Support `subject`, `literalSubject`, and `usages` for CA and self-signed certificates. by MartinWeindel · Pull Request #813 · gardener/cert-management

MartinWeindel · 2026-08-25T12:54:41Z

How to categorize this PR?

/kind enhancement

What this PR does / why we need it:
Support subject, literalSubject, and usages for CA and self-signed certificates.

subjectFromInput builds the pkix.Name from either the structured subject or a parsed literalSubject LDAP DN.
For literalSubject, the parsed RDN sequence is DER-encoded and set as RawSubject on the CSR/certificate template, preserving exact attribute order and non-structured attribute types (e.g. DC) that Go would otherwise reorder or drop.
The common name (structured or extracted from the literal subject) is promoted to a DNS SAN for leaf certificates, but not for CA certificates.
Configurable key usages are applied, always including cert-sign for CA/self-signed certs.

Notes

No change to DN ordering behavior was required — literalSubject order is preserved end-to-end. DER stores RDNs in the reverse of the RFC 4514 string form by spec, so openssl asn1parse shows root-first; openssl x509 -nameopt rfc2253 renders back the exact input.

Tests

Unit tests cover structured/literal subject population, attribute-order and non-structured-attribute preservation through CSR creation and issuance, CN→SAN promotion rules, and key-usage defaulting.

Which issue(s) this PR fixes:
Fixes #794

Special notes for your reviewer:

Release note:

Support `subject`, `literalSubject`, and `usages` for CA and self-signed certificates.

gardener-prow · 2026-08-25T12:54:47Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign marc1404 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Martin Weindel <martin.weindel@sap.com>

…objects Signed-off-by: Martin Weindel <martin.weindel@sap.com>

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

…tificates Extend the CA and self-signed issuance paths to honor the structured Subject, LiteralSubject and Usages fields of the Certificate spec: - subjectFromInput builds the pkix.Name from either the parsed literal subject (LDAP DN) or CommonName plus the structured Subject attributes, falling back to the CA-derived attributes otherwise. - buildKeyUsages maps api.KeyUsage values to x509 key/extended-key usages, always including KeyCertSign for CA certificates and defaulting to server auth when no usages are requested. - NewSelfSignedCertInPEMFormat and the CA/self-signed constructors now return the resulting common name so the reconciler can reconstruct the original spec and derive the status common name from a literalSubject. - Promote the common name (including one extracted from a literalSubject) to a DNS SAN for leaf certificates. Add unit and integration test coverage for these paths. Signed-off-by: Martin Weindel <martin.weindel@sap.com>

Go 1.25+ deprecates direct access to the raw ecdsa.PublicKey coordinate fields (X/Y). Use the Equal method implemented by all standard library public key types instead, which compares the underlying values without touching the deprecated fields and safely returns false for mismatched key types. The (bool, error) contract and error-on-unknown-type behavior are preserved; ed25519 keys are now handled as well. Signed-off-by: Martin Weindel <martin.weindel@sap.com>

ToKeyUsages split the usages annotation on "," without trimming, so a natural value like "server auth, client auth" produced " client auth", which failed the known-usage check and was silently dropped. Trim each token before the lookup so surrounding whitespace is tolerated. Signed-off-by: Martin Weindel <martin.weindel@sap.com>

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

…roller The certman2 source controller (common.CertInput / CreateSpec) handled issuer, preferredChain, privateKey and renewBefore annotations but not the literal-subject and usages annotations that the legacy source controller already syncs onto the Certificate spec. As a result, a Gateway/Service/Ingress annotated with cert.gardener.cloud/literal-subject or cert.gardener.cloud/usages produced a Certificate that silently dropped these fields. Add the AnnotLiteralSubject and AnnotUsages constants, extend CertInput with LiteralSubject and Usages, read them in augmentFromCommonAnnotations, and map them into the CertificateSpec in CreateSpec, mirroring the legacy controller. Extend the ingress and service reconciler tests accordingly. Signed-off-by: Martin Weindel <martin.weindel@sap.com>

