Adds capability to define EKUs to be included in CSRs #527
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ly during enroll & gencsr
BeardedPrincess
requested review from
rvelaVenafi,
marcos-albornoz,
luispresuelVenafi and
EduardoVV
as code owners
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In some instances, it may be necessary to include desired EKUs within the CSR when vCert is responsible for generating the private key and subsequent CSR. The vast majority of CAs will ignore this, and issue certificates with properties governed by the CA. However, we have recently encountered one instance where the upstream CA requires for these to be included within the CSR.
This PR primarily adds a new hidden cmdLine flag to the CLI (
--eku) which can be used during enroll or gencsr to include additional EKUs as defined. This is limited to currently known and supported EKUs in the crypto/x509 library. This functionality is also extended to the playbook use-case as well, by introducing a new YAML field (eKU) within the request section of a certificate task.Furthermore, this PR exposes the
crypto/x509.CertificateRequest.ExtraAttributesproperty through thevcert/certificate.Requestobject which will enable developers using vCert SDK to add additional attributes to the CSR during the request process enabling use-cases that would otherwise require changes directly to the SDK. This was done because the current Attributes property is being deprecated.