MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 12:52:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add TLS cert checksum (#18557)

Browse Source 
It allows validation of whether all certs match across clusters.
This commit is contained in:
Klaus Post
2023-11-30 12:13:50 -08:00
committed by GitHub
parent 879d5dd236
commit 94fbcd8ebe
3 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
cmd/admin-handlers.go
View File

@@ -60,6 +60,7 @@ import (
xnet "github.com/minio/pkg/v2/net"
"github.com/minio/pkg/v2/policy"
"github.com/secure-io/sio-go"
"github.com/zeebo/xxh3"
)
const (
@@ -2500,11 +2501,27 @@ func getTLSInfo() madmin.TLSInfo {
if globalIsTLS {
for _, c := range globalPublicCerts {
check := xxh3.Hash(c.RawIssuer)
check ^= xxh3.Hash(c.RawSubjectPublicKeyInfo)
// We XOR, so order doesn't matter.
for _, v := range c.DNSNames {
check ^= xxh3.HashString(v)
}
for _, v := range c.EmailAddresses {
check ^= xxh3.HashString(v)
}
for _, v := range c.IPAddresses {
check ^= xxh3.HashString(v.String())
}
for _, v := range c.URIs {
check ^= xxh3.HashString(v.String())
}
tlsInfo.Certs = append(tlsInfo.Certs, madmin.TLSCert{
PubKeyAlgo: c.PublicKeyAlgorithm.String(),
SignatureAlgo: c.SignatureAlgorithm.String(),
NotBefore: c.NotBefore,
NotAfter: c.NotAfter,
Checksum: strconv.FormatUint(check, 16),
})
}
}