cloudflare / cloudflare/cfssl

Multiple OU names in signer.SignRequest.Subject.Names can't be hierarchical

Open
#824 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

My scenario is as follows ...

I have client and server components built on top of cfssl. The client sends a CSR to the server and I need to add an OU hierarchy to the CSR before signing. So I add multiple csr.Name entries (from cfssl/csr/csr.go) to SignRequest.Subject.Names (defined in cfssl/signer/signer.go). However, the
Name function at https://github.com/cloudflare/cfssl/blob/master/signer/signer.go#L72 always squashes names of the same type into a single RDN. So there is no way for the server to add an OU hierarchy to the SignRequest.

So I have multiple questions:
1) Am I missing something? Is there a way for the server to add an OU hierarchy?
2) If not, is anything in plan to permit this?
3) If not, I would be glad to create a pull request, but I'd like to get approval on my approach before beginning. In order to not break existing code, I would add the "Names2" field to the "Subject" struct below. If it is set, we would gnore the "Names" field. The value of each element of the "Name2" field must be either a *csr.Name type or a []csr.Name type. This would allow us to represent both an RDNSequence and a multi-valued RDN.

{code}
// Subject contains the information that should be used to override the
// subject information when signing a certificate.
type Subject struct {
CN string
Names []csr.Name `json:"names"`
Names2 []interface{} `json:"names2"`
SerialNumber string
}
{code}

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.