You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficcontrol.apache.org by da...@apache.org on 2019/01/18 19:49:18 UTC
[trafficcontrol] branch master updated: Traffic Ops Delivery
Service - ADDSSLKeys API - Remove mandatory SKI/AKI extensions be present
in certificates (#3181) (#3211)
This is an automated email from the ASF dual-hosted git repository.
dangogh pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficcontrol.git
The following commit(s) were added to refs/heads/master by this push:
new 3e44782 Traffic Ops Delivery Service - ADDSSLKeys API - Remove mandatory SKI/AKI extensions be present in certificates (#3181) (#3211)
3e44782 is described below
commit 3e44782a8570a182220ed734216888ee48b17b8b
Author: Jeffrey Bevill <40...@users.noreply.github.com>
AuthorDate: Fri Jan 18 12:49:13 2019 -0700
Traffic Ops Delivery Service - ADDSSLKeys API - Remove mandatory SKI/AKI extensions be present in certificates (#3181) (#3211)
tested by @jhg03a
---
traffic_ops/traffic_ops_golang/deliveryservice/keys.go | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/traffic_ops/traffic_ops_golang/deliveryservice/keys.go b/traffic_ops/traffic_ops_golang/deliveryservice/keys.go
index 3dd2577..a8e8748 100644
--- a/traffic_ops/traffic_ops_golang/deliveryservice/keys.go
+++ b/traffic_ops/traffic_ops_golang/deliveryservice/keys.go
@@ -20,7 +20,6 @@ package deliveryservice
*/
import (
- "bytes"
"crypto/x509"
"database/sql"
"encoding/base64"
@@ -327,12 +326,14 @@ func verifyCertificate(certificate string, rootCA string) (string, bool, error)
}
pemEncodedChain := ""
for _, link := range chain[0] {
- // Only print non-self signed elements of the chain
- if link.AuthorityKeyId != nil && !bytes.Equal(link.AuthorityKeyId, link.SubjectKeyId) {
- block := &pem.Block{Type: "CERTIFICATE", Bytes: link.Raw}
- pemEncodedChain += string(pem.EncodeToMemory(block))
- }
- }
+ // Include all certificates in the chain, since verification was successful.
+ block := &pem.Block{Type: "CERTIFICATE", Bytes: link.Raw}
+ pemEncodedChain += string(pem.EncodeToMemory(block))
+ }
+
+ if len(pemEncodedChain) < 1 {
+ return "", false, errors.New("Invalid empty certicate chain in request")
+ }
return pemEncodedChain, false, nil
}