[ca] Fix cross-signing bug where ECDSA keys can't cross-sign RSA CAs#2163
Merged
Conversation
…A certificate and vice versa. Signed-off-by: cyli <ying.li@docker.com>
Collaborator
|
ping @diogomonica |
Collaborator
Probably not related? I think we just merged the PR which added that test. |
Contributor
Author
|
Agree I think it's probably not related, but the test was added a month ago - am trying to replicate it. |
Codecov Report
@@ Coverage Diff @@
## master #2163 +/- ##
=========================================
+ Coverage 59.84% 60.04% +0.2%
=========================================
Files 119 119
Lines 19665 19666 +1
=========================================
+ Hits 11769 11809 +40
+ Misses 6551 6522 -29
+ Partials 1345 1335 -10 |
Contributor
|
Ha, this is a cool bug. |
Contributor
|
LGTM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix bug where we could not cross-sign an RSA certificate with an ECDSA certificate and vice versa.
Signed-off-by: cyli ying.li@docker.com
Noticed this when poking around the docker CLI. It's because we are just using the new cert as a template, and the new cert's signature algorithm could be different than the old cert's signature algorithm (because the new cert's key could be an entirely different key type than the old).