[ovs-git] Open vSwitch: ovs-pki: Add uniqueness to CA certs (master)

nicira-dev at nicira.com nicira-dev at nicira.com
Thu Aug 13 22:59:13 UTC 2009


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Open vSwitch".

The branch, master has been updated
       via  496d0fe53648c34b1fbcce008314c6bbf1582ee2 (commit)
      from  d2a345699f3951029941d01c7f1bf008d706ad20 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 496d0fe53648c34b1fbcce008314c6bbf1582ee2
Diffs: http://openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=commitdiff;h=496d0fe53648c34b1fbcce008314c6bbf1582ee2
Author: Justin Pettit <jpettit at nicira.com>
		
ovs-pki: Add uniqueness to CA certs
		
When ovs-pki is used for CA cert generation, it generates certificates
that are identical except for the public key.  If multiple controllers are
their own certificate authorities, the switch will receive multiple CA
certs that are identical other than their key.  Unfortunately, OpenSSL
cannot distinguish between them.  This is an excerpt of the
SSL_CTX_load_verify_locations function used by vconn-ssl:

    Certificate matching is done based on the subject name, the key
    identifier (if present), and the serial number as taken from the
    certificate to be verified. If these data do not match, the next
    certificate will be tried. If a first certificate matching the
    parameters is found, the verification process will be performed; no
    other certificates for the same parameters will be searched in case of
    failure.

To work around this, we add a bit of uniqueness to each certificate.  In
this commit, we add the generation time to the subject name.  Please note
that the CN field is limited to 64 bytes, so a bit of name compression
needed to take place in order to fit the time.

Bug #1782


-----------------------------------------------------------------------

Summary of changes:
 utilities/ovs-pki.in |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
Open vSwitch




More information about the git mailing list