Inspired by docker-archive-public#1880 (and docker/compose#890 et al.). Make sure ca.pem subject is different from cert.pem subject to work-around OpenSSL bug.

posita · posita · commit f80dc360c702 · 2015-10-21T17:53:15.000-07:00
Signed-off-by: Matt Bogosian &lt;mtb19@columbia.edu&gt;
diff --git a/libmachine/cert/bootstrap.go b/libmachine/cert/bootstrap.go
@@ -20,7 +20,8 @@ func BootstrapCertificates(authOptions *auth.AuthOptions) error {
 	// TODO: I'm not super happy about this use of "org", the user should
 	// have to specify it explicitly instead of implicitly basing it on
 	// $USER.
-	org := mcnutils.GetUsername()
+	caOrg := mcnutils.GetUsername()
+	org := caOrg + ".<bootstrap>"
 
 	bits := 2048
 
@@ -42,7 +43,7 @@ func BootstrapCertificates(authOptions *auth.AuthOptions) error {
 			return errors.New("The CA key already exists.  Please remove it or specify a different key/cert.")
 		}
 
-		if err := GenerateCACertificate(caCertPath, caPrivateKeyPath, org, bits); err != nil {
+		if err := GenerateCACertificate(caCertPath, caPrivateKeyPath, caOrg, bits); err != nil {
 			return fmt.Errorf("Generating CA certificate failed: %s", err)
 		}
 	}
diff --git a/libmachine/provision/utils.go b/libmachine/provision/utils.go
@@ -63,7 +63,7 @@ func ConfigureAuth(p Provisioner) error {
 	driver := p.GetDriver()
 	machineName := driver.GetMachineName()
 	authOptions := p.GetAuthOptions()
-	org := machineName
+	org := mcnutils.GetUsername() + "." + machineName
 	bits := 2048
 
 	ip, err := driver.GetIP()

Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,8 @@ func BootstrapCertificates(authOptions *auth.AuthOptions) error {`
`20`	`20`	`// TODO: I'm not super happy about this use of "org", the user should`
`21`	`21`	`// have to specify it explicitly instead of implicitly basing it on`
`22`	`22`	`// $USER.`
`23`		`- org := mcnutils.GetUsername()`
	`23`	`+ caOrg := mcnutils.GetUsername()`
	`24`	`+ org := caOrg + ".<bootstrap>"`
`24`	`25`
`25`	`26`	`bits := 2048`
`26`	`27`
`@@ -42,7 +43,7 @@ func BootstrapCertificates(authOptions *auth.AuthOptions) error {`
`42`	`43`	`return errors.New("The CA key already exists. Please remove it or specify a different key/cert.")`
`43`	`44`	`}`
`44`	`45`
`45`		`- if err := GenerateCACertificate(caCertPath, caPrivateKeyPath, org, bits); err != nil {`
	`46`	`+ if err := GenerateCACertificate(caCertPath, caPrivateKeyPath, caOrg, bits); err != nil {`
`46`	`47`	`return fmt.Errorf("Generating CA certificate failed: %s", err)`
`47`	`48`	`}`
`48`	`49`	`}`