autosign with --allow-dns-alt-names

[Dejan Golja]

All,

I was wondering if it's possible to change the autosign behavior that it will allow to autosign certs with alternative DNS entries. Currently the problem is if an auto scaling events create another master the autosign on CA will fail, because it has alternative DNS entries.

We also tried to use an external autosign script, but the result is the same.

I understand that's a potential security risk, but we have other measures in place to make it safe. Alternatively we could embed the presigned certs in the cloud init process, but we would like to avoid that.

thank you,
Dejan

[Felix Frank]

On 11/20/2014 05:13 AM, Dejan Golja wrote:
> I was wondering if it's possible to change the autosign behavior that
> it will allow to autosign certs with alternative DNS entries.
> Currently the problem is if an auto scaling events create another
> master the autosign on CA will fail, because it has alternative DNS
> entries.

Hi,

can you elaborate on your problem? I don't really see what's going on.

Who has alternative DNS entries? How does this interfere with your
autosigning?

Thanks,
Felix