mirror of
https://github.com/etcd-io/etcd.git
synced 2024-09-27 06:25:44 +00:00
9a53601a18
Etcd currently supports validating peers based on their TLS certificate's CN field. The current best practice for creation and validation of TLS certs is to use the Subject Alternative Name (SAN) fields instead, so that a certificate might be issued with a unique CN and its logical identities in the SANs. This commit extends the peer validation logic to use Go's `(*"crypto/x509".Certificate).ValidateHostname` function for name validation, which allows SANs to be used for peer access control. In addition, it allows name validation to be enabled on clients as well. This is used when running Etcd behind an authenticating proxy, or as an internal component in a larger system (like a Kubernetes master).