Page MenuHomePhabricator

Puppet host certs do not contain Subject Alt Name entries
Closed, DeclinedPublic


The upstream bug is here:

This means the puppet certs are not compliant with modern standards. E.g. golang 1.15 no longer supports these certs by default. The workaround for go will disappear in future versions.

Event Timeline

jbond triaged this task as Medium priority.Feb 2 2021, 4:14 PM
jbond added projects: CAS-SSO, Puppet.

@Kormat is this blocking something, currently there is no plan to fix this untill we upgrade to puppet server 6 (for which there is no timeline, package is still not building in Debian upstream). I would say that anything which needs SAN certificates should be migrated away from the puppet certs to the new pki service.

also noting here that we have implemented the workaround above in the cfssl::cert define

@jbond: Using the env var workaround for services works for the moment, so long as:

  • we're using upstream's binary and they compile it with golang < 1.17
  • we're compiling the binary ourselves and the source doesn't require golang 1.17

It gets painful for cmdline binaries, though. I guess you're stuck with moving the real binary out of $PATH, and putting in a wrapper script that sets the env var, so that all callers will have it set.
I'm currently compiling with go1.14 to avoid that mess, for now.

Aklapper added a subscriber: jbond.

@jbond: Removing task assignee as this open task has been assigned for more than two years - See the email sent to task assignee on Feburary 22nd, 2023.
Please assign this task to yourself again if you still realistically [plan to] work on this task - it would be welcome! :)
If this task has been resolved in the meantime, or should not be worked on by anybody ("declined"), please update its task status via "Add Action… 🡒 Change Status".
Also see for tips how to best manage your individual work in Phabricator. Thanks!

@jbond this should be fixed, following the Puppet 7 upgrade. Do we have any way of noting post puppet 7 followup tasks?

@jhathaway not currently but we could request a new tag or possibly a milestone. @Aklapper are you able to offer any advice on this, thanks?

are you able to offer any advice on this, thanks?

See "Request a project" on the default front page

It's going to be fixed with puppet 7 upgrade.