{"action":"created","issue":{"url":"https://api.github.com/repos/PowerShell/xCertificate/issues/39","repository_url":"https://api.github.com/repos/PowerShell/xCertificate","labels_url":"https://api.github.com/repos/PowerShell/xCertificate/issues/39/labels{/name}","comments_url":"https://api.github.com/repos/PowerShell/xCertificate/issues/39/comments","events_url":"https://api.github.com/repos/PowerShell/xCertificate/issues/39/events","html_url":"https://github.com/PowerShell/xCertificate/issues/39","id":198099146,"number":39,"title":"[New Feature] xCertReq: SubjectAltName to automatically contain ComputerName and/or FQDN","user":{"login":"PlagueHO","id":7589164,"avatar_url":"https://avatars.githubusercontent.com/u/7589164?v=3","gravatar_id":"","url":"https://api.github.com/users/PlagueHO","html_url":"https://github.com/PlagueHO","followers_url":"https://api.github.com/users/PlagueHO/followers","following_url":"https://api.github.com/users/PlagueHO/following{/other_user}","gists_url":"https://api.github.com/users/PlagueHO/gists{/gist_id}","starred_url":"https://api.github.com/users/PlagueHO/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PlagueHO/subscriptions","organizations_url":"https://api.github.com/users/PlagueHO/orgs","repos_url":"https://api.github.com/users/PlagueHO/repos","events_url":"https://api.github.com/users/PlagueHO/events{/privacy}","received_events_url":"https://api.github.com/users/PlagueHO/received_events","type":"User","site_admin":false},"labels":[{"id":202109314,"url":"https://api.github.com/repos/PowerShell/xCertificate/labels/enhancement","name":"enhancement","color":"84b6eb","default":true},{"id":202109315,"url":"https://api.github.com/repos/PowerShell/xCertificate/labels/help%20wanted","name":"help wanted","color":"159818","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-30T03:11:48Z","updated_at":"2016-12-31T22:39:32Z","closed_at":null,"body":"One common way we use xCertReq is to request certificates for web servers that have both a CNAME and a computer name + FQDN. E.g.\r\n```\r\ndns=www.contoso.com&dns=webserver99232&dns=webserver99232.contoso.local\r\n```\r\n\r\nIt would be awesome if the SubjectAltName could be specified in such a way that the computername and FQDN were filled in automatically by the xCertReq resource at apply time (not at compile time). E.g.\r\n```\r\nSubjectAltName = 'dns=www.contoso.com&dns={ComputerName}&dns={FQDN}'\r\n```\r\n\r\nAt apply time the SubjectAltName could be adjusted by the xCertReq to be:\r\n```\r\nSubjectAltName = 'dns=www.contoso.com&dns=webserver99232&dns=webserver99232.contoso.local'\r\n```\r\nbased on the computer applying the DSC config. This enables a single DSC config work on any number of machines (e.g. a web farm). I know that certificate wildcards could also solve this problem, but our security team would prefer to not use this.\r\n\r\nI could submit the change for this feature if acceptable."},"comment":{"url":"https://api.github.com/repos/PowerShell/xCertificate/issues/comments/269884458","html_url":"https://github.com/PowerShell/xCertificate/issues/39#issuecomment-269884458","issue_url":"https://api.github.com/repos/PowerShell/xCertificate/issues/39","id":269884458,"user":{"login":"johlju","id":7189721,"avatar_url":"https://avatars.githubusercontent.com/u/7189721?v=3","gravatar_id":"","url":"https://api.github.com/users/johlju","html_url":"https://github.com/johlju","followers_url":"https://api.github.com/users/johlju/followers","following_url":"https://api.github.com/users/johlju/following{/other_user}","gists_url":"https://api.github.com/users/johlju/gists{/gist_id}","starred_url":"https://api.github.com/users/johlju/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johlju/subscriptions","organizations_url":"https://api.github.com/users/johlju/orgs","repos_url":"https://api.github.com/users/johlju/repos","events_url":"https://api.github.com/users/johlju/events{/privacy}","received_events_url":"https://api.github.com/users/johlju/received_events","type":"User","site_admin":false},"created_at":"2016-12-31T22:39:32Z","updated_at":"2016-12-31T22:39:32Z","body":"If that is an optional parameter I see no problem having that functionality. It would be a great addition. \r\n\r\nI guess one scenario would be when you want to try to monitor each back-end from the load balancer. Or just manually test if each node work, and don't want to get certificate error.\r\n\r\nWildcard certificates are only good (security-wise) if you can make a sub dns zone. Would not want a wildcard certificate on the top level dns zone. 😄 "}}
{"actor":{"display_login":"johlju"}}