Skip to content

Commit ce098d2

Browse files
Fix TLS gen() func to use updated csr file:
This fixes a regression in the docker-compose where the `TINKERBELL_HOST_IP` in the .env file wasn't showing up as a sans ip in the TLS certificate. This caused all TLS communication with the Tink server to fail with an error like: `x509: certificate is valid for 192.168.56.4, 127.0.0.1, not 192.168.2.150` Signed-off-by: Jacob Weinstock <[email protected]>
1 parent c21d11e commit ce098d2

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

deploy/compose/generate-tls-certs/generate.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,9 @@ gen() {
2626
local ca_crt_destination="$1"
2727
local server_crt_destination="$2"
2828
local server_key_destination="$3"
29+
local csr_file="$4"
2930
cfssl gencert -initca /app/ca-csr.json | cfssljson -bare ca -
30-
cfssl gencert -config /app/ca-config.json -ca ca.pem -ca-key ca-key.pem -profile server /app/csr.json | cfssljson -bare server
31+
cfssl gencert -config /app/ca-config.json -ca ca.pem -ca-key ca-key.pem -profile server "${csr_file}" | cfssljson -bare server
3132
mv ca.pem "${ca_crt_destination}"
3233
mv server.pem "${server_crt_destination}"
3334
mv server-key.pem "${server_key_destination}"
@@ -52,7 +53,7 @@ main() {
5253
echo "IP ${sans_ip} already in ${csr_file}"
5354
fi
5455
if [ ! -f "${ca_crt_file}" ] && [ ! -f "${server_crt_file}" ] && [ ! -f "${server_key_file}" ]; then
55-
gen "${ca_crt_file}" "${server_crt_file}" "${server_key_file}"
56+
gen "${ca_crt_file}" "${server_crt_file}" "${server_key_file}" "${csr_file}"
5657
cp "${server_crt_file}" "${bundle_crt_file}"
5758
else
5859
echo "Files [${ca_crt_file}, ${server_crt_file}, ${server_key_file}] already exist"

0 commit comments

Comments
 (0)