search

osixia / container-baseimage

A container base image to build reliable single or multiprocess images quickly 🐳✨🌴
MIT License
132 stars 115 forks source link

Fix: Update expired default-ca #30

Closed heidemn closed 3 years ago

heidemn commented 3 years ago

The previous CA certificate has expired on Dec 21 2020. This causes e.g. some functionality of the OpenLDAP image to no longer work out of the box. This PR updates the certificate, so it's again valid for 5 years.

Prerequisite to fix https://github.com/osixia/docker-openldap/issues/506

I followed these instructions: https://github.com/osixia/docker-light-baseimage/blob/master/image/service-available/:ssl-tools/assets/default-ca/README.md

Can you release a new image version after merge, so derived images can be fixed as well?

heidemn commented 3 years ago 
$ cfssl version
Version: 1.2.0
Revision: dev
Runtime: go1.8.1
$ openssl x509 -in ./default-ca.pem -text -noout > newca.txt
$ git checkout master
$ openssl x509 -in ./default-ca.pem -text -noout > oldca.txt
$ diff -u oldca.txt newca.txt

--- oldca.txt   2021-01-16 13:09:32.510000000 +0100
+++ newca.txt   2021-01-16 13:09:07.070000000 +0100
@@ -2,40 +2,37 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            09:f4:3e:9b:4a:60:67:f0:63:60:02:6f:c6:b9:ff:6d:d1:8d:66:89
+            72:e9:f7:2a:ec:98:89:5a:f2:40:27:ce:71:6c:fb:80:d3:f4:c7:f0
         Signature Algorithm: ecdsa-with-SHA384
-        Issuer: C = US, O = A1A Car Wash, OU = Information Technology Dep., L = Albuquerque, ST = New Mexico, CN = docker-light-baseimage
+        Issuer: C = US, ST = New Mexico, L = Albuquerque, O = A1A Car Wash, OU = Information Technology Dep., CN = docker-light-baseimage
         Validity
-            Not Before: Dec 23 13:53:00 2015 GMT
-            Not After : Dec 21 13:53:00 2020 GMT
-        Subject: C = US, O = A1A Car Wash, OU = Information Technology Dep., L = Albuquerque, ST = New Mexico, CN = docker-light-baseimage
+            Not Before: Jan 16 11:42:00 2021 GMT
+            Not After : Jan 15 11:42:00 2026 GMT
+        Subject: C = US, ST = New Mexico, L = Albuquerque, O = A1A Car Wash, OU = Information Technology Dep., CN = docker-light-baseimage
         Subject Public Key Info:
             Public Key Algorithm: id-ecPublicKey
                 Public-Key: (384 bit)
                 pub:
-                    04:c6:5f:ff:5d:a9:ba:90:20:97:c4:a6:fa:3f:06:
-                    9a:33:5e:35:b4:85:01:95:96:a1:39:88:bd:fd:8c:
-                    bb:82:d6:3c:7c:b8:6d:39:5d:91:08:07:51:b0:69:
-                    4f:7c:56:cf:c7:f4:94:1f:eb:bb:be:7d:e8:21:ec:
-                    1a:82:f6:03:6f:21:c6:e7:25:ab:98:5b:53:1d:72:
-                    ac:8b:77:6c:92:18:dd:3b:a2:5f:6e:47:19:37:ba:
-                    90:60:89:3c:1d:5a:2d
+                    04:d6:bd:3b:26:2b:57:04:cf:2e:3b:d7:5b:6f:e6:
+                    84:51:4c:99:00:19:48:58:b2:82:8f:61:5e:a9:f0:
+                    cf:f3:43:cb:46:6e:40:ab:14:17:34:9e:77:a5:17:
+                    36:ed:5e:42:03:07:4d:2b:b0:5a:2d:93:75:b8:12:
+                    5f:ca:5a:cf:ec:36:40:6c:e6:d9:05:a1:40:59:1c:
+                    03:de:a9:cd:35:33:8d:06:a7:0e:fb:aa:81:55:21:
+                    4d:6b:26:23:4e:14:d9
                 ASN1 OID: secp384r1
                 NIST CURVE: P-384
         X509v3 extensions:
             X509v3 Key Usage: critical
                 Certificate Sign, CRL Sign
             X509v3 Basic Constraints: critical
-                CA:TRUE, pathlen:2
+                CA:TRUE
             X509v3 Subject Key Identifier:
-                4F:A5:E9:7A:25:5C:30:18:9C:62:D3:97:85:BA:50:B2:87:AE:6E:F8
-            X509v3 Authority Key Identifier:
-                keyid:4F:A5:E9:7A:25:5C:30:18:9C:62:D3:97:85:BA:50:B2:87:AE:6E:F8
-
+                D7:12:78:64:3E:D6:ED:E7:B2:BD:81:71:86:36:8D:57:9C:C8:14:25
     Signature Algorithm: ecdsa-with-SHA384
-         30:65:02:31:00:97:2d:98:fc:a2:4c:b1:5b:a5:13:2f:b8:6b:
-         89:b5:14:6e:ee:b7:3d:b8:ee:c0:85:e7:c2:2e:36:d0:37:4d:
-         b2:f0:3d:03:b7:dc:40:45:d2:71:61:4b:5c:01:82:f2:b9:02:
-         30:67:2a:c1:76:4f:49:17:f0:b8:8f:6b:f9:1d:75:81:3a:cf:
-         f7:68:67:69:5c:6c:f6:c8:d1:8a:47:2d:a6:44:29:3b:23:65:
-         21:71:4f:a2:91:4a:f0:57:5f:58:fc:a9:bc
+         30:64:02:30:11:e9:a6:6a:18:f0:4d:9f:bf:43:c8:83:c9:51:
+         dd:7a:b8:6c:a3:53:1f:b7:06:dd:61:1b:47:5d:0d:1c:f7:89:
+         34:7b:41:ad:75:ac:9e:30:28:b9:72:85:19:2f:b5:be:02:30:
+         01:53:f5:81:90:8f:39:3b:c2:85:f4:c5:f2:e3:87:5b:b4:59:
+         dd:49:c2:df:17:09:94:66:8e:ac:2e:ec:b8:49:52:06:72:d3:
+         ec:32:13:de:e0:52:c6:62:1e:80:73:47
heidemn commented 3 years ago

Travis build fails, probably unrelated to my changes:

$ echo "$DOCKER_PASS" | docker login -u "$DOCKER_USER" --password-stdin
Must provide --username with --password-stdin
The command "echo "$DOCKER_PASS" | docker login -u "$DOCKER_USER" --password-stdin" failed and exited with 1 during .

Ping @BertrandGouny

heidemn commented 3 years ago

@BertrandGouny any chance to get this merged & released?

BertrandGouny commented 3 years ago

Hello guys, Thanks, i try to get some free time during the weekend to review those issues.

BertrandGouny commented 3 years ago

Perfect, thank you very mutch :)

heidemn commented 3 years ago

Thanks for merging :-)