cloudflare / cloudflare/cfssl

Issue with SANs Storage in Database: Only Domain Names are Saved

Open
#1,389 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

When issuing client certificates, I configure the CN (Common Name) as the User ID and SANs (Subject Alternative Names) as the User email. However, in the database, only the Domain Name (DNSName) is saved in the SANs field, ignoring other types like Email, IP Address, and URI. The issue seems to originate from the following code snippet in local.go:
```go
$ git diff signer/local/local.go
diff --git a/signer/local/local.go b/signer/local/local.go
index 091ce79c..c5c85d9a 100644
--- a/signer/local/local.go
+++ b/signer/local/local.go
@@ -525,7 +525,22 @@ func (s *Signer) Sign(req signer.SignRequest) (cert []byte, err error) {
if err := certRecord.SetMetadata(req.Metadata); err != nil {
return nil, err
}
- if err := certRecord.SetSANs(certTBS.DNSNames); err != nil {
+
+ var ipStrings []string
+ for _, ip := range certTBS.IPAddresses {
+ ipStrings = append(ipStrings, ip.String())
+ }
+
+ var uriStrings []string
+ for _, uri := range certTBS.URIs {
+ uriStrings = append(uriStrings, uri.String())
+ }
+
+ allSANs := append(certTBS.DNSNames, certTBS.EmailAddresses...)
+ allSANs = append(allSANs, ipStrings...)
+ allSANs = append(allSANs, uriStrings...)
+
+ if err := certRecord.SetSANs(allSANs); err != nil {
return nil, err
}

$
```
Please advise on how to modify the code to include all SANs types.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.