mirror of
https://github.com/dehydrated-io/dehydrated.git
synced 2026-07-22 04:48:33 +02:00
CSR Subject from OPENSSL_CNF ignored #298
Assignees
adam (Adam Melkus)
Clear assignees
adam (Adam Melkus)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/dehydrated#298
Reference in New Issue
Block a user
Originally created by @nova-2nd on GitHub (Mar 13, 2018).
Hi Lukas,
First of all, great piece of code. I really, really like it.
In my certificates I like to have a complete Distinguished Name (Subject) containing, company name, state, locality and so on. Nothing really outstanding.
I was pleased to see that there is an OPENSSL_CNF variable in the config to link to a corresponding OpenSSL template.
Unfortunately, in your function creating your CSR (sign_domain(), line: 803) as you call openssl, you use the option -subj, which replaces whatever configured DN, with what you give then. In dehydrator's case, the common name only.
An easy fix to this could be instead of giving the CN to openssl via an argument, simply stick it into the temporary openssl config, you already have (tmp_openssl_cnf).
Let me know if you are interested in code contributions or prefer to fix "simples" like this yourself.
Greets,
Stefan
@jobe1986 commented on GitHub (Mar 13, 2018):
Are you using dehydrated with Let's Encrypt? If so as I started in issue #439, it is worth noting LetsEncrypt strips out any fields from the subject identifier other then a commonName (CN) containing the primary host name of the certificate. So even if your CSR contained them, the certificate issued by LetsEncrypt would not.
Basically the only time allowing additional fields in the subject would be acceptable is if you're using dehydrated with an ACME certificate authority service that allows fields other then commonName (CN) in the subject
@lukas2511 commented on GitHub (Mar 13, 2018):
As @jobe1986 said Let's Encrypt strips those parameters, only CN will be set.
Reason is that only the domain is validated, the CAs don't want to sign any other (unvalidated) information like an organizations name.
@nova-2nd commented on GitHub (Mar 13, 2018):
Hi jobe1986,
Hi lukas2511,
Sorry for wasting you time, wasn't aware of Lets Encrypt is stripping the DN. WHY???
Whatever, thank you guys.
Greets,
Stefan
@lukas2511 commented on GitHub (Mar 13, 2018):
@nova-2nd like i said: "Reason is that only the domain is validated, the CAs don't want to sign any other (unvalidated) information like an organizations name."