Authorize endpoint: allow serial number without colons
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
#### Feature Description
In Consul's Connect Authorize endpoint, the documentation of `/agent/connect/authorize` path requires `ClientCertSerial` to be provided with "the colon-hex-encoded serial number".
See: https://www.consul.io/api/agent/connect.html#clientcertserial
While possibly making the serial number more human readable, the colon-hex encoding might have some drawbacks.
In particular, despite being common representation for Go-based clients, colon-hex encoding does not seem to be the default for popular OpenSSL conversion functions, such as `BN_bn2hex()`.
See: https://www.openssl.org/docs/man1.1.0/crypto/BN_bn2hex.html
It is true that colons can later be added as a delimiter to the output of OpenSSL functions such as `BN_bn2hex()`. However, it might be easier, more efficient and more elegant to rather make the server side accept serial numbers represented in hexadecimal encoding without colons.
IIUC, the server-side code that handles certificate serial numbers is not implemented yet.
See: https://github.com/hashicorp/consul/blob/b5abf61963c7b0bdb674602bfb64051f8e23ddb1/agent/agent_endpoint.go#L1232
Therefore, I would like to propose this enhancement to the API before the server-side code is implemented. In the meantime, this merely requires a modifying the docs.
#### Use Case(s)
This enhancement can be useful for Authorize endpoint REST clients which use OpenSSL, such as C/C++ clients.
Contributor guide
Research direction
Start with the referenced agent/agent_endpoint.go location and the /agent/connect/authorize documentation. Confirm whether ClientCertSerial handling exists and determine how colon-free hexadecimal serials should be accepted; done means the endpoint behavior and its documentation consistently describe and support the proposed representation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, documentation
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100