Icinga/icingaweb2-module-x509

Use SAN attribute for cert name if CN is not available

manfredw opened this issue · 3 comments

manfredw commented

Certificates that use only Subject Alternative Names (SAN) attribute without CN attribute (which is not mandatory when SAN is used) leads to a Icingaweb2 X509 certificate list with an empty certificate name.

If there is no CN present in the certificate, the x509-module should use i.e. the first DNS or IP Address entry from SAN attribute.

There seems to be no alternative, because due to different CA policies and automated cert generation I'm not able to enforce the issuer to use the CN attribute.

lippserd commented

Sounds good.

lippserd commented

I would try to parse the extension fields in the following order and use the first set field:

  • dNSName
  • rfc822Name
  • URI
  • iPAddress
  • First value

@manfredw Does that make sense?

  • 👍1
manfredw commented

I would try to parse the extension fields in the following order and use the first set field:

* dNSName

* rfc822Name

* URI

* iPAddress

* First value

@manfredw Does that make sense?

Yes, this makes sense - please implement it that way :-)