mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-25 10:40:02 +08:00
Tim Buckley
f03c48cbea
* MWI: Fix certificate chain handling in tbot's Envoy SDS API This fixes an issue in tbot's Envoy SDS API where, if the user also configured their cluster to use Workload Identity issuer overrides to provide their own CA chain, the Envoy SDS handler would attempt to pass through the entire DER-formatted chain inside a single PEM block instead of splitting it into multiple PEM blocks as it should. The root cause was mostly a historical artifact: there was no need to support CA chains when the SDS API was first implemented because there was no way it would ever try to serve an SVID with a custom CA chain. When issuer overrides were later added, the file output was updated to support chains properly, but the Envoy SDS path was missed. This fixes the issue by re-parsing the DER chain and reformatting it into separate PEM blocks properly. No server-side changes were needed; the most complex part of the change is the tests, which needed to be updated to handle actual certs since `newTLSV3Certificate` now actually parses the cert bytes and failed on the test fixture data. That was complicated by the use of `golden` so we need golden-stored certs. Fixes #68853 * Fix lint * Apply test fixes from code review