{"action":"created","issue":{"url":"https://api.github.com/repos/google/easypki/issues/5","repository_url":"https://api.github.com/repos/google/easypki","labels_url":"https://api.github.com/repos/google/easypki/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/google/easypki/issues/5/comments","events_url":"https://api.github.com/repos/google/easypki/issues/5/events","html_url":"https://github.com/google/easypki/pull/5","id":185045957,"number":5,"title":"create intermediate CA certificates + bug fixes","user":{"login":"theckman","id":787332,"avatar_url":"https://avatars.githubusercontent.com/u/787332?v=3","gravatar_id":"","url":"https://api.github.com/users/theckman","html_url":"https://github.com/theckman","followers_url":"https://api.github.com/users/theckman/followers","following_url":"https://api.github.com/users/theckman/following{/other_user}","gists_url":"https://api.github.com/users/theckman/gists{/gist_id}","starred_url":"https://api.github.com/users/theckman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theckman/subscriptions","organizations_url":"https://api.github.com/users/theckman/orgs","repos_url":"https://api.github.com/users/theckman/repos","events_url":"https://api.github.com/users/theckman/events{/privacy}","received_events_url":"https://api.github.com/users/theckman/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-10-25T08:05:58Z","updated_at":"2016-10-28T04:27:40Z","closed_at":"2016-10-26T07:28:56Z","pull_request":{"url":"https://api.github.com/repos/google/easypki/pulls/5","html_url":"https://github.com/google/easypki/pull/5","diff_url":"https://github.com/google/easypki/pull/5.diff","patch_url":"https://github.com/google/easypki/pull/5.patch"},"body":"**Note**: This change introduces breaking changes to the `easypki` API:\r\n\r\n* The `GenerateCertificate` function had a typo in its name. It used to\r\n  be `GenerateCertifcate` (missing an `i`).\r\n* The `GenerateCertificate` function now takes a struct as a parameter,\r\n  making it easier to use.\r\n\r\nThe main reason behind this change was to provide the ability to\r\ngenerate intermediate CA certificates. This will allow people and\r\norganizations to use `easypki` to create a multi-layered tree of trust.\r\nIn addition to that, the ability to set the maximum path length on CA\r\ncertificates was added to make the keys safer (less prone for abuse).\r\n\r\nYou can now generate intermediate certificates using the\r\n`--intermediate` flag. This flag effectively creates a new CA\r\ncertificate, within the CA, but doesn't overwrite the `ca.crt` or\r\n`ca.key` file. Instead, it uses the same logic as regular certificates\r\nand saves the cert and key within the `issued/` and `private/`\r\ndirectories respectively. It's suggested that the `--max-path-len` flag\r\nbe used when generating CA certificates.\r\n\r\nYou can now set the maximum path depth for a CA certificate by using the\r\n`--max-path-len` flag. If you want to generate an offline root CA and\r\nensure that your intermediates cannot generate valid intermediate CA\r\ncertificates themselves, you would set `--max-path-len 1` when\r\ngenerating the root CA. It's recommended to always use this flag when\r\ngenerating CA certificates, otherwise that certificate will be valid for\r\nan \"infinite\" number of intermediate certificates.\r\n\r\nWith the features above added, a few bugs were discovered in the\r\ncertificates being generated by `easypki`. Specifically we needed to fix\r\nsome issues with the KeyUsage and ExtKeyUsage settings of the certs.\r\n\r\nWhile troubleshooting an issue with Consul, trying to do\r\nverification of a TLS chain generated by `easypki`, I ran in to a\r\nsituation where the certificates were failing to validate. It turns out\r\nthere were a few issues that caused this to happen.\r\n\r\nI found an issue on Hashicorp's Vault project referencing a similar\r\nissue with CA certificates generated by Vault itself. This guided me to\r\nthe first bug that needed patching:\r\n\r\n* https://github.com/hashicorp/vault/pull/852\r\n\r\n>Assign ExtKeyUsageAny to CA certs to help with validation with the\r\n>Windows Crypto API and Go's validation logic\r\n\r\nThe solution: when generating CAs, we now set the `ExtKeyUsage` to\r\n`ExtKeyUsageAny`. This will mark the CA certificate as being valid for\r\nany usage. Some X.509 validation systems require that all certificates\r\nin the chain contain the requested usage, including in Go.\r\n\r\nThe second was that the server certificates weren't being assigned\r\n`ExtKeyUsageClientAuth` causing issues with applications trying to use\r\nthe certificates as both client and server certificates. The fix is to\r\nalso give server certificates `ExtKeyUsageClientAuth`. Upon\r\ninvestigation of certificates deployed for public Internet services, it\r\nseems that `ExtKeyUsageClientAuth` is pretty common in server\r\ncertificates.\r\n\r\nfixes #2\r\nfixes #3\r\nfixes #4"},"comment":{"url":"https://api.github.com/repos/google/easypki/issues/comments/256833588","html_url":"https://github.com/google/easypki/pull/5#issuecomment-256833588","issue_url":"https://api.github.com/repos/google/easypki/issues/5","id":256833588,"user":{"login":"theckman","id":787332,"avatar_url":"https://avatars.githubusercontent.com/u/787332?v=3","gravatar_id":"","url":"https://api.github.com/users/theckman","html_url":"https://github.com/theckman","followers_url":"https://api.github.com/users/theckman/followers","following_url":"https://api.github.com/users/theckman/following{/other_user}","gists_url":"https://api.github.com/users/theckman/gists{/gist_id}","starred_url":"https://api.github.com/users/theckman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theckman/subscriptions","organizations_url":"https://api.github.com/users/theckman/orgs","repos_url":"https://api.github.com/users/theckman/repos","events_url":"https://api.github.com/users/theckman/events{/privacy}","received_events_url":"https://api.github.com/users/theckman/received_events","type":"User","site_admin":false},"created_at":"2016-10-28T04:27:40Z","updated_at":"2016-10-28T04:27:40Z","body":"@jeremy-clerc thank you for the quick turn-around on the issues and the code review. Much appreciated!"}}
{"actor":{"display_login":"theckman"}}