[ovs-git] Open vSwitch: ovs-pki: Add uniqueness to CA certs (citrix)

nicira-dev at nicira.com nicira-dev at nicira.com
Thu Aug 13 22:39:49 UTC 2009


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Open vSwitch".

The branch, citrix has been updated
       via  a20d2466fcd4edc2f2cfbc870c225a3afb96ffd5 (commit)
      from  f35409904bc4a0a695a4aecb2435933d8a8187fe (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a20d2466fcd4edc2f2cfbc870c225a3afb96ffd5
Diffs: http://openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff;h=a20d2466fcd4edc2f2cfbc870c225a3afb96ffd5
Author: Justin Pettit <jpettit at nicira.com>
		
ovs-pki: Add uniqueness to CA certs
		
When ovs-pki is used for CA cert generation, it generates certificates
that are identical except for the public key.  If multiple controllers are
their own certificate authorities, the switch will receive multiple CA
certs that are identical other than their key.  Unfortunately, OpenSSL
cannot distinguish between them.  This is an excerpt of the
SSL_CTX_load_verify_locations function used by vconn-ssl:

    Certificate matching is done based on the subject name, the key
    identifier (if present), and the serial number as taken from the
    certificate to be verified. If these data do not match, the next
    certificate will be tried. If a first certificate matching the
    parameters is found, the verification process will be performed; no
    other certificates for the same parameters will be searched in case of
    failure.

To work around this, we add a bit of uniqueness to each certificate.  In
this commit, we add the generation time to the subject name.  Please note
that the CN field is limited to 64 bytes, so a bit of name compression
needed to take place in order to fit the time.

Bug #1782


-----------------------------------------------------------------------

Summary of changes:
 utilities/ovs-pki.in |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
Open vSwitch




More information about the git mailing list