MartinWeindel · 2026-08-25T13:07:45Z

/cla

marc1404 · 2026-08-31T07:55:29Z

+	if spec.LiteralSubject != nil {
+		h.Write([]byte("literalSubject"))
+		h.Write([]byte{0})
+		h.Write([]byte(*spec.LiteralSubject))
+		h.Write([]byte{0})
+	}
+	if spec.Subject != nil {
+		s := spec.Subject
+		for _, v := range s.Organizations {
+			h.Write([]byte("O="))
+			h.Write([]byte(v))
+			h.Write([]byte{0})
+		}
+		for _, v := range s.Countries {
+			h.Write([]byte("C="))
+			h.Write([]byte(v))
+			h.Write([]byte{0})
+		}
+		for _, v := range s.OrganizationalUnits {
+			h.Write([]byte("OU="))
+			h.Write([]byte(v))
+			h.Write([]byte{0})
+		}
+		for _, v := range s.Localities {
+			h.Write([]byte("L="))
+			h.Write([]byte(v))
+			h.Write([]byte{0})
+		}
+		for _, v := range s.Provinces {
+			h.Write([]byte("ST="))
+			h.Write([]byte(v))
+			h.Write([]byte{0})
+		}
+		for _, v := range s.StreetAddresses {
+			h.Write([]byte("STREET="))
+			h.Write([]byte(v))
+			h.Write([]byte{0})
+		}
+		for _, v := range s.PostalCodes {
+			h.Write([]byte("PC="))
+			h.Write([]byte(v))
+			h.Write([]byte{0})
+		}
+		if s.SerialNumber != "" {
+			h.Write([]byte("SN="))
+			h.Write([]byte(s.SerialNumber))
+			h.Write([]byte{0})
+		}
+	}
+	for _, u := range spec.Usages {
+		h.Write([]byte("usage="))
+		h.Write([]byte(u))
+		h.Write([]byte{0})
+	}


Given the length of this function at this point, we could add a little helper function that takes an optional prefix, writes the payload, and adds the 0 trailer. What do you think?

marc1404 · 2026-08-31T07:58:05Z

+	for usage := range strings.SplitSeq(value, ",") {
+		if set.Has(string(usage)) {
+			usages = append(usages, api.KeyUsage(usage))
+		}
+	}


Currently, it doesn't allow for extraneous spaces in the key usages. Do we want to allow that and implicitly trim the spaces before appending the key usage?

marc1404 · 2026-08-31T07:58:50Z

  email: some.user@mydomain.com
+  precheckNameservers:
+    - 8.8.8.8
+    - 8.8.4.4


nit: there was a trailing newline here before

marc1404

I haven't verified whether it actually happens, but it might be that the current tests don't capture this case: I think there could be a hash mismatch scenario with a CSR-based Certificate that would cause it to be reprovisioned constantly.

The hash is using the CommonName from the spec:

cert-management/pkg/controller/issuer/certificate/reconciler.go

Lines 1078 to 1081 in 62f3761

    
           if spec.CommonName != nil { 
        
           	h.Write([]byte(*spec.CommonName)) 
        
           	h.Write([]byte{0}) 
        
           }

(when using a CSR only this would be nil)

When reconstructing the spec, it populates CommonName from the LiteralSubject now. This should only happen when CSR is nil:

cert-management/pkg/controller/issuer/certificate/reconciler.go

Lines 401 to 403 in 62f3761

    
           if cert.Spec.LiteralSubject == nil { 
        
           	spec.CommonName = result.CommonName 
        
           }

marc1404 · 2026-09-04T10:45:09Z

+		certInput.LiteralSubject = value
+	}
+	if value := annotations[AnnotUsages]; value != "" {
+		certInput.Usages = shared.ToKeyUsages(value)


minor: shared.ToKeyUsages silently drops unrecognized values (whereas this is highlighted when having them in the resource spec

marc1404 · 2026-09-04T10:45:22Z

+
+	var usages []api.KeyUsage
+	if value, ok := resources.GetAnnotation(objData, AnnotUsages); ok && value != "" {
+		usages = shared.ToKeyUsages(value)


minor: shared.ToKeyUsages silently drops unrecognized values (whereas this is highlighted when having them in the resource spec

marc1404 · 2026-09-04T10:47:00Z

+		if ptr.Deref(spec.LiteralSubject, "") != info.LiteralSubject {
+			if info.LiteralSubject != "" {
+				s := info.LiteralSubject
+				spec.LiteralSubject = new(s)
+			} else {
+				spec.LiteralSubject = nil
+			}
+			mod.Modify(true)
+		}
+
+		if !reflect.DeepEqual(spec.Usages, info.Usages) {
+			spec.Usages = info.Usages
+			mod.Modify(true)
+		}


minor: LiteralSubject and Usages are correctly set in the updateEntry path. However, in createEntryFor, they are not set when building the spec

cert-management/pkg/cert/source/reconciler.go

Lines 322 to 389 in 62f3761

func (r *sourceReconciler) createEntryFor(logger logger.LogContext, obj resources.Object, info CertInfo, feedback CertFeedback) error {

cert := &api.Certificate{}

cert.GenerateName = strings.ToLower(r.nameprefix + obj.GetName() + "-" + obj.GroupKind().Kind + "-")

resources.SetAnnotation(cert, AnnotForwardOwnerRefs, "true")

if r.targetclass != "" {

resources.SetAnnotation(cert, AnnotClass, r.targetclass)

}

if len(info.Domains) > 0 {

if len(info.Domains[0]) <= 64 {

cert.Spec.CommonName = &info.Domains[0]

cert.Spec.DNSNames = info.Domains[1:]

} else {

cert.Spec.CommonName = nil

cert.Spec.DNSNames = info.Domains

}

}

if info.IssuerName != nil {

parts := strings.SplitN(*info.IssuerName, "/", 2)

if len(parts) == 2 {

cert.Spec.IssuerRef = &api.IssuerRef{Namespace: parts[0], Name: parts[1]}

} else {

cert.Spec.IssuerRef = &api.IssuerRef{Name: *info.IssuerName}

}

}

cert.Spec.SecretRef = &core.SecretReference{

Name: info.SecretName.Name,

Namespace: info.SecretName.Namespace,

}

if r.namespace == "" {

cert.Namespace = obj.GetNamespace()

} else {

cert.Namespace = r.namespace

}

if info.FollowCNAME {

cert.Spec.FollowCNAME = &info.FollowCNAME

}

cert.Spec.SecretLabels = info.SecretLabels

if info.PreferredChain != "" {

cert.Spec.PreferredChain = &info.PreferredChain

}

cert.Spec.PrivateKey = createPrivateKey(info.PrivateKeyAlgorithm, info.PrivateKeySize, info.PrivateKeyEncoding)

// Set renewBefore (validation will happen in certificate reconciler)

if info.RenewBefore != nil {

cert.Spec.RenewBefore = info.RenewBefore

}

for key, value := range info.Annotations {

resources.SetAnnotation(cert, key, value)

}

e, _ := r.SlaveResoures()[0].Wrap(cert)

err := r.Slaves().CreateSlave(obj, e)

if err != nil {

if feedback != nil {

feedback.Failed(&info, err)

}

return err

}

obj.Eventf(core.EventTypeNormal, "reconcile", "created certificate object %s", e.ObjectName())

logger.Infof("created certificate object %s", e.ObjectName())

if feedback != nil {

feedback.Pending(&info, "")

}

return nil

}

marc1404 · 2026-09-04T10:54:13Z

 	// +optional
 	IsCA *bool `json:"isCA,omitempty"`
+	// Usages defines the requested key usages and extended key usages.
+	// If unset, defaults to `digital signature` and `key encipherment`.


minor: The comment is slightly off; key encipherment is only added for RSA keys:

cert-management/pkg/shared/legobridge/pki.go

Lines 482 to 484 in 62f3761

if isRSA {

ku |= RSAKeyUsage

}

What about:

Suggested change

// If unset, defaults to `digital signature` and `key encipherment`.

// If unset, defaults to `digital signature` (and `key encipherment` for RSA keys).

marc1404 · 2026-09-04T10:56:25Z

+	if src.LiteralSubject != "" {
+		spec.LiteralSubject = &src.LiteralSubject
+	}


Earlier in the function CommonName is set, but there's no exclusivity check here to use either CommonName or LiteralSubject

cert-management/pkg/certman2/controller/source/common/certinput.go

Lines 187 to 195 in 62f3761

if len(src.Domains) > 0 {

if len(src.Domains[0]) <= 64 {

spec.CommonName = &src.Domains[0]

spec.DNSNames = normalizeArray(src.Domains[1:])

} else {

spec.CommonName = nil

spec.DNSNames = src.Domains

}

}

gardener-prow Bot added kind/enhancement Enhancement, improvement, extension size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Aug 25, 2026

MartinWeindel and others added 12 commits August 25, 2026 14:58

Add subject, literalsubject, and key usages to types

d793c38

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

add ValidateSubjectExclusivity method

c6a6faf

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

extend certificate hash calculation

ff1e2ec

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

Add tests for ToKeyUsages

c42071d

Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Martin Weindel <martin.weindel@sap.com>

Add support for annotations for literal subject and usages on source …

a4e2f64

…objects Signed-off-by: Martin Weindel <martin.weindel@sap.com>

fix functional tests

e538cb3

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

Consider common name from literalsubject in method ExtractDomains

ae0a71f

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

Add ignore note to new fields for ACME issuers

829344e

Signed-off-by: Martin Weindel <martin.weindel@sap.com>

MartinWeindel force-pushed the enh/subject-and-usages branch from 80d399f to 62f3761 Compare August 25, 2026 13:01

MartinWeindel mentioned this pull request Aug 25, 2026

Support for Setting Subject DN in Self-Signed Certificate API #564

Open

marc1404 reviewed Sep 4, 2026

View reviewed changes

Navigation Menu

Uh oh!

