Empty issuer DN when using selfSigned #3634
Description
Describe the bug:
The selfSigned issuer seems to generate a certificate that, while tolerated by Chromium for example, is rejected as malformed by Java—apparently due to lack of an issuer DN (and perhaps other reasons if it were to get past that).
Expected behaviour:
That the certificate be accepted as well-fomed and importable into the Java cert store.
Steps to reproduce the bug:
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: self-signed
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: xxx
spec:
secretName: xxx-tls
dnsNames:
- what.ever
issuerRef:
name: self-signedOnce the secret is created:
$ kubectl get secret xxx-tls -o go-template='{{ index .data "ca.crt" | base64decode }}' | tee xxx.crt
-----BEGIN CERTIFICATE-----
…
-----END CERTIFICATE-----
$ openssl x509 -text -in xxx.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
…
Signature Algorithm: sha256WithRSAEncryption
Issuer:
Validity
…
$ keytool -cacerts -storepass changeit -import -file xxx.crt
keytool error: java.lang.Exception: Input not an X.509 certificate
$ keytool -v -printcert -file xxx.crt
keytool error: java.lang.Exception: Failed to parse input
java.lang.Exception: Failed to parse input
at java.base/sun.security.tools.keytool.Main.printCertFromStream(Main.java:2626)
at java.base/sun.security.tools.keytool.Main.doPrintCert(Main.java:2780)
at java.base/sun.security.tools.keytool.Main.doCommands(Main.java:1246)
at java.base/sun.security.tools.keytool.Main.run(Main.java:405)
at java.base/sun.security.tools.keytool.Main.main(Main.java:398)
Caused by: java.security.cert.CertificateParsingException: Empty issuer DN not allowed in X509Certificates
at java.base/sun.security.x509.X509CertInfo.parse(X509CertInfo.java:658)
at java.base/sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)
at java.base/sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1842)
at java.base/sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:194)
at java.base/sun.security.provider.X509Factory.parseX509orPKCS7Cert(X509Factory.java:476)
at java.base/sun.security.provider.X509Factory.engineGenerateCertificates(X509Factory.java:361)
at java.base/java.security.cert.CertificateFactory.generateCertificates(CertificateFactory.java:478)
at java.base/sun.security.tools.keytool.Main.printCertFromStream(Main.java:2624)
... 4 moreAnything else we need to know?:
Environment details::
- Kubernetes version: v1.18.14-gke.1600
- Cloud-provider/provisioner: GKE
- cert-manager version: v1.1.0
- Install method: Helm
Java:
openjdk version "11.0.9.1" 2020-11-04
OpenJDK Runtime Environment (build 11.0.9.1+1-Ubuntu-0ubuntu1.20.04)
OpenJDK 64-Bit Server VM (build 11.0.9.1+1-Ubuntu-0ubuntu1.20.04, mixed mode, sharing)
/kind bug