Skip to content

feat: Add support for custom root CA subject - #14

Closed
fhemberger wants to merge 1 commit into
jsha:masterfrom
fhemberger:feature/custom-subject
Closed

fhemberger wants to merge 1 commit into
jsha:masterfrom
fhemberger:feature/custom-subject

Conversation

@fhemberger

Copy link
Copy Markdown

Hi, first of all, thanks for creating minica! Finally a solution that doesn't make my head explode because of cryptic openssl commands.

I added the feature to declare a custom subject for the root CA by providing a JSON file with the necessary fields.

There's still an issue I don't know how to fix: The result looks like OU=,O=Frederic Hemberger,POSTALCODE=,STREET=,L=,ST=,C=DE if not all fields exist in the JSON file. Unfortunately, this gives me a parsing error on macOS because of the empty fields. Is there a way in Go to map only existing fields to avoid this?

I don't have much experience with Go, so I hope the code changes are not too far off.

@jsha

jsha commented Dec 30, 2018

Copy link
Copy Markdown
Owner

Hi, first of all, thanks for creating minica! Finally a solution that doesn't make my head explode because of cryptic openssl commands.

You're welcome! Thanks for the kind words, and sorry it's taken a while to get back to you.

I added the feature to declare a custom subject for the root CA by providing a JSON file with the necessary fields.

My goal with minica is to keep it radically simple. Right now it generates a random subject CN, as you've probably seen. Customizing the subject beyond that doesn't add compatibility, standards compliance, or features as far as I know, so my inclination is to not incorporate that into the main program. Please let me know if I'm wrong in that evaluation.

However, minica will load any file named minica.pem in the current directory, so you can definitely create your own self-signed root with another program (or, indeed, with a forked and modified copy of minica).

There's still an issue I don't know how to fix: The result looks like OU=,O=Frederic Hemberger,POSTALCODE=,STREET=,L=,ST=,C=DE if not all fields exist in the JSON file. Unfortunately, this gives me a parsing error on macOS because of the empty fields. Is there a way in Go to map only existing fields to avoid this?

You are unconditionally setting these fields to a one-element slice which sometimes contains an empty string:

  PostalCode:         []string{subject.PostalCode},

If you want the PostalCode field (for example) to be empty, you need to set it to nil, or possible an empty slice.

@fhemberger

Copy link
Copy Markdown
Author

Thanks for your feedback, it helped a lot!

Closing.

@fhemberger fhemberger closed this Dec 31, 2018
@fhemberger
fhemberger deleted the feature/custom-subject branch December 31, 2018 10:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants