TLS server cert is CN-only (no SANs), blocks Go @customCert e2e
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- go
- Domain
- security, testing-qa
Research direction
Start with /ssl/server-cert.pem and the @customCert SSL e2e scenarios, especially the Go flagd provider exclusions. Regenerate the certificate with SANs for localhost and 127.0.0.1, then run the SSL variants of Connection and Provider reconnection to confirm Go no longer rejects them.
Written by the indexing model from the issue text.
Description
The TLS server certificate baked into the image (/ssl/server-cert.pem) is CN-only (CN=localhost) with no Subject Alternative Names, which Go's crypto/tls rejects because it has required SANs and ignored the CN field since Go 1.15. This blocks the @customCert / ssl e2e scenarios (the ssl variants of Connection and Provider reconnection) for the Go flagd provider, which currently excludes them; Java and JS still accept CN-only certs so they are unaffected for now. The server cert should be regenerated with SANs covering localhost and 127.0.0.1 so Go (and eventually other stacks, which are also moving away from CN) can run the TLS scenarios.
- Dominant language
- Gherkin
- Stars
- 5
- Forks
- 14
- Avg merge
- 3h 17m
- Merged PRs (30d)
- 13
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from open-feature/flagd-testbed
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
open-feature/flagd-testbed#398 ·
-
`/start` should restore the baseline flag state, and skip the restart when the config is unchanged Openenhancement
Difficulty 4/5 3-5 days Newbie friendliness 25/100
open-feature/flagd-testbed#395 ·
-
Make reconnect/grace timing self-documenting (grace vs downtime is currently hidden in step code) Open
open-feature/flagd-testbed#389 · 1 assignee ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
open-feature/flagd-testbed#379 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 76/100
open-feature/flagd-testbed#374 ·
All issues in open-feature/flagd-testbed
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
AXERA-TECH/ax-llm#75 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
TheManticoreProject/Manticore#1383 ·
-
auth bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100