starred/certbot-certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-01 19:02:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add warning about multiple SANs extensions

Browse Source
This commit is contained in:
Brad Warren
2016-01-07 16:45:46 -05:00
parent f09d3ac8b2
commit 946f4474da
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
acme/acme/crypto_util.py
+2 -2
View File
@@ -169,11 +169,11 @@ def _pyopenssl_cert_or_req_san(cert_or_req):
func = OpenSSL.crypto.dump_certificate func = OpenSSL.crypto.dump_certificate
else: else:
func = OpenSSL.crypto.dump_certificate_request func = OpenSSL.crypto.dump_certificate_request
# This method of finding SANs is used to support PyOpenSSL version 0.13. # This method of finding SANs is used to support PyOpenSSL version 0.13.
text = func(OpenSSL.crypto.FILETYPE_TEXT, cert_or_req).decode("utf-8") text = func(OpenSSL.crypto.FILETYPE_TEXT, cert_or_req).decode("utf-8")
# WARNING: this function does not support multiple SANs extensions.
# Multiple X509v3 extensions of the same type is disallowed by RFC 5280.
match = re.search(r"X509v3 Subject Alternative Name:\s*(.*)", text) match = re.search(r"X509v3 Subject Alternative Name:\s*(.*)", text)
# WARNING: this function assumes that no SAN can include # WARNING: this function assumes that no SAN can include
# parts_separator, hence the split! # parts_separator, hence the split!
sans_parts = [] if match is None else match.group(1).split(parts_separator) sans_parts = [] if match is None else match.group(1).split(parts_separator)