remove Subject Alternative Names from server certificate (#281)

apps/smp-server/Main.hs

@@ -186,6 +186,9 @@ initializeServer InitOptions {enableStoreLog, signAlgorithm, ip, fqdn} = do
             \authorityKeyIdentifier = keyid:always\n\
             \basicConstraints = critical,CA:true\n"
         -- TODO revise https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3, https://www.rfc-editor.org/rfc/rfc3279#section-2.3.5
+        -- IP and FQDN can't both be used as server address interchangeably even if IP is added
+        -- as Subject Alternative Name, unless the following validation hook is disabled:
+        -- https://hackage.haskell.org/package/x509-validation-1.6.10/docs/src/Data-X509-Validation.html#validateCertificateName
         createOpensslServerConf =
           writeFile
             opensslServerConfFile
@@ -197,17 +200,10 @@ initializeServer InitOptions {enableStoreLog, signAlgorithm, ip, fqdn} = do
                 <> "[v3]\n\
                    \basicConstraints = CA:FALSE\n\
                    \keyUsage = digitalSignature, nonRepudiation, keyAgreement\n\
-                   \extendedKeyUsage = serverAuth\n\
-                   \subjectAltName = @alt_names\n\n\
-                   \[alt_names]\n"
-                <> optionalDns1
-                <> ("IP.1 = " <> ip <> "\n")
+                   \extendedKeyUsage = serverAuth\n"
             )
           where
             cn = fromMaybe ip fqdn
-            optionalDns1 = case fqdn of
-              Nothing -> ""
-              Just n -> "DNS.1 = " <> n <> "\n"
 
     saveFingerprint = do
       Fingerprint fp <- loadFingerprint caCrtFile

tests/fixtures/openssl_server.conf

@@ -9,8 +9,3 @@ CN = localhost
 basicConstraints = CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyAgreement
 extendedKeyUsage = serverAuth
-subjectAltName = @alt_names
-
-[alt_names]
-DNS.1 = localhost
-IP.1 = 127.0.0.1

tests/fixtures/server.crt

@@ -1,12 +1,12 @@
 -----BEGIN CERTIFICATE-----
-MIIB2jCCAVqgAwIBAgIUOMoaJ+qlkiUwq5MW7LDi+sHu64IwBQYDK2VxMCoxFjAU
+MIIBvDCCATygAwIBAgIUUgqht3ibEJ9jp5JuroML5Baxa/IwBQYDK2VxMCoxFjAU
 BgNVBAMMDVNNUCBzZXJ2ZXIgQ0ExEDAOBgNVBAoMB1NpbXBsZVgwIBcNMjIwMTEx
-MTExODAyWhgPNDc1OTEyMDgxMTE4MDJaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDBD
-MAUGAytlcQM6AJXsy+S9i3Qdftydn51/p/6a0Ml9vJsYonAwv6CzpIOVG5e3Ath1
-wUfrS0YETmZe0EA7Nk40UKRSgKOBjDCBiTAJBgNVHRMEAjAAMAsGA1UdDwQEAwID
-yDATBgNVHSUEDDAKBggrBgEFBQcDATAaBgNVHREEEzARgglsb2NhbGhvc3SHBH8A
-AAEwHQYDVR0OBBYEFPuA/LW1tq1byaZ4Rrx4JON60JlEMB8GA1UdIwQYMBaAFBxQ
-m9HuabbrLExB8KxaBufAyYlUMAUGAytlcQNzABfc1ODnEfcpAsRmOjYIuyhMvJFE
-sGnjf0TRk4vNS5vs2+CfEGHjKOrbAUDwhUI0Al26WpSvxMcvAE2E0qQoCSRS5Pa8
-+FgzzN3WfFMcXnuYAiqOp8op2mtsp5aJ3UIkwncItp5w+kICiWV6LL3QJM4zAA==
+MTYzOTQ2WhgPNDc1OTEyMDgxNjM5NDZaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDBD
+MAUGAytlcQM6AFj+fmjmgOMBFgQ7lXfICSlSaB5sYp1wzhM2IaqgmVhWbDs3Tw7W
+oUXFJsWpKku1kFjLH2yhqIInAKNvMG0wCQYDVR0TBAIwADALBgNVHQ8EBAMCA8gw
+EwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFMjbHbxESDI8YDPjJ8kXWjkg
+jHxmMB8GA1UdIwQYMBaAFBxQm9HuabbrLExB8KxaBufAyYlUMAUGAytlcQNzAP98
+RpFacmjxsc07GwC07uAxUxNgxX4R2nA+0St866uFbdyxApiyn44giG+m+YXCXLjh
+1ffKEhhqAPdlpzByLarx8EWgmOsisBCRWrmraksOV15FKxjPqm7OYKp4f9GvieAQ
+o/SKOyZVVdcZX7NcuDUxAA==
 -----END CERTIFICATE-----

tests/fixtures/server.key

@@ -1,4 +1,4 @@
 -----BEGIN PRIVATE KEY-----
-MEcCAQAwBQYDK2VxBDsEOY3wzMxEAnHIJ36bmp+0YfaGUUdHPfS4y+DD+KmSrslz
-PQPIY/SZc5orjPuF66RlEutpkqHBNE3WMg==
+MEcCAQAwBQYDK2VxBDsEOZcXSjKQ3FQ9EBfqHmFIidOu4LecpUgi5NVPMhx7mS2d
+QNQ0lFasp+EfvLErbs1Sd9xLVxA1hnZJng==
 -----END PRIVATE KEY-----