Improved ACM root cert hash mismatch error, #2948
Ylian Saint-Hilaire committed
Jul 30, 2021 at 13:59 UTC
40eb8762e28b6eabd4244e66b4154066085ff356
1 file changed
+5
-1
amtmanager.js
+5
-1
@@ -2022,9 +2022,12 @@ module.exports.CreateAmtManager = function (parent) {
2022
if (trustedFqdn == null) return { err: "No trusted DNS suffix reported" };
2023
2024
// Find a matching certificate
2025
+ var gotSuffixMatch = false;
2026
for (var i in activationCerts) {
2027
var cert = activationCerts[i];
2027
- if ((cert.cn == '*') || checkAcmActivationCertName(cert.cn, trustedFqdn)) {
2028
+ var certDnsMatch = checkAcmActivationCertName(cert.cn, trustedFqdn);
2029
+ if (certDnsMatch == true) { gotSuffixMatch = true; }
2030
+ if ((cert.cn == '*') || certDnsMatch) {
2031
for (var j in deviceHashes) {
2032
var hashInfo = deviceHashes[j];
2033
if ((hashInfo != null) && (hashInfo.isActive == 1)) {
@@ -2034,6 +2037,7 @@ module.exports.CreateAmtManager = function (parent) {
2037
}
2038
}
2039
}
2040
+ if (gotSuffixMatch) { return { err: "Certificate root hash matching failed for \"" + trustedFqdn + "\"." }; } // Found a DNS suffix match, but root hash failed to match.
2041
return { err: "No matching ACM activation certificate for \"" + trustedFqdn + "\"." }; // Did not find a match
2042
}
2043