netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

security/acme-client: fix CA association, closes #2550

Browse Source
This commit is contained in:
Frank Wall
2021-09-28 18:08:54 +02:00
parent 9220a41499
commit 247408e50a
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/acme-client/pkg-descr
+3
View File
@@ -13,6 +13,9 @@ Plugin Changelog
Added:
* add button to (re-) import a certificate into the trust storage
Fixed:
* associate certificates with the correct CA when multiple CAs use the same name (#2550)
3.1
Changed:
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+7 -1
View File
@@ -159,7 +159,7 @@ class LeCertificate extends LeCommon
foreach (Config::getInstance()->object()->ca as $cacrt) {
$cacrt_subject = cert_get_subject($cacrt->crt, true);
$cacrt_issuer = cert_get_issuer($cacrt->crt, true);
if (($ca_subject == $cacrt_subject) and ($ca_issuer == $cacrt_issuer)) {
if (($ca_subject === $cacrt_subject) and ($ca_issuer === $cacrt_issuer)) {
// Use old refid instead of generating a new one
$ca['refid'] = (string)$cacrt->refid;
$ca_found = true;
@@ -257,6 +257,12 @@ class LeCertificate extends LeCommon
// Prepare certificate for import
cert_import($cert, $cert_content, $key_content);
// Overwrite caref in order to use the correct CA (GH #2550).
// This is required because cert_import() uses lookup_ca_by_subject()
// to find a matching CA. If multiple CAs are using the same name, the
// first CA wins, but it may still be the wrong CA.
$cert['caref'] = (string)$ca['refid'];
// Check if cert was found in config
if ($cert_found == true) {
// Update existing cert