Make sure to set uri_sans parameter

Signed-off-by: Tomoya Usami <[email protected]>

Author: hiyosi

pkg/server/plugin/upstreamauthority/vault/testdata/intermediate-csr.pem

@@ -1,8 +1,8 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIH5MIGfAgEAMD0xCzAJBgNVBAYTAlVTMQ8wDQYDVQQKDAZTUElGRkUxHTAbBgNV
-BAMMFHRlc3QtaW50ZXJtZWRpYXRlLWNhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
-QgAEJdubi12ArVLguehwX4rkj0YoWYfl2RXtWswLfJuCRRUBNDCmARprr/nbcW2+
-0tQ1gyFnvv04J8D5bz2dnxvB9aAAMAoGCCqGSM49BAMCA0kAMEYCIQDb0bE0odj5
-EXz81sEgUl4DOfcYZ34YOSusS+YElc3jTgIhAPIzNH+mD0goEVgWuVvmgNbZmftw
-8mQYInhuqXq0AmL6
+MIIBEDCBuAIBADAdMQswCQYDVQQGEwJVUzEOMAwGA1UEChMFU1BJUkUwWTATBgcq
+hkjOPQIBBggqhkjOPQMBBwNCAAQI1FDnfpUSdXuUJewcmF+Mlxn1AzsnCIP/zUVm
+ipFC9HtCWgE+5t/C1zChb7LkqhmIDaFmN8BsPpMJyzGoqPLfoDkwNwYJKoZIhvcN
+AQkOMSowKDAmBgNVHREEHzAdhhtzcGlmZmU6Ly9pbnRlcm1lZGlhdGUtc3BpcmUw
+CgYIKoZIzj0EAwIDRwAwRAIgK6jQpWH/yqgj1lA+Trt4kUfHv4zUPXYnpoHu1OM7
+dA0CIEi3E5epUlzXO9gH5lXa/HlbVhVoZK5lcc17tCjAQQlu
 -----END CERTIFICATE REQUEST-----

pkg/server/plugin/upstreamauthority/vault/vault_client.go

@@ -350,10 +350,19 @@ func (c *Client) LookupSelf(token string) (*vapi.Secret, error) {
 func (c *Client) SignIntermediate(ttl string, csr *x509.CertificateRequest) (*SignCSRResponse, error) {
 	csrPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csr.Raw})
 
+	var uris []string
+	for _, uri := range csr.URIs {
+		uris = append(uris, uri.String())
+	}
+	if len(uris) == 0 {
+		return nil, status.Errorf(codes.Internal, "CSR must have least one URIs")
+	}
+
 	reqData := map[string]interface{}{
 		"common_name":  csr.Subject.CommonName,
 		"organization": strings.Join(csr.Subject.Organization, ","),
 		"country":      strings.Join(csr.Subject.Country, ","),
+		"uri_sans":     strings.Join(uris, ","),
 		"csr":          string(csrPEM),
 		"ttl":          ttl,
 	}

pkg/server/plugin/upstreamauthority/vault/vault_client_test.go

@@ -633,6 +633,7 @@ func TestSignIntermediate(t *testing.T) {
 	require.NoError(t, err)
 
 	testTTL := "0"
+	spiffeID := "spiffe://intermediate-spire"
 	csr, err := pemutil.LoadCertificateRequest(testReqCSR)
 	require.NoError(t, err)
 
@@ -641,6 +642,19 @@ func TestSignIntermediate(t *testing.T) {
 	require.NotNil(t, resp.UpstreamCACertPEM)
 	require.NotNil(t, resp.UpstreamCACertChainPEM)
 	require.NotNil(t, resp.CACertPEM)
+
+	cert, err := pemutil.ParseCertificate([]byte(resp.CACertPEM))
+	require.NoError(t, err)
+
+	hasURISAN := func(spiffeID string, cert *x509.Certificate) bool {
+		for _, uri := range cert.URIs {
+			if uri.String() == spiffeID {
+				return true
+			}
+		}
+		return false
+	}(spiffeID, cert)
+	require.True(t, hasURISAN)
 }
 
 func TestSignIntermediateErrorFromEndpoint(t *testing.T) {