ssntp/certs: Set signing usage when creating anchor cert

Since e71a8d6 every cert is not labelled as a signing certificate. Rather than have every requestor of an anchor certificate set this bit instead make the certs.CreateAnchorCert() set this bit. Signed-off-by: Rob Bradford <[email protected]>
sboeuf · Aug 9, 2017 · 40e3e6d · 40e3e6d
1 parent 81b734b
commit 40e3e6d
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 1 deletion.
diff --git a/ciao-cert/main.go b/ciao-cert/main.go
@@ -112,7 +112,6 @@ func createCertificates(role ssntp.Role) {
 	CAcertName := fmt.Sprintf("%s/CAcert-%s.pem", *installDir, firstHost)
 	certName := fmt.Sprintf("%s/cert-%s-%s.pem", *installDir, role.String(), firstHost)
 	if *isAnchor == true {
-		template.KeyUsage = template.KeyUsage | x509.KeyUsageCertSign
 		CAcertOut, err := os.Create(CAcertName)
 		if err != nil {
 			log.Fatalf("Failed to open %s for writing: %s", CAcertName, err)

diff --git a/ssntp/certs/certs.go b/ssntp/certs/certs.go
@@ -176,6 +176,7 @@ func CreateAnchorCert(template *x509.Certificate, useElliptic bool, certOutput i
 	}
 
 	template.IsCA = true
+	template.KeyUsage = template.KeyUsage | x509.KeyUsageCertSign
 
 	// Create self-signed certificate
 	derBytes, err := x509.CreateCertificate(rand.Reader, template, template, publicKey(priv), priv)