hashicorp / hashicorp/consul

Authorize endpoint: allow serial number without colons

Open
#4,327 1 comment 0 reactions 0 assignees View on GitHub
theme/connect type/enhancement
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

#### Feature Description

In Consul's Connect Authorize endpoint, the documentation of `/agent/connect/authorize` path requires `ClientCertSerial` to be provided with "the colon-hex-encoded serial number".
See: https://www.consul.io/api/agent/connect.html#clientcertserial

While possibly making the serial number more human readable, the colon-hex encoding might have some drawbacks.

In particular, despite being common representation for Go-based clients, colon-hex encoding does not seem to be the default for popular OpenSSL conversion functions, such as `BN_bn2hex()`.
See: https://www.openssl.org/docs/man1.1.0/crypto/BN_bn2hex.html

It is true that colons can later be added as a delimiter to the output of OpenSSL functions such as `BN_bn2hex()`. However, it might be easier, more efficient and more elegant to rather make the server side accept serial numbers represented in hexadecimal encoding without colons.

IIUC, the server-side code that handles certificate serial numbers is not implemented yet.
See: https://github.com/hashicorp/consul/blob/b5abf61963c7b0bdb674602bfb64051f8e23ddb1/agent/agent_endpoint.go#L1232

Therefore, I would like to propose this enhancement to the API before the server-side code is implemented. In the meantime, this merely requires a modifying the docs.

#### Use Case(s)

This enhancement can be useful for Authorize endpoint REST clients which use OpenSSL, such as C/C++ clients.

Contributor guide

Open the contributing guide

Research direction

Start with the referenced agent/agent_endpoint.go location and the /agent/connect/authorize documentation. Confirm whether ClientCertSerial handling exists and determine how colon-free hexadecimal serials should be accepted; done means the endpoint behavior and its documentation consistently describe and support the proposed representation.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, documentation
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.