Bug 1425884 - certtool issues bogus warning about 'uri' option in config file when generating certs
Summary: certtool issues bogus warning about 'uri' option in config file when generati...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: gnutls
Version: 25
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Nikos Mavrogiannopoulos
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-22 16:32 UTC by Daniel Berrangé
Modified: 2017-03-07 14:07 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-03-07 14:07:45 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Daniel Berrangé 2017-02-22 16:32:32 UTC
Description of problem:
The 'certtool' man page indicates that it supports a 'uri' field in config files for creating certs:

[quote]
           # A subject alternative name URI
           #uri = "http://www.example.com"
[/quote]

Attempting to use this, eg

# cat > server.info <<EOF
organization = ACME
cn = localhost
uri = "https://localhost"
uri = "https://localhost4"
uri = "https://localhost6"
uri = "https://localhost.localdomain"
uri = "https://localhost4.localdomain4"
uri = "https://localhost6.localdomain6"
ip_address = 127.0.0.1
ip_address = ::1
tls_www_server
encryption_key
signing_key
EOF

and it generates a warning from certtool that its ignoring 'uri'

$  certtool --generate-certificate --load-privkey server-key.pem   --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem   --template server.info   2>&1 | grep Warn
Warning: skipping unknown option 'uri'
Warning: skipping unknown option 'uri'
Warning: skipping unknown option 'uri'
Warning: skipping unknown option 'uri'
Warning: skipping unknown option 'uri'
Warning: skipping unknown option 'uri'



Version-Release number of selected component (if applicable):
gnutls-3.5.8-2.fc25.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Run certtool to create a certificate against a config file containing a 'uri' key

Comment 1 Nikos Mavrogiannopoulos 2017-02-23 09:03:56 UTC
Thanks. That seems however like a misleading warning though and the certificate already contains the expected data right?

https://gitlab.com/gnutls/gnutls/commit/e6badc35efdc6078ca30edb0ee5e059f8da7a305

Comment 2 Daniel Berrangé 2017-02-23 09:11:36 UTC
Oh I just saw the warning and assumed it was truthful, so didn't check the resulting cert :-) Now I look more closely, I see that the cert *does* contain URI data !

Comment 3 Nikos Mavrogiannopoulos 2017-03-07 14:07:45 UTC
Should be addressed in 3.5.10.


Note You need to log in before you can comment on or make changes to this bug.