4 ms·
> services that generate malformed X.509 certs (golang's standard library…) In which way are those certificates malformed? Is it because they don't have the ex
by est31 5y ago
> services that generate malformed X.509 certs (golang's standard library…)
In which way are those certificates malformed? Is it because they don't have the extensions needed to pass certlint?
- deathanatos 5y agoMalformed subject, IIRC. It's not every cert, mind you (I didn't intend to imply that) it's just the ones that happen to not specify some element. Unfortunately, it's the default of a utility that we use, that's written in Go. It generates a very long-lived cert on start, and by default, it'll be malformed. We have another utility (that crawls certs looking for ones near expiry. That cert trips it up. (And it now has a configurable ignore-list specifically so that we can ignore that cert.) But more and more I appreciate libraries who (produce well-formed output) xor (error). Go also has a "simpler" interface to X.509 in its standard library that will easily produce the wrong (but well-formed; i.e., wrong semantically, not syntactically / not what any user is gong to want) output under very easy-to-accomplish circumstances.
- anitil 5y agoThis describes so much of my work. "We have a thing that does X. Except sometimes it doesn't, so we have another thing Y that checks X. Except sometimes it doesn't, so we .... "
- est31 5y agoThanks for this explanation! I'm always curious about such user stories because I maintain a library to generate certificates.
- deathanatos 5y agoI found the bug: https://github.com/bitnami-labs/sealed-secrets/issues/398 https://github.com/bitnami-labs/sealed-secrets/issues/398 — it's actually an empty Issuer DN. Seems like it was recently fixed too, which is nice. Now I'll have to find a way to upgrade…