test: make SSL certificates a bit more realistic. #1228
Conversation
This commit includes few of small changes: - all certificates are generated with X509v3 extensions, and have "Subject Key Identifier" and "Authority Key Identifier" set, - CA certificates have "Basic Constraints: CA:TRUE", - leaf certificates have "Extended Key Usage" set, - "California" is used consistently for the state name, - "Lyft Engineering" is used for the Organizational Unit. No functional changes. Signed-off-by: Piotr Sikora <piotrsikora@google.com>
|
@mattklein123 @myidpt PTAL, I've made most of those changes while chasing #1220, so I figured that I might as well send them out. However, none of them are really necessary, so feel free to reject this PR (or parts of it). Also, please note that |
| extendedKeyUsage = clientAuth, serverAuth | ||
| subjectAltName = @alt_names | ||
| subjectKeyIdentifier = hash | ||
| authorityKeyIdentifier = keyid:always | ||
|
|
||
| [alt_names] | ||
| URI.1 = istio:account1.foo.cluster.local |
There was a problem hiding this comment.
Since you are changing the cert fields, could you change this (and corresponding tests) to:
spiffe://lyft.com/foo
Istio auth has recently changed the SAN format. We have updated other certs but not this one, so it would be great to keep them consistent :)
|
This is fine with me as long as @myidpt is good with it. @PiotrSikora will approve/merge once you fix his small comment. |
Signed-off-by: Piotr Sikora <piotrsikora@google.com>
|
@htuch OpenSSL config files don't support includes, and automagically merging them during @myidpt @mattklein123 Done. |
This commit includes few of small changes:
"Subject Key Identifier" and "Authority Key Identifier" set,
No functional changes.