Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

improve interoperability between self-signer in dev environments with openssl generated certs #2495

Merged
merged 1 commit into from
Jan 30, 2024

Conversation

havetisyan
Copy link
Collaborator

@havetisyan havetisyan commented Jan 28, 2024

Description

In a dev environment that is setup with our scripts, we using openssl to generate our self-signed server certs with the CA while the server is using the self signer library which uses BouncyCastle to sign the certificates.

During this process, openssl when it generates the server ca certs used in the trust store it uses DER PrintableString for the C component and UTF8String for all other components. BouncyCastle library, on the other hand, uses PrintableString for all the components.

Now, with curl, this is not a problem and curl determines that the server is accepting client connections from a given issuer. With Go, the tls module actually compares the DER encoding (RawIssuer field) and determines that the client certificate used in the TLSConfig object is not accepted by the server thus it ignores it.

Now, both BC library and openssl are using the same DER encoding and the self-signed certs work fine in a dev environment.

Contribution Checklist:

  • The pull request does not introduce any breaking changes
  • I have read the contribution guidelines.
  • Create an issue and link to the pull request.

Attach Screenshots (Optional)

… openssl generated certs

Signed-off-by: Henry Avetisyan <hga@yahooinc.com>
@havetisyan havetisyan merged commit 7f4e3e3 into master Jan 30, 2024
2 checks passed
@havetisyan havetisyan deleted the self-sign branch January 30, 2024 01:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants