From f843e1d9b599f459b035191f6df340fadaee73e7 Mon Sep 17 00:00:00 2001 From: Krzysztof Czajka Date: Thu, 23 Jul 2026 09:55:27 +0200 Subject: [PATCH] fix: make container certificates compliant with X.501 standard Golang's `crypto/x509/pkix` does not generate X.501-compliant structure for multi-valued RDNs (see [1]). This commit provides a workaround for this bug: instead of `pkix.Name.OrganizationalUnits` it uses `ExtraNames` property which encodes each entry as a separate RDN (see [2]). --- [1] https://github.com/golang/go/issues/40876 [2] https://github.com/golang/go/blob/release-branch.go1.27/src/crypto/x509/pkix/pkix.go#L249 --- .../executor/depot/containerstore/credmanager.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/code.cloudfoundry.org/executor/depot/containerstore/credmanager.go b/src/code.cloudfoundry.org/executor/depot/containerstore/credmanager.go index a40424abff..8bf1e259dc 100644 --- a/src/code.cloudfoundry.org/executor/depot/containerstore/credmanager.go +++ b/src/code.cloudfoundry.org/executor/depot/containerstore/credmanager.go @@ -473,12 +473,19 @@ func createCertificateTemplate(guid string, certSAN certificateSAN, notBefore, n for _, route := range certSAN.InternalRoutes { dnsNames = append(dnsNames, route.Hostname) } + organizationalUnits := []pkix.AttributeTypeAndValue{} + for _, ou := range certSAN.OrganizationalUnits { + organizationalUnits = append(organizationalUnits, pkix.AttributeTypeAndValue{ + Type: []int{2, 5, 4, 11}, // OID for Organizational Unit RDN + Value: ou, + }) + } return &x509.Certificate{ SerialNumber: big.NewInt(0), Subject: pkix.Name{ - CommonName: guid, - OrganizationalUnit: certSAN.OrganizationalUnits, + CommonName: guid, + ExtraNames: organizationalUnits, }, IPAddresses: ipaddr, DNSNames: dnsNames,