From 420870623a70591d5e0b187c77c95455a1224ca6 Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Thu, 6 Apr 2017 22:44:21 -0700 Subject: [PATCH] acme: set correct KeyUsage and ExtKeyUsage A certificate must have the Server Auth Extended Key Usage to be used for TLS, and an ECDSA certificate must have the Digital Signature Key Usage to be used at all (you can't encrypt to an ECDSA key). crypto/tls ignores (E)KUs when serving certificates, and most browsers do as well, so it works, but OpenSSL would refuse to serve these certificates, and clients would be allowed to reject them. Change-Id: I699e58e613f01077e6b67fdb9e789d46e1672112 Reviewed-on: https://go-review.googlesource.com/39913 Run-TryBot: Alex Vaghin TryBot-Result: Gobot Gobot Reviewed-by: Alex Vaghin --- acme/acme.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/acme/acme.go b/acme/acme.go index 03e24e4..8421819 100644 --- a/acme/acme.go +++ b/acme/acme.go @@ -974,7 +974,8 @@ func tlsChallengeCert(san []string, opt []CertOption) (tls.Certificate, error) { NotBefore: time.Now(), NotAfter: time.Now().Add(24 * time.Hour), BasicConstraintsValid: true, - KeyUsage: x509.KeyUsageKeyEncipherment, + KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, + ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, } } tmpl.DNSNames = san