Try to find the first non-CA certificate when generating a Hash
because letsencrypt puts 3 different certificates in the secret.
Trusting the final CA (the one matching the host) should be enough.
@@ -34,22 +34,29 @@ func GenerateHash(certRaw []byte) (string, error) {
// -----------------------------------------------------------------------------------
// See gh:paketo-buildpacks/ca-certificates (cacerts/certs.go) for the original code.
+// Iterates over pem blocks until a non-CA certificate if found or no other PEM
+// blocks exist.
func decodeOneCert(raw []byte) (*x509.Certificate, error) {
- block, rest := pem.Decode(raw)
+ byteData := raw
+ for len(byteData) > 0 {
+ block, rest := pem.Decode(byteData)
if block == nil {
return nil, errors.New("failed find PEM data")
}
- extra, _ := pem.Decode(rest)
- if extra != nil {
- return nil, errors.New("found multiple PEM blocks, expected exactly one")
- }
cert, err := x509.ParseCertificate(block.Bytes)
if err != nil {
- return nil, fmt.Errorf("failed to parse certficate\n%w", err)
+ byteData = rest
+ continue // pem block is not a cert? (e.g. maybe it was a dh_params block)
}
+ if !cert.IsCA {
return cert, nil
}
+ byteData = rest
+ }
+
+ return nil, errors.New("failed find PEM data")
+}
// SubjectNameHash is a reimplementation of the X509_subject_name_hash
// in openssl. It computes the SHA-1 of the canonical encoding of the
