{"push_id":1363217525,"size":1,"distinct_size":1,"ref":"refs/heads/supereasypki","head":"c383bfedc03a11cb1745689671967aa337d25412","before":"5e2628ee3910e01d38d95d10ad122eff1e227956","commits":[{"sha":"c383bfedc03a11cb1745689671967aa337d25412","author":{"name":"Tim Heckman","email":"213c4738cc35c04f021cb47d03c4226bdf330636@heckman.io"},"message":"fix issues with KeyUsage and ExtKeyUsage settings\n\nWhile troubleshooting an issue with Consul program trying to do\nverification of a TLS chain generated by `easypki`, I ran in to an\nissue where the certificates were failing to validate. It turns out\nthere were a few issues that caused this to happen.\n\nUpon further investigation, I found an issue on Hashicorp's Vault\nproject referencing a similar issue with CA certificates generated by\nVault itself. This lead me to the first bug to be patched:\n\n* https://github.com/hashicorp/vault/pull/852\n\n>Assign ExtKeyUsageAny to CA certs to help with validation with the\n>Windows Crypto API and Go's validation logic\n\nThe solution: when generating CAs, we now set the `ExtKeyUsage` to\n`ExtKeyUsageAny`. This should avoid part of the issue.\n\nThe second was that the server certificates weren't being assigned\n`ExtKeyUsageClientAuth` causing issues with applications trying to use\nthe certificates as both client and server certificates. The fix is to\nalso give server certificates `ExtKeyUsageClientAuth`.","distinct":true,"url":"https://api.github.com/repos/theckman/easypki/commits/c383bfedc03a11cb1745689671967aa337d25412"}]}
{"actor":{"display_login":"theckman"}}