Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Warn on empty Subject field for issuers #15494

Merged
merged 2 commits into from
May 18, 2022
Merged

Conversation

cipherboy
Copy link
Contributor

When generating a root or signing an intermediate certificate, it is
possible to have Vault generate a certificate with an empty Subject.
These don't validate in most TLS implementations well, so add a warning.
Note that non-Common Name fields could be present to make a non-empty
subject, so simply requiring a CommonName isn't strictly the best.

For example:

$ vault write pki/root/generate/exported common_name=""
WARNING! The following warnings were returned from Vault:
  * This issuer certificate was generated without a Subject; this makes
  it likely that issuing leaf certs with this certificate will cause TLS
  validation libraries to reject this certificate.
....

Signed-off-by: Alexander Scheel <[email protected]>

When generating a root or signing an intermediate certificate, it is
possible to have Vault generate a certificate with an empty Subject.
These don't validate in most TLS implementations well, so add a warning.
Note that non-Common Name fields could be present to make a non-empty
subject, so simply requiring a CommonName isn't strictly the best.

For example:

    $ vault write pki/root/generate/exported common_name=""
    WARNING! The following warnings were returned from Vault:
      * This issuer certificate was generated without a Subject; this makes
      it likely that issuing leaf certs with this certificate will cause TLS
      validation libraries to reject this certificate.
    ....

Signed-off-by: Alexander Scheel <[email protected]>
@cipherboy cipherboy added this to the 1.11.0-rc1 milestone May 18, 2022
@cipherboy cipherboy requested review from sgmiller and a team May 18, 2022 13:22
Signed-off-by: Alexander Scheel <[email protected]>
@cipherboy
Copy link
Contributor Author

Thanks!

@cipherboy cipherboy merged commit ad18cc2 into main May 18, 2022
Gabrielopesantos pushed a commit to Gabrielopesantos/vault that referenced this pull request Jun 6, 2022
* Warn on empty Subject field for issuers

When generating a root or signing an intermediate certificate, it is
possible to have Vault generate a certificate with an empty Subject.
These don't validate in most TLS implementations well, so add a warning.
Note that non-Common Name fields could be present to make a non-empty
subject, so simply requiring a CommonName isn't strictly the best.

For example:

    $ vault write pki/root/generate/exported common_name=""
    WARNING! The following warnings were returned from Vault:
      * This issuer certificate was generated without a Subject; this makes
      it likely that issuing leaf certs with this certificate will cause TLS
      validation libraries to reject this certificate.
    ....

Signed-off-by: Alexander Scheel <[email protected]>

* Add changelog

Signed-off-by: Alexander Scheel <[email protected]>
@cipherboy cipherboy deleted the cipherboy-warn-empty-subject branch June 16, 2022 15:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants