Disable commonName matching for certificates

net/tools/testserver/minica.py

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import asn1
 import datetime
 import hashlib
 import itertools
 import os
 import time
@@ skipping 198 matching lines @@
 AUTHORITY_INFORMATION_ACCESS = asn1.OID([1, 3, 6, 1, 5, 5, 7, 1, 1])
 BASIC_CONSTRAINTS = asn1.OID([2, 5, 29, 19])
 CERT_POLICIES = asn1.OID([2, 5, 29, 32])
 COMMON_NAME = asn1.OID([2, 5, 4, 3])
 COUNTRY = asn1.OID([2, 5, 4, 6])
 HASH_SHA1 = asn1.OID([1, 3, 14, 3, 2, 26])
 OCSP_TYPE_BASIC = asn1.OID([1, 3, 6, 1, 5, 5, 7, 48, 1, 1])
 ORGANIZATION = asn1.OID([2, 5, 4, 10])
 PUBLIC_KEY_RSA = asn1.OID([1, 2, 840, 113549, 1, 1, 1])
 SHA256_WITH_RSA_ENCRYPTION = asn1.OID([1, 2, 840, 113549, 1, 1, 11])
-
+SUBJECT_ALTERNATIVE_NAME = asn1.OID([2, 5, 29, 17])
 
 def MakeCertificate(
     issuer_cn, subject_cn, serial, pubkey, privkey, ocsp_url = None,
-    ca_issuers_url = None, is_ca=False, path_len=None):
+    ca_issuers_url = None, is_ca=False, path_len=None, ip_sans=None,
+    dns_sans=None):
   '''MakeCertificate returns a DER encoded certificate, signed by privkey.'''
   extensions = asn1.SEQUENCE([])
 
   # Default subject name fields
   c = "XX"
   o = "Testing Org"
 
   if is_ca:
     # Root certificate.
     c = None
     o = None
     extensions.children.append(
       asn1.SEQUENCE([
         BASIC_CONSTRAINTS,
         True,
         asn1.OCTETSTRING(asn1.ToDER(asn1.SEQUENCE([
             True, # IsCA
         ] + ([path_len] if path_len is not None else []) # Path len
         ))),
       ]))
 
+  if ip_sans is not None or dns_sans is not None:
+    sans = []
+    if dns_sans is not None:
+      for dns_name in dns_sans:
+        sans.append(
+          asn1.Raw(asn1.TagAndLength(0x82, len(dns_name)) + dns_name))
+    if ip_sans is not None:
+      for ip_addr in ip_sans:
+        sans.append(
+          asn1.Raw(asn1.TagAndLength(0x87, len(ip_addr)) + ip_addr))
+    extensions.children.append(
+      asn1.SEQUENCE([
+        SUBJECT_ALTERNATIVE_NAME,
+        # There is implicitly a critical=False here. Since false is the
+        # default, encoding the value would be invalid DER.
+        asn1.OCTETSTRING(asn1.ToDER(asn1.SEQUENCE(sans)))
+      ]))
+
   if ocsp_url is not None or ca_issuers_url is not None:
     aia_entries = []
     if ocsp_url is not None:
       aia_entries.append(
           asn1.SEQUENCE([
             AIA_OCSP,
             asn1.Raw(asn1.TagAndLength(0x86, len(ocsp_url)) + ocsp_url),
           ]))
     if ca_issuers_url is not None:
       aia_entries.append(
@@ skipping 164 matching lines @@
 
 # unauthorizedDER is an OCSPResponse with a status of 6:
 # SEQUENCE { ENUM(6) }
 unauthorizedDER = '30030a0106'.decode('hex')
 
 def GenerateCertKeyAndOCSP(subject = "127.0.0.1",
                            ocsp_url = "http://127.0.0.1",
                            ocsp_states = None,
                            ocsp_dates = None,
                            ocsp_produced = OCSP_PRODUCED_VALID,
+                           ip_sans = ["\x7F\x00\x00\x01"],
+                           dns_sans = None,
                            serial = 0):
   '''GenerateCertKeyAndOCSP returns a (cert_and_key_pem, ocsp_der) where:
        * cert_and_key_pem contains a certificate and private key in PEM format
          with the given subject common name and OCSP URL.
        * ocsp_der contains a DER encoded OCSP response or None if ocsp_url is
          None'''
 
   if ocsp_states is None:
     ocsp_states = [OCSP_STATE_GOOD]
   if ocsp_dates is None:
     ocsp_dates = [OCSP_DATE_VALID]
 
   if serial == 0:
     serial = RandomNumber(16)
   cert_der = MakeCertificate(ROOT_CN, bytes(subject), serial, LEAF_KEY,
-                             ROOT_KEY, bytes(ocsp_url))
+                             ROOT_KEY, bytes(ocsp_url), ip_sans=ip_sans,
+                             dns_sans=dns_sans)
   cert_pem = DERToPEM(cert_der)
 
   ocsp_der = None
   if ocsp_url is not None:
     if ocsp_states[0] == OCSP_STATE_UNAUTHORIZED:
       ocsp_der = unauthorizedDER
     elif ocsp_states[0] == OCSP_STATE_INVALID_RESPONSE:
       ocsp_der = '3'
     elif ocsp_states[0] == OCSP_STATE_TRY_LATER:
       resp = asn1.SEQUENCE([
@@ skipping 61 matching lines @@
   print 'ocsp-test-root.pem:'
   print DERToPEM(der_root)
 
   print
   print 'kOCSPTestCertFingerprint:'
   print bin_to_array(hashlib.sha1(der_root).digest())
 
   print
   print 'kOCSPTestCertSPKI:'
   print bin_to_array(crlsetutil.der_cert_to_spki_hash(der_root))