{"ref":"refs/heads/2.6.x","commits":[{"author":{"name":"Josh Cooper","email":"c028c213ed5efcf30c3f4fc7361dbde0c893c5b7@puppetlabs.com"},"sha":"ab9a128f9edc92faba4d6a221864959240a97951","message":"(#10739) Provide default subjectAltNames while bootstrapping master\n\nPrior to #2848 (CVE-2011-3872), if Puppet[:certdnsnames] was not set,\npuppet would add default subjectAltNames to any non-CA cert it\nsigned. The subjectAltNames were of the form:\n\n  DNS:puppet, DNS:<fqdn>, DNS:puppet.<domain>\n\nThe fix for #2848, prevented implicit subjectAltNames from ever being\nadded. However, this is desirable behavior when bootstrapping the\ninitial puppet master.\n\nThis commit re-enables this behavior but restricts it to the case\nwhere all of the following are true:\n\n 1. We are a CA and master\n 2. We're signing the master's cert, not self-signing the CA\n 3. The CSR is for the current host\n\nThese should only ever be true when bootstrapping the initial\nmaster. In particular, it should never be true for the CA's\nself-signed cert, for remote agents, or for servers that are either\nmasters or CAs, but not both.\n\nThis commit also restores the previous behavior of only adding default\nsubject alt names if the fqdn of the host can be resolved.\n\nSince the CSR for the initial master may contain subjectAltNames,\ne.g. by setting Puppet[:dns_alt_names] prior to starting the master\nfor the first time, then the default subjectAltNames will not be\nmerged -- it's either one or the other, but not both.","url":"https://api.github.com/repos/joshcooper/puppet/commits/ab9a128f9edc92faba4d6a221864959240a97951"}],"head":"ab9a128f9edc92faba4d6a221864959240a97951","size":1,"push_id":51839400}