Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use both hostname and ip address for debug service certificate #1667

Merged
merged 3 commits into from
Dec 11, 2023

Conversation

william-xiang
Copy link
Contributor

Changes

Use both hostname and ip address when creating the debug service certificate, so users can use either one of them for connection.

Checklist

  • have tested my change
  • updated relevant documentation
  • Remove any/all console.logs I added
  • eslint is not complaining
  • have added myself to the contributors' list in CONTRIBUTING.md
  • for feature PRs: PR only includes one feature enhancement.

Signed-off-by: William Xiang <william.xiang1375@gmail.com>
Signed-off-by: William Xiang <william.xiang1375@gmail.com>
@worksofliam
Copy link
Contributor

This likely needs to wait for #1657 to be merged first.

@william-xiang william-xiang changed the title Use hostname ip Use both hostname and ip address for debug service certificate Nov 20, 2023
@worksofliam worksofliam added this to the 2.6.0 milestone Dec 11, 2023
@worksofliam worksofliam self-requested a review December 11, 2023 18:35
Copy link
Contributor

@worksofliam worksofliam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@william-xiang I have tested it and it's working great.

/QIBM/ProdData/IBMiDebugService/bin/certs: openssl genrsa -out debug_service_ca.key 2048 && openssl req -x509 -new -nodes -key debug_service_ca.key -sha256 -days 1825 -out debug_service_ca.pem -subj '/CN=mybox' && openssl genrsa -out debug_service.key 2048 && openssl req -new -key debug_service.key -out debug_service.csr -subj '/CN=mybox' && openssl x509 -req -in debug_service.csr -CA debug_service_ca.pem -CAkey debug_service_ca.key -CAcreateserial -out debug_service.crt -days 1095 -sha256 -sha256 -req -extfile <(printf "subjectAltName=DNS:mybox,IP:9.5.10.206") && openssl pkcs12 -export -out debug_service.pfx -inkey debug_service.key -in debug_service.crt -password pass:mybox
{
    "code": 0,
    "signal": null,
    "stdout": "",
    "stderr": "Generating RSA private key, 2048 bit long modulus (2 primes)\n...........................................................+++++\n...........+++++\ne is 65537 (0x010001)\nGenerating RSA private key, 2048 bit long modulus (2 primes)\n..................................................................................................+++++\n.......+++++\ne is 65537 (0x010001)\nSignature ok\nsubject=CN = mybox\nGetting CA Private Key"
}

If you are happy with your testing, I am happy to merge.

@william-xiang
Copy link
Contributor Author

@worksofliam I see you used the hostname for the testing. I guess with this PR #1657, when using the IP address and secure is enabled, the user will get an warning message about changing to use hostname. Do we still want to keep this message?

@worksofliam
Copy link
Contributor

@william-xiang I can try creating the certificates with an IP address today as well. Let me post back when I've done that.

@worksofliam
Copy link
Contributor

Just tested new certs, connected with an IP in secure mode and it works great!

Let's merge.

@worksofliam worksofliam merged commit a992307 into codefori:master Dec 11, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants