Server certificates also need to be allowed to be used for client authentication, e.g. etcd servers cross authenticate each other as both servers and clients. (#1758)

davidmccormick · web-flow · commit ca88238888c7 · 2019-10-18T09:53:51.000+01:00
diff --git a/pki/x509.go b/pki/x509.go
@@ -88,7 +88,7 @@ func NewSignedServerCertificate(cfg ServerCertConfig, key *rsa.PrivateKey, caCer
 		NotBefore:    caCert.NotBefore,
 		NotAfter:     time.Now().Add(cfg.Duration).UTC(),
 		KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 	}
 	certDERBytes, err := x509.CreateCertificate(rand.Reader, &certTmpl, caCert, key.Public(), caKey)
 	if err != nil {

Original file line number	Diff line number	Diff line change
`@@ -88,7 +88,7 @@ func NewSignedServerCertificate(cfg ServerCertConfig, key *rsa.PrivateKey, caCer`
`88`	`88`	`NotBefore: caCert.NotBefore,`
`89`	`89`	`NotAfter: time.Now().Add(cfg.Duration).UTC(),`
`90`	`90`	`KeyUsage: x509.KeyUsageKeyEncipherment \| x509.KeyUsageDigitalSignature,`
`91`		`- ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},`
	`91`	`+ ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},`
`92`	`92`	`}`
`93`	`93`	`certDERBytes, err := x509.CreateCertificate(rand.Reader, &certTmpl, caCert, key.Public(), caKey)`
`94`	`94`	`if err != nil {`