Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

the CA cert's SAN extensions not include DNSName.

Open
  • Is something wrong?
#1,276 5 comments 1 reaction 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
go
Domain
cryptography, security

Research direction

Start in signer/signer.go at FillTemplate, then trace the signing path used by the intermediate_ca profile in ca-config.json. Reproduce the commands from the issue and inspect the resulting certificate's SAN extension; done means the intended DNSName behavior for CA certificates is established and covered by an appropriate test.

Written by the indexing model from the issue text.

Description

I use cfssl to sign a intermedia-ca. the intermediate-ca.json has "hosts" config:

{
  "CN": "Custom Widgets Intermediate CA",
  "hosts": [
    "host1.custom-widgets.com",
    "localhost",
    "192.168.1.3"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C":  "GB",
      "L":  "London",
      "O":  "Custom Widgets",
      "OU": "Custom Widgets Intermediate CA",
      "ST": "England"
    }
  ],
  "ca": {
    "expiry": "42720h"
  }
}

The signed intermedia-ca cert only include the ip address "192.168.1.3", But the dnsname ""host1.custom-widgets.com" and "localhost" not include。

I used the ca-config.json:

{
  "signing": {
    "default": {
      "expiry": "8760h"
    },
    "profiles": {
      "intermediate_ca": {
        "usages": [
            "signing",
            "digital signature",
            "key encipherment",
            "cert sign",
            "crl sign",
            "server auth",
            "client auth"
        ],
        "expiry": "8760h",
        "ca_constraint": {
            "is_ca": true,
            "max_path_len": 0, 
            "max_path_len_zero": true
        }
      }
    }
  }
}

I use these command

cfssl gencert -initca intermediate-ca.json | cfssljson -bare intermediate_ca
cfssl sign -ca ca.pem -ca-key ca-key.pem -config ca-config.json -profile intermediate_ca intermediate_ca.csr | cfssljson -bare intermediate_ca

I found the function FillTemplate in the source signer/signer.go has these code

     if template.IsCA {
		template.MaxPathLen = profile.CAConstraint.MaxPathLen
		if template.MaxPathLen == 0 {
			template.MaxPathLenZero = profile.CAConstraint.MaxPathLenZero
		}
		template.DNSNames = nil
		template.EmailAddresses = nil
		template.URIs = nil
	}

the DNSNames set to nil.
so is this a mistake or am I missing something? Thank you!

Dominant language
Go
Stars
9.5k
Forks
1.2k
Avg merge
5d 1h
Merged PRs (30d)
5

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudflare/cfssl

All issues in cloudflare/cfssl

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.