Support `subject`, `literalSubject`, and `usages` for CA and self-signed certificates. - #813

Support `subject`, `literalSubject`, and `usages` for CA and self-signed certificates.#813
MartinWeindel wants to merge 12 commits into
masterfrom
enh/subject-and-usages

MartinWeindel commented Aug 25, 2026 •

edited

Loading

Uh oh!

gardener-prow Bot commented Aug 25, 2026

Uh oh!

MartinWeindel commented Aug 25, 2026

Uh oh!

marc1404 Aug 31, 2026

Uh oh!

marc1404 Aug 31, 2026

Uh oh!

marc1404 Aug 31, 2026

Uh oh!

marc1404 left a comment •

edited

Loading

Uh oh!

marc1404 Sep 4, 2026

Uh oh!

marc1404 Sep 4, 2026

Uh oh!

marc1404 Sep 4, 2026

Uh oh!

marc1404 Sep 4, 2026

Uh oh!

marc1404 Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	if spec.CommonName != nil {
	h.Write([]byte(*spec.CommonName))
	h.Write([]byte{0})
	}

	if cert.Spec.LiteralSubject == nil {
	spec.CommonName = result.CommonName
	}

	func (r *sourceReconciler) createEntryFor(logger logger.LogContext, obj resources.Object, info CertInfo, feedback CertFeedback) error {
	cert := &api.Certificate{}
	cert.GenerateName = strings.ToLower(r.nameprefix + obj.GetName() + "-" + obj.GroupKind().Kind + "-")
	resources.SetAnnotation(cert, AnnotForwardOwnerRefs, "true")
	if r.targetclass != "" {
	resources.SetAnnotation(cert, AnnotClass, r.targetclass)
	}
	if len(info.Domains) > 0 {
	if len(info.Domains[0]) <= 64 {
	cert.Spec.CommonName = &info.Domains[0]
	cert.Spec.DNSNames = info.Domains[1:]
	} else {
	cert.Spec.CommonName = nil
	cert.Spec.DNSNames = info.Domains
	}
	}
	if info.IssuerName != nil {
	parts := strings.SplitN(*info.IssuerName, "/", 2)
	if len(parts) == 2 {
	cert.Spec.IssuerRef = &api.IssuerRef{Namespace: parts[0], Name: parts[1]}
	} else {
	cert.Spec.IssuerRef = &api.IssuerRef{Name: *info.IssuerName}
	}
	}
	cert.Spec.SecretRef = &core.SecretReference{
	Name: info.SecretName.Name,
	Namespace: info.SecretName.Namespace,
	}
	if r.namespace == "" {
	cert.Namespace = obj.GetNamespace()
	} else {
	cert.Namespace = r.namespace
	}
	if info.FollowCNAME {
	cert.Spec.FollowCNAME = &info.FollowCNAME
	}
	cert.Spec.SecretLabels = info.SecretLabels
	if info.PreferredChain != "" {
	cert.Spec.PreferredChain = &info.PreferredChain
	}

	cert.Spec.PrivateKey = createPrivateKey(info.PrivateKeyAlgorithm, info.PrivateKeySize, info.PrivateKeyEncoding)

	// Set renewBefore (validation will happen in certificate reconciler)
	if info.RenewBefore != nil {
	cert.Spec.RenewBefore = info.RenewBefore
	}

	for key, value := range info.Annotations {
	resources.SetAnnotation(cert, key, value)
	}

	e, _ := r.SlaveResoures()[0].Wrap(cert)

	err := r.Slaves().CreateSlave(obj, e)
	if err != nil {
	if feedback != nil {
	feedback.Failed(&info, err)
	}
	return err
	}
	obj.Eventf(core.EventTypeNormal, "reconcile", "created certificate object %s", e.ObjectName())
	logger.Infof("created certificate object %s", e.ObjectName())
	if feedback != nil {
	feedback.Pending(&info, "")
	}
	return nil
	}

	// If unset, defaults to `digital signature` and `key encipherment`.
	// If unset, defaults to `digital signature` (and `key encipherment` for RSA keys).

	if len(src.Domains) > 0 {
	if len(src.Domains[0]) <= 64 {
	spec.CommonName = &src.Domains[0]
	spec.DNSNames = normalizeArray(src.Domains[1:])
	} else {
	spec.CommonName = nil
	spec.DNSNames = src.Domains
	}
	}

Uh oh!

Conversation

MartinWeindel commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gardener-prow Bot commented Aug 25, 2026

Uh oh!

MartinWeindel commented Aug 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marc1404 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

MartinWeindel commented Aug 25, 2026 •

edited

Loading

marc1404 left a comment •

edited

Loading