Andrew Lytvynov 8492f62d43 u2f: add optional attestation cert validation (#6057) ...

By specifying `device_attestation_cas` in `teleport.yaml`, admins can
restrict U2F device manufacturers. For example, specifying the yubico
attestation CA
(https://developers.yubico.com/U2F/yubico-u2f-ca-certs.txt), you can
restrict users to only yubikeys.

Example error when using the yubico CA and trying to register a Google
Titan key:

```
$ tsh mfa add --type u2f --name test && tsh mfa rm test
Tap any *registered* security key
Tap your *new* security key
ERROR: rpc error: code = InvalidArgument desc = U2F device attestation certificate is signed by "CN=Security Key,O=Google", but this cluster only accepts certificates from ["CN=Yubico U2F Root CA Serial 457200631"]; make sure you're using a U2F device from a trusted manufacturer
```

2021-03-23 15:14:31 -07:00

..

tlsutils.go

u2f: add optional attestation cert validation (#6057)

2021-03-23 15:14:31 -07:00