{"action":"created","comment":{"url":"https://api.github.com/repos/ClusterHQ/flocker/pulls/comments/29885375","id":29885375,"diff_hunk":"@@ -3,7 +3,25 @@\n \"\"\"\n Low-level logic for a certificate authority.\n \n-Uses RSA 4096-bit + SHA 256.\n+We have three categories of certificates:\n+\n+1. Control service, used by AMP and REST API servers. Needs to be\n+   validated over HTTP by 3rd party clients, as well as by AMP clients.\n+2. Node agents, used by AMP clients in agents. Needs to encode a node\n+   UUID, and is validated by the control service.\n+3. API clients. Used by HTTP API clients to authenticate, so the control\n+   service REST API needs to validate them.\n+\n+None of these should be able to impersonate the others. We therefore use\n+the following Distinguised Name scheme:\n+\n+1. Control service: common name is \"control-service\", subjectAltName is\n+   administrator-specifiable DNS hostname, to support standard HTTPS\n+   client authentication, and extendedKeyUsage is set to \"serverAuth\".\n+2. Node agents: common name is \"node-<uuid>\", and extendedKeyUsage is set\n+   to \"clientAuth\" (technically clientAuth means HTTPS, but whatevs).\n+3. API clients: Common name is set to \"user-<username>\", and\n+   extendedKeyUsage is set to \"clientAuth\".","path":"flocker/ca/_ca.py","position":23,"original_position":23,"commit_id":"cb339247d83081c233f7aee63bc421895173c742","original_commit_id":"cb339247d83081c233f7aee63bc421895173c742","user":{"login":"exarkun","id":254565,"avatar_url":"https://avatars.githubusercontent.com/u/254565?v=3","gravatar_id":"","url":"https://api.github.com/users/exarkun","html_url":"https://github.com/exarkun","followers_url":"https://api.github.com/users/exarkun/followers","following_url":"https://api.github.com/users/exarkun/following{/other_user}","gists_url":"https://api.github.com/users/exarkun/gists{/gist_id}","starred_url":"https://api.github.com/users/exarkun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/exarkun/subscriptions","organizations_url":"https://api.github.com/users/exarkun/orgs","repos_url":"https://api.github.com/users/exarkun/repos","events_url":"https://api.github.com/users/exarkun/events{/privacy}","received_events_url":"https://api.github.com/users/exarkun/received_events","type":"User","site_admin":false},"body":"The correct thing for us to do is probably create a new extension type and use that.  This is probably a lot of work and apart from being less abusive of the x509v3 standard (with has interop consequences) I'm not sure it actually makes the software better (rather, if it makes it better, I'm not sure in what ways).  It's perhaps worth a note about follow-up work, though?\r\n\r\n:question: ","created_at":"2015-05-07T19:07:56Z","updated_at":"2015-05-07T19:07:56Z","html_url":"https://github.com/ClusterHQ/flocker/pull/1368#discussion_r29885375","pull_request_url":"https://api.github.com/repos/ClusterHQ/flocker/pulls/1368","_links":{"self":{"href":"https://api.github.com/repos/ClusterHQ/flocker/pulls/comments/29885375"},"html":{"href":"https://github.com/ClusterHQ/flocker/pull/1368#discussion_r29885375"},"pull_request":{"href":"https://api.github.com/repos/ClusterHQ/flocker/pulls/1368"}}},"pull_request":{"url":"https://api.github.com/repos/ClusterHQ/flocker/pulls/1368","id":34653757,"html_url":"https://github.com/ClusterHQ/flocker/pull/1368","diff_url":"https://github.com/ClusterHQ/flocker/pull/1368.diff","patch_url":"https://github.com/ClusterHQ/flocker/pull/1368.patch","issue_url":"https://api.github.com/repos/ClusterHQ/flocker/issues/1368","number":1368,"state":"open","locked":false,"title":"[FLOC-1805] Validating TLS context factories for control service, AMP clients and REST API clients","user":{"login":"itamarst","id":3266662,"avatar_url":"https://avatars.githubusercontent.com/u/3266662?v=3","gravatar_id":"","url":"https://api.github.com/users/itamarst","html_url":"https://github.com/itamarst","followers_url":"https://api.github.com/users/itamarst/followers","following_url":"https://api.github.com/users/itamarst/following{/other_user}","gists_url":"https://api.github.com/users/itamarst/gists{/gist_id}","starred_url":"https://api.github.com/users/itamarst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/itamarst/subscriptions","organizations_url":"https://api.github.com/users/itamarst/orgs","repos_url":"https://api.github.com/users/itamarst/repos","events_url":"https://api.github.com/users/itamarst/events{/privacy}","received_events_url":"https://api.github.com/users/itamarst/received_events","type":"User","site_admin":false},"body":"These will be hooked up in follow-up issue.","created_at":"2015-05-04T16:54:05Z","updated_at":"2015-05-07T19:07:56Z","closed_at":null,"merged_at":null,"merge_commit_sha":"6dffe6d748e4100cd75a839aa83afa4e20300973","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/ClusterHQ/flocker/pulls/1368/commits","review_comments_url":"https://api.github.com/repos/ClusterHQ/flocker/pulls/1368/comments","review_comment_url":"https://api.github.com/repos/ClusterHQ/flocker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ClusterHQ/flocker/issues/1368/comments","statuses_url":"https://api.github.com/repos/ClusterHQ/flocker/statuses/cb339247d83081c233f7aee63bc421895173c742","head":{"label":"ClusterHQ:certificate-validation-FLOC-1805","ref":"certificate-validation-FLOC-1805","sha":"cb339247d83081c233f7aee63bc421895173c742","user":{"login":"ClusterHQ","id":7913449,"avatar_url":"https://avatars.githubusercontent.com/u/7913449?v=3","gravatar_id":"","url":"https://api.github.com/users/ClusterHQ","html_url":"https://github.com/ClusterHQ","followers_url":"https://api.github.com/users/ClusterHQ/followers","following_url":"https://api.github.com/users/ClusterHQ/following{/other_user}","gists_url":"https://api.github.com/users/ClusterHQ/gists{/gist_id}","starred_url":"https://api.github.com/users/ClusterHQ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ClusterHQ/subscriptions","organizations_url":"https://api.github.com/users/ClusterHQ/orgs","repos_url":"https://api.github.com/users/ClusterHQ/repos","events_url":"https://api.github.com/users/ClusterHQ/events{/privacy}","received_events_url":"https://api.github.com/users/ClusterHQ/received_events","type":"Organization","site_admin":false},"repo":{"id":19248542,"name":"flocker","full_name":"ClusterHQ/flocker","owner":{"login":"ClusterHQ","id":7913449,"avatar_url":"https://avatars.githubusercontent.com/u/7913449?v=3","gravatar_id":"","url":"https://api.github.com/users/ClusterHQ","html_url":"https://github.com/ClusterHQ","followers_url":"https://api.github.com/users/ClusterHQ/followers","following_url":"https://api.github.com/users/ClusterHQ/following{/other_user}","gists_url":"https://api.github.com/users/ClusterHQ/gists{/gist_id}","starred_url":"https://api.github.com/users/ClusterHQ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ClusterHQ/subscriptions","organizations_url":"https://api.github.com/users/ClusterHQ/orgs","repos_url":"https://api.github.com/users/ClusterHQ/repos","events_url":"https://api.github.com/users/ClusterHQ/events{/privacy}","received_events_url":"https://api.github.com/users/ClusterHQ/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ClusterHQ/flocker","description":"Easily manage Docker containers & their data","fork":false,"url":"https://api.github.com/repos/ClusterHQ/flocker","forks_url":"https://api.github.com/repos/ClusterHQ/flocker/forks","keys_url":"https://api.github.com/repos/ClusterHQ/flocker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ClusterHQ/flocker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ClusterHQ/flocker/teams","hooks_url":"https://api.github.com/repos/ClusterHQ/flocker/hooks","issue_events_url":"https://api.github.com/repos/ClusterHQ/flocker/issues/events{/number}","events_url":"https://api.github.com/repos/ClusterHQ/flocker/events","assignees_url":"https://api.github.com/repos/ClusterHQ/flocker/assignees{/user}","branches_url":"https://api.github.com/repos/ClusterHQ/flocker/branches{/branch}","tags_url":"https://api.github.com/repos/ClusterHQ/flocker/tags","blobs_url":"https://api.github.com/repos/ClusterHQ/flocker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ClusterHQ/flocker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ClusterHQ/flocker/git/refs{/sha}","trees_url":"https://api.github.com/repos/ClusterHQ/flocker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ClusterHQ/flocker/statuses/{sha}","languages_url":"https://api.github.com/repos/ClusterHQ/flocker/languages","stargazers_url":"https://api.github.com/repos/ClusterHQ/flocker/stargazers","contributors_url":"https://api.github.com/repos/ClusterHQ/flocker/contributors","subscribers_url":"https://api.github.com/repos/ClusterHQ/flocker/subscribers","subscription_url":"https://api.github.com/repos/ClusterHQ/flocker/subscription","commits_url":"https://api.github.com/repos/ClusterHQ/flocker/commits{/sha}","git_commits_url":"https://api.github.com/repos/ClusterHQ/flocker/git/commits{/sha}","comments_url":"https://api.github.com/repos/ClusterHQ/flocker/comments{/number}","issue_comment_url":"https://api.github.com/repos/ClusterHQ/flocker/issues/comments{/number}","contents_url":"https://api.github.com/repos/ClusterHQ/flocker/contents/{+path}","compare_url":"https://api.github.com/repos/ClusterHQ/flocker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ClusterHQ/flocker/merges","archive_url":"https://api.github.com/repos/ClusterHQ/flocker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ClusterHQ/flocker/downloads","issues_url":"https://api.github.com/repos/ClusterHQ/flocker/issues{/number}","pulls_url":"https://api.github.com/repos/ClusterHQ/flocker/pulls{/number}","milestones_url":"https://api.github.com/repos/ClusterHQ/flocker/milestones{/number}","notifications_url":"https://api.github.com/repos/ClusterHQ/flocker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ClusterHQ/flocker/labels{/name}","releases_url":"https://api.github.com/repos/ClusterHQ/flocker/releases{/id}","created_at":"2014-04-28T18:02:14Z","updated_at":"2015-05-07T16:33:07Z","pushed_at":"2015-05-07T18:53:13Z","git_url":"git://github.com/ClusterHQ/flocker.git","ssh_url":"git@github.com:ClusterHQ/flocker.git","clone_url":"https://github.com/ClusterHQ/flocker.git","svn_url":"https://github.com/ClusterHQ/flocker","homepage":"https://clusterhq.com","size":56503,"stargazers_count":1393,"watchers_count":1393,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":79,"mirror_url":null,"open_issues_count":21,"forks":79,"open_issues":21,"watchers":1393,"default_branch":"master"}},"base":{"label":"ClusterHQ:master","ref":"master","sha":"3deca26ba2acd28f8c28fe489b0b9b8ee4e781f3","user":{"login":"ClusterHQ","id":7913449,"avatar_url":"https://avatars.githubusercontent.com/u/7913449?v=3","gravatar_id":"","url":"https://api.github.com/users/ClusterHQ","html_url":"https://github.com/ClusterHQ","followers_url":"https://api.github.com/users/ClusterHQ/followers","following_url":"https://api.github.com/users/ClusterHQ/following{/other_user}","gists_url":"https://api.github.com/users/ClusterHQ/gists{/gist_id}","starred_url":"https://api.github.com/users/ClusterHQ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ClusterHQ/subscriptions","organizations_url":"https://api.github.com/users/ClusterHQ/orgs","repos_url":"https://api.github.com/users/ClusterHQ/repos","events_url":"https://api.github.com/users/ClusterHQ/events{/privacy}","received_events_url":"https://api.github.com/users/ClusterHQ/received_events","type":"Organization","site_admin":false},"repo":{"id":19248542,"name":"flocker","full_name":"ClusterHQ/flocker","owner":{"login":"ClusterHQ","id":7913449,"avatar_url":"https://avatars.githubusercontent.com/u/7913449?v=3","gravatar_id":"","url":"https://api.github.com/users/ClusterHQ","html_url":"https://github.com/ClusterHQ","followers_url":"https://api.github.com/users/ClusterHQ/followers","following_url":"https://api.github.com/users/ClusterHQ/following{/other_user}","gists_url":"https://api.github.com/users/ClusterHQ/gists{/gist_id}","starred_url":"https://api.github.com/users/ClusterHQ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ClusterHQ/subscriptions","organizations_url":"https://api.github.com/users/ClusterHQ/orgs","repos_url":"https://api.github.com/users/ClusterHQ/repos","events_url":"https://api.github.com/users/ClusterHQ/events{/privacy}","received_events_url":"https://api.github.com/users/ClusterHQ/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ClusterHQ/flocker","description":"Easily