Improved Intel AMT ACM certificate matching.
Ylian Saint-Hilaire committed
Jul 1, 2021 at 15:20 UTC
bafad4310b10816a2547b241c2daf99dac7fc3b1
1 file changed
+9
-1
amtmanager.js
+9
-1
@@ -2003,7 +2003,7 @@ module.exports.CreateAmtManager = function (parent) {
2003
// Find a matching certificate
2004
for (var i in activationCerts) {
2005
var cert = activationCerts[i];
2006
- if ((cert.cn == '*') || (cert.cn == trustedFqdn)) {
2006
+ if ((cert.cn == '*') || checkAcmActivationCertName(cert.cn, trustedFqdn)) {
2007
for (var j in deviceHashes) {
2008
var hashInfo = deviceHashes[j];
2009
if ((hashInfo != null) && (hashInfo.isActive == 1)) {
@@ -2016,6 +2016,14 @@ module.exports.CreateAmtManager = function (parent) {
2016
return null; // Did not find a match
2017
}
2018
2019
+ // Return true if the trusted FQDN matched the certificate common name
2020
+ function checkAcmActivationCertName(commonName, trustedFqdn) {
2021
+ commonName = commonName.toLowerCase();
2022
+ trustedFqdn = trustedFqdn.toLowerCase();
2023
+ if (commonName.startsWith('*.') && (commonName.length > 2)) { commonName = commonName.substring(2); }
2024
+ return ((commonName == trustedFqdn) || (trustedFqdn.endsWith('.' + commonName)));
2025
+ }
2026
+
2027
// Attempt Intel AMT TLS ACM activation
2028
function activateIntelAmtTlsAcm(dev, password, acminfo) {
2029
// Check if MeshAgent/MeshCMD can support the startConfigurationhostB() call.