Re: [PATCH v3 1/3] vpnmain.cgi: set SubjectAlternativeName default during root certificate generation

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1429 bytes --]

Hi,

> On 9 Jan 2020, at 15:20, Peter Müller <peter.mueller(a)ipfire.org> wrote:
> 
> Hello Michael,
> 
> thanks for your reply. In my opinion: Partly. :-)
> 
> Actually, the code allows arbitrary user input as log as _any_
> SubjectAlternativeName is provided during root/host certificate
> generation. As far as I can recall, this is exactly what we agreed
> on.

Yes, we wanted to allow users to set whatever they want here in addition to the default which is the FQDN of the firewall.

> Regarding the FQDN, I do not think it makes sense to use IPFire's
> hostname unconditionally: Most installations will not even have a
> valid FQDN assigned to red0, not to mention missing DNS records if
> the latter one is present.

If people set an invalid FQDN, that is a configuration issue I believe.

> Thereof, I consider using the same value filled into "$ROOTCERT_HOSTNAME"
> as a SubjectAlternativeName makes sense.

And the default is the FQDN here?

> 
> Thanks, and best regards,
> Peter Müller
> 
> 
>> Hi,
>> 
>> I am not sure about the change of behaviour here.
>> 
>> I thought the consensus in the telephone conference was to always set it to the FQDN of the IPFire box and accept any additional values from the user. So it will always be set.
>> 
>> The code looks like it does not do that.
>> 
>> Did I get it wrong what we agreed on in the end?
>> 
>> -Michael
>> 
>