Create unique CN for generated CA certificates

[ddz]

When creating multiple test clusters, the generated self-signed CA certificates can confuse clients like Chrome because they all have the same CN. It also becomes difficult to trust these individual root CA certificates in various client software. This can be reproduced simply by creating two clusters with self-generated certificates and trying to log into the web dashboard of the second cluster will fail with HSTS errors because the CA is invalid (not just untrusted).

If the CNs of the generated CA certificates were unique, client software would have an easier time dealing with them. I would propose putting the given fqdn or some other unique information into the CN for the generated CA certificate.

[mumoshu]

@ddz Sorry for the long silence - and thanks for the feedback!
Your suggestion sounds nice.
However, for my education, would you mind telling me how are you exposing your kube-dashboard?
Personally, I've been used kubectl proxy for accessing the dashboard and never thought of adding certs as trusted.

[ddz]

I was using https://github.com/coreos/tectonic-installer and traced the certificate creation to this upstream project. The kube dashboard was directly exposed to the Internet from AWS, which isn't the greatest idea security-wise, but being able to trust the generated certificate in the browser makes it slightly better.