xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2025-05-30 09:36:41 +00:00
Code Issues Releases Wiki Activity

Merge pull request #754 from xuweibj/SAN

Browse Source 
Set the FQDN in the xcatd certificate, use subjectAltNames
This commit is contained in:
Xiaopeng Wang 2016-03-01 22:26:02 +08:00
commit ad24234659
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
xCAT-server/share/xcat/ca/openssl.cnf.tmpl
View File

@ -225,6 +225,9 @@ authorityKeyIdentifier=keyid,issuer
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ san_env ]
subjectAltaName = ${ENV::SAN}
[ v3_ca ]

3
xCAT-server/share/xcat/scripts/setup-server-cert.sh
View File

@ -23,6 +23,7 @@ fi
mkdir -p $XCATDIR/cert
cd $XCATDIR/cert
openssl genrsa -out server-key.pem 2048
export SAN=DNS:`hostname --long`,DNS:`hostname --short`
openssl req -config $XCATCADIR/openssl.cnf -new -key server-key.pem -out server-req.pem -extensions server -subj "/CN=$CNA"
cp server-req.pem $XCATDIR/ca/`hostname`.csr
cd -
@ -33,7 +34,7 @@ cd $XCATDIR/ca
# - call cmds directly instead - seems safe
# make sign
openssl ca -startdate 600101010101Z -config openssl.cnf -in `hostname`.csr -out `hostname`.cert -extensions server
openssl ca -startdate 600101010101Z -config openssl.cnf -in `hostname`.csr -out `hostname`.cert -extensions server -extensions san_env
if [ -f `hostname`.cert ]; then
rm `hostname`.csr
fi