search

mpeylo / cmpossl

An OpenSSL-based implementation of the Certificate Management Protocol (CMP), defined in IETF RFCs 4210, 4211, and 6712. It is being extended according to the emerging RFCs 'CMP Updates' (CMPv3), 'CMP Algorithms', and 'Lightweight CMP Profile'.
https://github.com/mpeylo/cmpossl/wiki
Other
35 stars 13 forks source link

Allowing cmp -sans to digest host names starting with a digit #166

Closed mpeylo closed 5 years ago

mpeylo commented 5 years ago

See RFC 1123, October 1989

Checklist
DDvO commented 5 years ago

When do host names start with a digit? I thought this is not legal for DNS names, but it is indeed allowed - see e.g. https://serverfault.com/questions/638260/is-it-valid-for-a-hostname-to-start-with-a-digit

So far, -sans interpreted its input as an IP address when it starts with a digit, and if this option is removed as currently suggested, the help text 

"Subject Alternative Name(s) (DNS/IPADDR) to add as cert request extension"

needs to be adapted.

As suggested in the above reference, a solution would be to parse the whole input string and see if it is of the form #.#.#.# and in this case use GEN_IPADD. What should also work is to try this type first when calling a2i_GENERAL_NAME() and to switch to GEN_DNS on failure of the first call.

mpeylo commented 5 years ago

you realize that this is a pull request?

DDvO commented 5 years ago

Ok

DDvO commented 5 years ago

By having a look at the context I've just realized that the latter solution is what I already implemented earlier and your changes where actually already sufficient :) So I'll just cherry-pick your commit.