maintenance: use client rid as mtls cert subject

Author: tschaefer

internal/mtls/mtls.go

@@ -14,6 +14,8 @@ import (
 	"fmt"
 	"math/big"
 	"time"
+
+	"github.com/tschaefer/finchctl/internal/version"
 )
 
 const CertValidityDays = 90 * 24 * time.Hour
@@ -30,11 +32,8 @@ func GenerateCA(hostname string) ([]byte, []byte, error) {
 	}
 
 	template := x509.Certificate{
-		SerialNumber: serialNumber,
-		Subject: pkix.Name{
-			Organization: []string{"Finch"},
-			CommonName:   fmt.Sprintf("Finch CA - %s", hostname),
-		},
+		SerialNumber:          serialNumber,
+		Subject:               pkix.Name{CommonName: hostname},
 		NotBefore:             time.Now(),
 		NotAfter:              time.Now().Add(CertValidityDays),
 		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature,
@@ -95,14 +94,11 @@ func GenerateClient(hostname string, caCertPEM, caKeyPEM []byte) ([]byte, []byte
 
 	template := x509.Certificate{
 		SerialNumber: serialNumber,
-		Subject: pkix.Name{
-			Organization: []string{"Finch"},
-			CommonName:   fmt.Sprintf("Finch Client - %s", hostname),
-		},
-		NotBefore:   time.Now(),
-		NotAfter:    time.Now().Add(CertValidityDays),
-		KeyUsage:    x509.KeyUsageDigitalSignature,
-		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		Subject:      pkix.Name{CommonName: version.ResourceID()},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().Add(CertValidityDays),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 	}
 
 	clientCertDER, err := x509.CreateCertificate(rand.Reader, &template, caCert, &clientKey.PublicKey, caKey)

internal/mtls/mtls_test.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/brianvoe/gofakeit/v7"
 	"github.com/stretchr/testify/assert"
+	"github.com/tschaefer/finchctl/internal/version"
 )
 
 func Test_GenerateCA(t *testing.T) {
@@ -48,7 +49,7 @@ func Test_GenerateClient(t *testing.T) {
 	cert, err := x509.ParseCertificate(block.Bytes)
 	assert.NoError(t, err, "client cert should parse")
 	assert.False(t, cert.IsCA, "cert should not be CA")
-	assert.Contains(t, cert.Subject.CommonName, hostname, "cert CN should contain hostname")
+	assert.Contains(t, cert.Subject.CommonName, version.ResourceID(), "cert CN should contain client rid")
 	assert.Contains(t, cert.ExtKeyUsage, x509.ExtKeyUsageClientAuth, "cert should have client auth usage")
 }