check wildcard mTLS alt names #12068
Conversation
| where wildcard values in the certificate alternative name list are not | ||
| accepted. | ||
|
|
||
| This breaking change will be fixed in a future version of Nomad. |
There was a problem hiding this comment.
A follow-up PR will update this line with the proper version where this was fixed.
There was a problem hiding this comment.
Let's also add:
It is recommended to avoid wildcards and use different certificates for clients and servers.
| name: "globs without role", | ||
| cn: "*.global.nomad", | ||
| canRaft: false, |
There was a problem hiding this comment.
Why doesn't this work? A CN of *.global.noamd should satisfy the server.global.nomad requirement unless CN's never support wildcards?
| Raft requests were not being verified for their certificate common alternative | ||
| name. A check was introduced to make sure only servers in the same region are |
There was a problem hiding this comment.
their certificate common alternative name.
Did you mean Common Name or Subject Alternative Name? Or maybe I'm forgetting a term.
| Raft requests were not being verified for their certificate common alternative | ||
| name. A check was introduced to make sure only servers in the same region are | ||
| able to make Raft requests. This additional check results in a breaking change | ||
| where wildcard values in the certificate alternative name list are not |
There was a problem hiding this comment.
Let's add an example:
where wildcard values (eg
*.global.nomad) in the certificate...
| where wildcard values in the certificate alternative name list are not | ||
| accepted. | ||
|
|
||
| This breaking change will be fixed in a future version of Nomad. |
There was a problem hiding this comment.
Let's also add:
It is recommended to avoid wildcards and use different certificates for clients and servers.
tgross
added
the
stage/needs-rebase
#11089 introduced strict server role mTLS role check for Raft requests.
As pointed out in this comment, this change caused an issue for mTLS setups that use wildcard alt name domains, as they would fail this new check.
This PRs changes the mTLS verification to allow wildcard domains in addition to an equal match.