Bug 11594 - use SubjectAltName for IPsec root/host certificate
Summary: use SubjectAltName for IPsec root/host certificate
Status: CLOSED FIXED
Alias: None
Product: IPFire
Classification: Unclassified
Component: --- (show other bugs)
Version: 2
Hardware: all All
: Will only affect a few users Major Usability
Assignee: Peter Müller
QA Contact:
URL:
Keywords:
Depends on:
Blocks: IPSECBUGS
  Show dependency tree / graph
 
Reported: 2018-01-14 13:37 UTC by Peter Müller
Modified: 2020-03-07 09:23 UTC (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Müller 2018-01-14 13:37:19 UTC 
Currently, the hostnames for IPsec certificates are saved as "Common Names" (CN).

Some programs (such as iked on OpenBSD) require SubjectAltNames to be set, and it seems like this is best practise now: http://wiki.cacert.org/FAQ/subjectAltName

So we can just set SubjectAltNames with a copy of the CN...
Comment 1 Tom Rymes 2018-01-30 15:02:45 UTC 
This is also recommended by Strongswan. From https://wiki.strongswan.org/projects/strongswan/wiki/SimpleCA :

"If you want to add subjectAltName extensions to your certificates use the --san option (can be provided multiple times), for instance, --san vpn.strongswan.org or --san peer@strongswan.org. It is recommended to include the hostname of a gateway as subjectAltName in its certificate."
Comment 2 Michael Tremer 2018-02-12 00:07:36 UTC 
Yes, since the implementation is so old, this wasn't a thing.

Peter, would you send a patch for this? I think you know what there is to do here.
Comment 3 Peter Müller 2020-01-04 15:34:25 UTC 
Just bumped into this again. I will try to develop a fix for it... :-)

Sorry for high response latency.
Comment 4 Peter Müller 2020-01-05 14:38:37 UTC 
@All: Should a SubjectAlternativeName be mandatory for newly generated certificates?
Comment 5 Peter Müller 2020-01-05 17:54:46 UTC 
https://patchwork.ipfire.org/patch/2682/
Comment 6 Peter Müller 2020-01-22 20:37:37 UTC 
https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=993724b4dd9837af033880d7816511818f030d59
https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=8e9f096e702d4bb7cd7ca74e40686e6a23d77abc

However, certificate generation from CSRs does not honour subjectAltName extentions, so there is *another* bug to solve until OpenIKED is finally working correctly...