certifix

commit efce179f9b0a3309ec22d17629b019eede15af49
parent e0e0e0f7cc64d24a9c2e21754172df64490c3d10
Author: Daniel Barlow <dan@telent.net>
Date:   Tue, 21 Oct 2025 10:01:35 +0100

add extendedKeyUsage=clientAuth only if not set in CSR

this is so that a client can request serverAuth

Diffstat:
M
main.fnl
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/main.fnl b/main.fnl
@@ -99,10 +99,11 @@
       (let [ext (csr:getRequestedExtension i)]
         (crt:addExtension ext)))
     ;; https://www.golinuxcloud.com/add-x509-extensions-to-certificate-openssl/
+    (when (not (crt:getExtension "extendedKeyUsage"))
+      (crt:addExtension (extension.new "extendedKeyUsage" "clientAuth")))
     (doto crt
       (: :addExtension (extension.new "basicConstraints" "critical,CA:FALSE"))
       (: :addExtension (extension.new "keyUsage" "digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment")) ;; all of these?
-      (: :addExtension (extension.new "extendedKeyUsage" "clientAuth"))
       (: :sign ca-key))))
 
 (fn approve-request? [csr]