From 861db7bf4e34f255d449cebe88686863982841c2 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 4 Apr 2021 13:43:30 +0200 Subject: [PATCH 1/2] Fix minor local dev environment issue Signed-off-by: Erik Godding Boye --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 91fa83ba2..956c2477d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ .DS_Store .idea +*.iml /acmesolver /controller /ingress-shim From bbafeeef67de3ef406f4e2cf501e52395877a582 Mon Sep 17 00:00:00 2001 From: Erik Godding Boye Date: Sun, 4 Apr 2021 14:30:05 +0200 Subject: [PATCH 2/2] fix #3619: Handle CA issuer working as intermediate correctly Signed-off-by: Erik Godding Boye --- pkg/util/pki/csr.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkg/util/pki/csr.go b/pkg/util/pki/csr.go index 1eef77448..6751c046b 100644 --- a/pkg/util/pki/csr.go +++ b/pkg/util/pki/csr.go @@ -424,9 +424,9 @@ func SignCSRTemplate(caCerts []*x509.Certificate, caKey crypto.Signer, template return nil, nil, errors.New("no CA certificates given to sign CSR template") } - caCert := caCerts[0] + issuingCACert := caCerts[0] - certPem, _, err := SignCertificate(template, caCert, template.PublicKey, caKey) + certPem, _, err := SignCertificate(template, issuingCACert, template.PublicKey, caKey) if err != nil { return nil, nil, err @@ -440,7 +440,8 @@ func SignCSRTemplate(caCerts []*x509.Certificate, caKey crypto.Signer, template certPem = append(certPem, chainPem...) // encode the CA certificate to be bundled in the output - caPem, err := EncodeX509(caCerts[0]) + caCert := caCerts[len(caCerts)-1] + caPem, err := EncodeX509(caCert) if err != nil { return nil, nil, err }