DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #1771 from aledbf/verifyHostname

Browse source 
Add additional check for old SSL certificates
This commit is contained in:
Manuel Alejandro de Brito Fontes 2017-11-30 10:34:51 -03:00 • committed by GitHub
commit 5482bca363
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 117 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
internal/ingress/controller/controller.go
View file

@ -1032,8 +1032,15 @@ func (n *NGINXController) createServers(data []*extensions.Ingress,
cert := bc.(*ingress.SSLCert)
err = cert.Certificate.VerifyHostname(host)
if err != nil {
glog.Warningf("ssl certificate %v does not contain a Common Name or Subject Alternative Name for host %v", key, host)
continue
glog.Warningf("unexpected error validating SSL certificate %v for host %v. Reason: %v", key, host, err)
glog.Warningf("Validating certificate against DNS names. This will be deprecated in a future version.")
// check the common name field
// https://github.com/golang/go/issues/22922
err := verifyHostname(host, cert.Certificate)
if err != nil {
glog.Warningf("ssl certificate %v does not contain a Common Name or Subject Alternative Name for host %v. Reason: %v", key, host, err)
continue
}
}
servers[host].SSLCertificate = cert.PemFileName