fix: #1127

migrations/1766800800_upgrade_v0.4.12.go

@@ -0,0 +1,57 @@
+package migrations
+
+import (
+	"strings"
+
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+
+	xcert "github.com/certimate-go/certimate/pkg/utils/cert"
+	xcertx509 "github.com/certimate-go/certimate/pkg/utils/cert/x509"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		tracer := NewTracer("v0.4.12")
+		tracer.Printf("go ...")
+
+		// update collection `certificate`
+		//   - update field `subjectAltNames`
+		{
+			collection, err := app.FindCollectionByNameOrId("4szxr9x43tpj6np")
+			if err != nil {
+				return err
+			}
+
+			records, err := app.FindAllRecords(collection)
+			if err != nil {
+				return err
+			}
+
+			for _, record := range records {
+				changed := false
+
+				if certX509, err := xcert.ParseCertificateFromPEM(record.GetString("certificate")); err == nil {
+					certSANs := xcertx509.GetSubjectAltNames(certX509)
+					if strings.Join(certSANs, ";") != record.GetString("subjectAltNames") {
+						record.Set("subjectAltNames", strings.Join(certSANs, ";"))
+						changed = true
+					}
+				}
+
+				if changed {
+					if err := app.Save(record); err != nil {
+						return err
+					}
+
+					tracer.Printf("record #%s in collection '%s' updated", record.Id, collection.Name)
+				}
+			}
+		}
+
+		tracer.Printf("done")
+		return nil
+	}, func(app core.App) error {
+		return nil
+	})
+}

pkg/utils/cert/x509/x509.go

@@ -3,10 +3,18 @@
 import (
 	"crypto/x509"
 	"encoding/asn1"
+	"net"
 )
 
 var oidSubjectAlternativeNameExtension = asn1.ObjectIdentifier{2, 5, 29, 17}
 
+const (
+	sanGeneralNameTagEmail = 1
+	sanGeneralNameTagDNS   = 2
+	sanGeneralNameTagURI   = 6
+	sanGeneralNameTagIP    = 7
+)
+
 // 返回指定 x509.Certificate 对象的主题名称。
 // 如果主题名称为空，则返回第一个主题替代名称。
 //
@@ -55,7 +63,18 @@ func GetSubjectAltNames(cert *x509.Certificate) []string {
 					continue
 				}
 
-				sans = append(sans, string(seq.Bytes))
+				switch seq.Tag {
+				case sanGeneralNameTagIP:
+					// IPv4 地址需要单独处理，否则直接转换为字符串会得到乱码
+					var ip net.IP = seq.Bytes
+					sans = append(sans, ip.String())
+
+				case sanGeneralNameTagEmail, sanGeneralNameTagDNS, sanGeneralNameTagURI:
+					sans = append(sans, string(seq.Bytes))
+
+				default:
+					// 忽略其他非 Critical 的 GeneralName​
+				}
 			}
 		}
 	}