manage Docker containers & their data","fork":false,"url":"https://api.github.com/repos/ClusterHQ/flocker","forks_url":"https://api.github.com/repos/ClusterHQ/flocker/forks","keys_url":"https://api.github.com/repos/ClusterHQ/flocker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ClusterHQ/flocker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ClusterHQ/flocker/teams","hooks_url":"https://api.github.com/repos/ClusterHQ/flocker/hooks","issue_events_url":"https://api.github.com/repos/ClusterHQ/flocker/issues/events{/number}","events_url":"https://api.github.com/repos/ClusterHQ/flocker/events","assignees_url":"https://api.github.com/repos/ClusterHQ/flocker/assignees{/user}","branches_url":"https://api.github.com/repos/ClusterHQ/flocker/branches{/branch}","tags_url":"https://api.github.com/repos/ClusterHQ/flocker/tags","blobs_url":"https://api.github.com/repos/ClusterHQ/flocker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ClusterHQ/flocker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ClusterHQ/flocker/git/refs{/sha}","trees_url":"https://api.github.com/repos/ClusterHQ/flocker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ClusterHQ/flocker/statuses/{sha}","languages_url":"https://api.github.com/repos/ClusterHQ/flocker/languages","stargazers_url":"https://api.github.com/repos/ClusterHQ/flocker/stargazers","contributors_url":"https://api.github.com/repos/ClusterHQ/flocker/contributors","subscribers_url":"https://api.github.com/repos/ClusterHQ/flocker/subscribers","subscription_url":"https://api.github.com/repos/ClusterHQ/flocker/subscription","commits_url":"https://api.github.com/repos/ClusterHQ/flocker/commits{/sha}","git_commits_url":"https://api.github.com/repos/ClusterHQ/flocker/git/commits{/sha}","comments_url":"https://api.github.com/repos/ClusterHQ/flocker/comments{/number}","issue_comment_url":"https://api.github.com/repos/ClusterHQ/flocker/issues/comments{/number}","contents_url":"https://api.github.com/repos/ClusterHQ/flocker/contents/{+path}","compare_url":"https://api.github.com/repos/ClusterHQ/flocker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ClusterHQ/flocker/merges","archive_url":"https://api.github.com/repos/ClusterHQ/flocker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ClusterHQ/flocker/downloads","issues_url":"https://api.github.com/repos/ClusterHQ/flocker/issues{/number}","pulls_url":"https://api.github.com/repos/ClusterHQ/flocker/pulls{/number}","milestones_url":"https://api.github.com/repos/ClusterHQ/flocker/milestones{/number}","notifications_url":"https://api.github.com/repos/ClusterHQ/flocker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ClusterHQ/flocker/labels{/name}","releases_url":"https://api.github.com/repos/ClusterHQ/flocker/releases{/id}","created_at":"2014-04-28T18:02:14Z","updated_at":"2015-05-07T16:33:07Z","pushed_at":"2015-05-07T18:53:13Z","git_url":"git://github.com/ClusterHQ/flocker.git","ssh_url":"git@github.com:ClusterHQ/flocker.git","clone_url":"https://github.com/ClusterHQ/flocker.git","svn_url":"https://github.com/ClusterHQ/flocker","homepage":"https://clusterhq.com","size":56503,"stargazers_count":1393,"watchers_count":1393,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":79,"mirror_url":null,"open_issues_count":21,"forks":79,"open_issues":21,"watchers":1393,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/ClusterHQ/flocker/pulls/1368"},"html":{"href":"https://github.com/ClusterHQ/flocker/pull/1368"},"issue":{"href":"https://api.github.com/repos/ClusterHQ/flocker/issues/1368"},"comments":{"href":"https://api.github.com/repos/ClusterHQ/flocker/issues/1368/comments"},"review_comments":{"href":"https://api.github.com/repos/ClusterHQ/flocker/pulls/1368/comments"},"review_comment":{"href":"https://api.github.com/repos/ClusterHQ/flocker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ClusterHQ/flocker/pulls/1368/commits"},"statuses":{"href":"https://api.github.com/repos/ClusterHQ/flocker/statuses/cb339247d83081c233f7aee63bc421895173c742"}}}}