fix(iam): oidc provider fetches leaf certificate thumbprint instead of root

[iliapolo]

Currently, the implementation of the OIDC provider custom resource fetches the certificate chain using:

aws-cdk/packages/@aws-cdk/aws-iam/lib/oidc-provider/external.ts

Line 40 in 9bde9f3

let cert = socket.getPeerCertificate(true);

It then extracts the root certificate by detecting a circular reference in the cert.issuerCertificate property.

aws-cdk/packages/@aws-cdk/aws-iam/lib/oidc-provider/external.ts

Line 46 in 9bde9f3

} while ( cert && typeof cert === 'object' && !unqiueCerts.has(cert));

As it turns out, this results in the wrong certificate being extracted. I observed this while running an EKS integration test.

The current certificate thumbprint that is extracted is: AD7E1C28B064EF8F6003402014C3D0E3370EB58A.
While the expected thumbprint is: 9E99A48A9960B14926BB7F3B02E22DA2B0AB7280. (this is the value we used to hardcode)

The recommended way for extracting the correct thumbprint according to AWS is using openssl s_client -showcerts. When I tried this, I did in fact see that the last certificate returned by this command has the correct thumbprint.

During investigation, I noticed that socket.getPeerCertificate(true) returns another additional certificate, acting as the root one. This is aligned with what the comment made in the original issue. This additional certificate is not the correct one, and we should be using the one just before it in the chain. There is however no way to detect that "second to last" certificate in this way, because it doesn't resolve to a circular reference.

After some digging, I switched the implementation to use socket.getPeerX509Certificate(), a new method that only exists in Node16. This method skips over the incorrect certificate, and results in the correct thumbprint.

Fixes #8607

---

All Submissions:

• Have you followed the guidelines in our Contributing guide?

Adding new Unconventional Dependencies:

• This PR adds new unconventional dependencies following the process described here

New Features

• Have you added the new feature to an integration test?
  • Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

✅ Updated pull request passes all PRLinter validations. Dissmissing previous PRLinter review.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 5f6a5d6
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[PeterBaker0]

Thanks @iliapolo - working well in our deployment