As per https://support.apple.com/en-in/HT210176:
> TLS server certificates must contain an ExtendedKeyUsage (EKU)
extension containing the id-kp-serverAuth OID.
We were not specifying this EKU.
Validated by checking with the old self-signed certs:
$ security verify-cert -c webproxy_cert.pem -p ssl -r webproxy_cert.pem
Cert Verify Result: Invalid Extended Key Usage for policy
And then repeating the process after this change:
$ security verify-cert -c webproxy_cert.pem -p ssl -r webproxy_cert.pem
...certificate verification successful.
Closes#32531
* adds public web addresses to self-signed cert
* skips adding ip addresses to self-signed cert
* skip error on public addresses
* lint fix
* optimize logic and log error
* Update lib/service/service.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* skip adding IP addresses to DNS SANS and log warning
* lint fix and update log message
* add public addresses into IP sans if ips
* remove comment
* lint fix
* include empty ipaddress for GeneratedSelfSignedCert calls
* removed
* update function call
* logic updates
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* handle when a IP addressed can't be parsed for self-signed cert
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Many of our tests (db package, I'm looking at you) generate many RSA keys. This has two main side effects; makes our tests slow and flaky as CPU usage spikes in random moments when the tests are run in parallel.
This change pre-generates RSA keys at the beginning of each test module and reuse them in randomized order to reduce the situation that one key has been used multiple times in one test.
I had to move a few files to avoid circular dependencies.
fheinecke