Skip to content

Commit

Permalink
make cn field a valid single hostname, and use wildcard in SANs field. (
Browse files Browse the repository at this point in the history
  • Loading branch information
davidism authored May 5, 2024
2 parents e633b30 + 793be47 commit 249527f
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 2 deletions.
1 change: 1 addition & 0 deletions CHANGES.rst
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ Version 3.0.3
Unreleased

- Make reloader more robust when ``""`` is in ``sys.path``. :pr:`2823`
- Better TLS cert format with ``adhoc`` dev certs. :pr:`2891`


Version 3.0.2
Expand Down
7 changes: 5 additions & 2 deletions src/werkzeug/serving.py
Original file line number Diff line number Diff line change
Expand Up @@ -532,7 +532,10 @@ def generate_adhoc_ssl_pair(
.not_valid_before(dt.now(timezone.utc))
.not_valid_after(dt.now(timezone.utc) + timedelta(days=365))
.add_extension(x509.ExtendedKeyUsage([x509.OID_SERVER_AUTH]), critical=False)
.add_extension(x509.SubjectAlternativeName([x509.DNSName(cn)]), critical=False)
.add_extension(
x509.SubjectAlternativeName([x509.DNSName(cn), x509.DNSName(f"*.{cn}")]),
critical=False,
)
.sign(pkey, hashes.SHA256(), backend)
)
return cert, pkey
Expand Down Expand Up @@ -560,7 +563,7 @@ def make_ssl_devcert(
"""

if host is not None:
cn = f"*.{host}/CN={host}"
cn = host
cert, pkey = generate_adhoc_ssl_pair(cn=cn)

from cryptography.hazmat.primitives import serialization
Expand Down

0 comments on commit 249527f

Please sign in to comment.