From e28ee7df01060e3eba5de51adaf092591b9b6c2e Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Tue, 27 Oct 2020 12:51:28 +0100 Subject: [PATCH] Simplify EKU logic With -client, you get clientAuth. With a non-email SAN, you also get serverAuth. With an email SAN, you also get emailProtection. --- cert.go | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/cert.go b/cert.go index 457ec2f..0d365e2 100644 --- a/cert.go +++ b/cert.go @@ -68,11 +68,9 @@ func (m *mkcert) makeCert(hosts []string) { OrganizationalUnit: []string{userAndHostname}, }, - NotAfter: expiration, - NotBefore: time.Now(), + NotBefore: time.Now(), NotAfter: expiration, - KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, - BasicConstraintsValid: true, + KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, } for _, h := range hosts { @@ -88,9 +86,10 @@ func (m *mkcert) makeCert(hosts []string) { } if m.client { - tpl.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth} - } else if len(tpl.IPAddresses) > 0 || len(tpl.DNSNames) > 0 { - tpl.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth} + tpl.ExtKeyUsage = append(tpl.ExtKeyUsage, x509.ExtKeyUsageClientAuth) + } + if len(tpl.IPAddresses) > 0 || len(tpl.DNSNames) > 0 || len(tpl.URIs) > 0 { + tpl.ExtKeyUsage = append(tpl.ExtKeyUsage, x509.ExtKeyUsageServerAuth) } if len(tpl.EmailAddresses) > 0 { tpl.ExtKeyUsage = append(tpl.ExtKeyUsage, x509.ExtKeyUsageEmailProtection)