Allow email SANs for S/MIME certificates #152
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Looks like I based this on an old master. I'll rebase this later today or tomorrow. |
FiloSottile
reviewed
Apr 11, 2019
main.go
Outdated
| @@ -190,13 +191,17 @@ func (m *mkcert) Run(args []string) { | |||
| if ip := net.ParseIP(name); ip != nil { | |||
| continue | |||
| } | |||
| if email, err := mail.ParseAddress(name); err == nil { | |||
| args[i] = email.Address | |||
There was a problem hiding this comment.
Why modify the argument here?
There was a problem hiding this comment.
Otherwise, someone could pass Foo Bar <foo@bar.com> in and we'd try to put that in the SAN. I guess an alternative would be to check that email.Address matches the name.
|
Ah, good point. Let’s error out if they don’t match instead.
|
|
I fixed this in ba92743. Let me know if you want commits squashed or anything. |
|
Thank you! |
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR allows email addresses to be passed in, along with IP addresses and domain names. Email addresses are added as SANs. The appropriate EKUs are added to the cert based on which types of SANs are present. To identify email addresses, I try parsing them with the
net/mailpackage. This is probably overkill and I'm happy to switch to a regex if that's preferrable./fixes #143
/cc @jcjones