3

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. For the smaller clusters this worked fine, but when generating a certificate for the larger cluster I ran into this issue:

https://support.venafi.com/hc/en-us/articles/215914307-Error-MS-CA-error-0xc80005e2-while-enrolling

https://social.technet.microsoft.com/wiki/contents/articles/3306.pki-faq-what-is-the-maximum-number-of-names-that-can-be-included-in-the-san-extension.aspx

Essentially the maximum size of the SAN list is 4096 bytes with 2/name for encoding, and my SAN list is already at 4566 bytes even without the encoding overhead.

So, my question is, if I split the SAN list into two certificates (signed by the same CA), is there any way to concatenate the two certs into one file that can be used for applications that require a single certificate file to be specified? Is it as easy as cat cert{1,2}.crt > combined.crt?

6

There is no way to combine multiple certificates into a single entity which then can be provided to the client for validation. It is also not possible to send multiple leaf certificates within the TLS handshake to the client in the hope that the client will pick the matching one.

The common way to deal with many names is instead to have many certificates and then use SNI to provide the expected one. This means that the client sends the expected domain inside the server_name extension within the TLS handshake ClientHello and the server will check this extension and provide the certificate which matches the requested name. Of course, this needs support by both client and servers. With HTTPS support for this is common in both clients and servers but for other TLS based protocols this might be different.

1
  • 3
    Another possibility if you name your machines systematically is (a cert with) a single wildcard name or a list of a few wildcard names. – dave_thompson_085 Dec 25 '19 at 2:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.