Added strictCommonName option for matching the Intel AMT ACM activation cert.
Ylian Saint-Hilaire committed
Aug 15, 2022 at 21:49 UTC
15a76d3932117c2caf5afcf29c5430ab80f2060e
3 files changed
+15
-7
certoperations.js
+13
-7
@@ -247,14 +247,20 @@ module.exports.CertificateOperations = function (parent) {
247
// Get the certificate common name
248
var certCommonName = r.certs[0].subject.getField('CN');
249
if (certCommonName == null) { amtacmactivation.acmCertErrors.push("Unable to get Intel AMT activation certificate common name."); continue; }
250
- var certCommonNameSplit = certCommonName.value.split('.');
251
- var topLevel = certCommonNameSplit[certCommonNameSplit.length - 1].toLowerCase();
252
- var topLevelNum = TopLevelDomainExtendedSupport[topLevel];
253
- if (topLevelNum != null) {
254
- while (certCommonNameSplit.length > topLevelNum) { certCommonNameSplit.shift(); }
255
- acmconfig.cn = certCommonNameSplit.join('.');
256
- } else {
250
+ if (amtacmactivation.strictcommonname == true) {
251
+ // Use the certificate common name exactly
252
acmconfig.cn = certCommonName.value;
253
+ } else {
254
+ // Check if Intel AMT will allow some flexibility in the certificate common name
255
+ var certCommonNameSplit = certCommonName.value.split('.');
256
+ var topLevel = certCommonNameSplit[certCommonNameSplit.length - 1].toLowerCase();
257
+ var topLevelNum = TopLevelDomainExtendedSupport[topLevel];
258
+ if (topLevelNum != null) {
259
+ while (certCommonNameSplit.length > topLevelNum) { certCommonNameSplit.shift(); }
260
+ acmconfig.cn = certCommonNameSplit.join('.');
261
+ } else {
262
+ acmconfig.cn = certCommonName.value;
263
+ }
264
}
265
266
delete acmconfig.cert;
meshcentral-config-schema.json
+1
@@ -934,6 +934,7 @@
934
"additionalProperties": false,
935
"properties": {
936
"log": { "type": "string" },
937
+ "strictCommonName": { "type": "boolean", "default": false, "description": "When set to true, the certificate common name needs to match exactly the Intel AMT trusted FQDN or DHCP Option 15. If false, some flexibility may be given to the matching." },
938
"certs": {
939
"type": "object",
940
"additionalProperties": {
sample-config-advanced.json
+1
@@ -367,6 +367,7 @@
367
],
368
"_amtAcmActivation": {
369
"log": "amtactivation.log",
370
+ "strictCommonName": false,
371
"certs": {
372
"mycertname": {
373
"certfiles": [