set a random certificate issuer
According to RFC3280, the issuer field must not be empty.
@@ -183,7 +183,12 @@ func keyToCertificate(sk ic.PrivKey) (*tls.Certificate, error) {
return nil, err
}
- sn, err := rand.Int(rand.Reader, big.NewInt(1<<62))
+ bigNum := big.NewInt(1 << 62)
+ sn, err := rand.Int(rand.Reader, bigNum)
+ if err != nil {
+ return nil, err
+ }
+ subjectSN, err := rand.Int(rand.Reader, bigNum)
if err != nil {
return nil, err
}
@@ -191,6 +196,9 @@ func keyToCertificate(sk ic.PrivKey) (*tls.Certificate, error) {
SerialNumber: sn,
NotBefore: time.Time{},
NotAfter: time.Now().Add(certValidityPeriod),
+ // According to RFC 3280, the issuer field must be set,
+ // see https://datatracker.ietf.org/doc/html/rfc3280#section-4.1.2.4.
+ Subject: pkix.Name{SerialNumber: subjectSN.String()},
// after calling CreateCertificate, these will end up in Certificate.Extensions
ExtraExtensions: []pkix.Extension{
{Id: extensionID, Critical: extensionCritical, Value: value},
