Add serial and issuer to SSL logs and audits #4752
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fmarco76
force-pushed
the
SubjectListener
branch
2 times, most recently
from
629610a to
04b2176
Compare
|
ladycfu
reviewed
May 22, 2024
|
I should add that other than the name change suggestions, LGTM if tested to work on both failure and success connection cases. |
When creating an SSL connection, logs and audits where reporting only the certificate subject. Since the certificate could be issued from other CAs it could be difficult to identify. This commit adds the issuer and the serial number of the certificate in both the audit and log messages for a better identification.
|
@ladycfu Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When acting as server SSL logs where reporting in log and audit only the certificate subject. Since a client could use a certificate from other CAs to access, the issuer and the serial number of the certificate are included in the audit for a better identification.
To work properly in all condition this requires also dogtagpki/jss#1008