-
Notifications
You must be signed in to change notification settings - Fork 349
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1408 from wallrj/release-notes-tweaks-1
Improve OtherNames Release notes
- Loading branch information
Showing
2 changed files
with
6 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -20,7 +20,7 @@ The KeyUsage and BasicConstraints extensions will now be encoded as critical in | |
|
||
#### New X.509 Features | ||
|
||
The cert-manager Certificate resource now allows you to configure a subset of "Other Name" SANs, | ||
The cert-manager [Certificate resource](../../usage/certificate.md##creating-certificate-resources) now allows you to [configure a subset of "Other Name" SANs](../../reference/api-docs.md#cert-manager.io/v1.OtherName), | ||
which are described in the [Subject Alternative Name section of RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6) (on page 37). | ||
|
||
We specifically support any `otherName` type with a `UTF-8` value, such as the [User Principal Name](https://docs.venafi.com/Docs/current/TopNav/Content/Certificates/r-UEP-support-SANs.php) or [`sAMAccountName`](https://learn.microsoft.com/en-us/windows/win32/ad/naming-properties). | ||
|
@@ -31,7 +31,7 @@ For example you can create certificates with this block in the spec: | |
- oid: 1.3.6.1.4.1.311.20.2.3 # UPN OID | ||
utf8Value: [email protected] | ||
``` | ||
The feature is still in alpha stage and requires you to [enable the `OtherName` feature flag in the controller and webhook components](../../installation/configuring-components.md#feature-gates). | ||
The feature is still in alpha stage and requires you to [enable the `OtherNames` feature flag in the controller and webhook components](../../installation/configuring-components.md#feature-gates). | ||
|
||
#### New CA certificate Features | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -3,7 +3,7 @@ title: Certificate resource | |
description: 'cert-manager usage: Certificates' | ||
--- | ||
|
||
> **apiVersion:** cert-manager.io/v1 | ||
> **apiVersion:** cert-manager.io/v1 | ||
> **kind:** Certificate | ||
<div style={{textAlign: "center"}}> | ||
|
@@ -82,9 +82,9 @@ spec: | |
- spiffe://cluster.local/ns/sandbox/sa/example | ||
ipAddresses: | ||
- 192.168.0.5 | ||
# Needs cert-manager 1.14+ and "OtherName" feature flag | ||
# Needs cert-manager 1.14+ and "OtherNames" feature flag | ||
otherNames: | ||
# Should only supply oid of ut8 valued types | ||
# Should only supply oid of ut8 valued types | ||
- oid: 1.3.6.1.4.1.311.20.2.3 # User Principal Name "OID" | ||
utf8Value: [email protected] | ||
# Issuer references are always required. | ||
|
@@ -312,7 +312,7 @@ spec: | |
ipRanges: ["10.10.0.0/24"] | ||
``` | ||
|
||
Note that when used with cert-manager's built-in CA and SelfSigned Issuer, the SANs (DNS name, IP address, URI, and email address) are not checked with the certificate's own name constraints, and are not checked with any of name constraints contained in the chain of certificates the certificate belongs to. | ||
Note that when used with cert-manager's built-in CA and SelfSigned Issuer, the SANs (DNS name, IP address, URI, and email address) are not checked with the certificate's own name constraints, and are not checked with any of name constraints contained in the chain of certificates the certificate belongs to. | ||
|
||
The certificate may get issued successfully, but be rejected by clients during TLS handshakes. | ||
|
||
|