gencert with -initca ignores most config arguments
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
Research direction
Reproduce the cfssl gencert -initca command with -profile, -config, -ca, and -ca-key, then trace the initca argument-handling and certificate-generation paths. Done means the intermediate profile is applied to the generated CA, or ignored options produce a clear warning; inspect the resulting certificate to verify the behavior.
Written by the indexing model from the issue text.
Description
Context
Creating a certificate authority using a two-tier key heirarchy. Root here is used ONLY to generate a new CA, and is stored in a 'secure' location under my bed
Usage
cfssl gencert -initca -profile intermediate -config config.json -ca root.pem -ca-key root-key.pem ca-csr.json
Expected outcome:
Generates a new CA certificate signed by the Root certificate, which includes the options specified by the profile "intermediate" in config.json
Actual outcome:
Generates a basic self signed certificate as if no options were specified.
Workaround 1
Generate and sign the certificate as two separate steps i.e.
cfssl gencert -initca csr.json | cfssljson -bare ca
cfssl sign -profile intermediate -config config.json ...
Workaround 2
Including
"ca_constraint": {
"is_ca": true
}
in the config.json profile for a certificate has a similar outcome.
Notes
This can be confusing to understand, especially considering the documentation makes no mention of keys invalidating other keys. In this case, I was unaware that my config options were being ignored until inspected the certificate directly. Would be handy to have a warning if arguments are discarded.
Thanks! :)
- Dominant language
- Go
- Stars
- 9.5k
- Forks
- 1.2k
- Avg merge
- 12h 48m
- Merged PRs (30d)
- 2
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudflare/cfssl
-
gencrl: serial numbers that fail to parse are added to the CRL as 0 or a partial valuePossibly taken @sebxt claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/cfssl#1460 ·
Maintainers usually reply within 2 days
-
`Bundler.BundleFromRemote` fails for IPv6 address literalsPossibly taken @reginaldalfret claimed this 14 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
cloudflare/cfssl#1448 ·
Maintainers usually reply within 2 days
-
crl_override (and extensions) in /api/v1/sign request body are silently ignored by the HTTP APIPossibly taken @Hashim1999164 claimed this 69 days ago. Open
Difficulty 2/5 Half a day Newbie friendliness 78/100
cloudflare/cfssl#1439 ·
Maintainers usually reply within 2 days
-
gencrl silently revokes the wrong serial number when a line is not plain decimalPossibly taken @RaphaelFakhri claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 30/100
cloudflare/cfssl#1458 ·
Maintainers usually reply within 2 days
-
config: LoadConfig panics when not_after is before not_beforePossibly taken @sebxt claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
cloudflare/cfssl#1456 ·
Maintainers usually reply within 2 days
All issues in cloudflare/cfssl
Similar issues
-
🕷️ bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
sysadminsmedia/homebox#1805 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
router-for-me/CLIProxyAPI#6851 ·
Maintainers usually reply within 1 day
-
usage: a custom provider's balance meters ("…%" in the balance path) ignore the Left/Used switchOpen
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
[bug]: docs: Update webhook delete examples to use the correct flag (--webhook-id)Possibly taken @MuhammadHassan968 claimed this today. Openbug
Difficulty 1/5 Under an hour Newbie friendliness 84/100
goharbor/harbor-cli#1127 ·
Maintainers usually reply within 12 days