Fixed Intel AMT ACM certificate matching bug, #2805.
Ylian Saint-Hilaire committed
Jul 15, 2021 at 10:15 UTC
37418ba6e06162a1a6383eb96279667ab718b33d
1 file changed
+4
-4
certoperations.js
+4
-4
@@ -49,7 +49,7 @@ module.exports.CertificateOperations = function (parent) {
49
if ((certEntry.sha256 == hash) && ((certEntry.cn == '*') || checkAcmActivationCertName(certEntry.cn, fqdn))) { hashAlgo = 'sha256'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
50
if ((certEntry.sha1 == hash) && ((certEntry.cn == '*') || checkAcmActivationCertName(certEntry.cn, fqdn))) { hashAlgo = 'sha1'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
51
}
52
- if (signkey == null) return { action: 'acmactivate', error: 2, errorText: "No signing certificate found." }; // Did not find a match.
52
+ if (signkey == null) return { action: 'acmactivate', error: 2, errorText: "Can't create ACM cert chain, no signing certificate found." }; // Did not find a match.
53
54
// If the matching certificate our wildcard root cert, we can use the root to match any FQDN
55
if (domain.amtacmactivation.certs[certIndex].cn == '*') {
@@ -86,10 +86,10 @@ module.exports.CertificateOperations = function (parent) {
86
var signkey = null, certChain = null, hashAlgo = null, certIndex = null;
87
for (var i in domain.amtacmactivation.certs) {
88
const certEntry = domain.amtacmactivation.certs[i];
89
- if ((certEntry.sha256 == request.hash) && ((certEntry.cn == '*') || (certEntry.cn == request.fqdn))) { hashAlgo = 'sha256'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
90
- if ((certEntry.sha1 == request.hash) && ((certEntry.cn == '*') || (certEntry.cn == request.fqdn))) { hashAlgo = 'sha1'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
89
+ if ((certEntry.sha256 == request.hash) && ((certEntry.cn == '*') || checkAcmActivationCertName(certEntry.cn, request.fqdn))) { hashAlgo = 'sha256'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
90
+ if ((certEntry.sha1 == request.hash) && ((certEntry.cn == '*') || checkAcmActivationCertName(certEntry.cn, request.fqdn))) { hashAlgo = 'sha1'; signkey = certEntry.key; certChain = certEntry.certs; certIndex = i; break; }
91
}
92
- if (signkey == null) return { 'action': 'acmactivate', 'error': 2, 'errorText': "No signing certificate found." }; // Did not find a match.
92
+ if (signkey == null) return { 'action': 'acmactivate', 'error': 2, 'errorText': "Can't sign ACM request, no signing certificate found (2)." }; // Did not find a match.
93
94
// If the matching certificate our wildcard root cert, we can use the root to match any FQDN
95
if (domain.amtacmactivation.certs[certIndex].cn == '*') {