From 0137703825ea5f493e7486e19c2d83b328ca2998 Mon Sep 17 00:00:00 2001 From: Tim Burke Date: Fri, 30 Nov 2018 14:40:12 -0800 Subject: [PATCH] Allow IP-based subject alt names ... even when no other subject alt names provided Previously, a non-voting job in barbican's gate would fail with something like X509 V3 routines:X509V3_parse_list:invalid null name:v3_utl.c:319: X509 V3 routines:DO_EXT_NCONF:invalid extension string:v3_conf.c:140:name=subjectAltName,section=DNS:pykmip-server,,IP:198.72.124.103 X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:95:name=subjectAltName, value=DNS:pykmip-server,,IP:198.72.124.103 because we'd have an invalid empty string. Change-Id: I5459b8976539924cd6cc6c1e681b6753a76b804c --- lib/tls | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/tls b/lib/tls index 217f40e3a5..9b55099e43 100644 --- a/lib/tls +++ b/lib/tls @@ -252,7 +252,11 @@ function make_cert { if [ "$common_name" != "$SERVICE_HOST" ]; then if is_ipv4_address "$SERVICE_HOST" ; then - alt_names="$alt_names,IP:$SERVICE_HOST" + if [[ -z "$alt_names" ]]; then + alt_names="IP:$SERVICE_HOST" + else + alt_names="$alt_names,IP:$SERVICE_HOST" + fi fi fi