2

I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. For the smaller clusters this worked fine, but when generating a certificate for the larger cluster I ran into this issue:

https://support.venafi.com/hc/en-us/articles/215914307-Error-MS-CA-error-0xc80005e2-while-enrolling

https://social.technet.microsoft.com/wiki/contents/articles/3306.pki-faq-what-is-the-maximum-number-of-names-that-can-be-included-in-the-san-extension.aspx

Essentially the maximum size of the SAN list is 4096 bytes with 2/name for encoding, and my SAN list is already at 4566 bytes even without the encoding overhead.

So, my question is, if I split the SAN list into two certificates (signed by the same CA), is there any way to concatenate the two certs into one file that can be used for applications that require a single certificate file to be specified? Is it as easy as cat cert{1,2}.crt > combined.crt?

Improve this question

2 Answers 2

Reset to default
7

There is no way to combine multiple certificates into a single entity which then can be provided to the client for validation. It is also not possible to send multiple leaf certificates within the TLS handshake to the client in the hope that the client will pick the matching one.

The common way to deal with many names is instead to have many certificates and then use SNI to provide the expected one. This means that the client sends the expected domain inside the server_name extension within the TLS handshake ClientHello and the server will check this extension and provide the certificate which matches the requested name. Of course, this needs support by both client and servers. With HTTPS support for this is common in both clients and servers but for other TLS based protocols this might be different.

Improve this answer
1
  • 3
    Another possibility if you name your machines systematically is (a cert with) a single wildcard name or a list of a few wildcard names.
    – dave_thompson_085
    Commented Dec 25, 2019 at 2:15
0

I think it's unsupported for cert that may be sent within the TLS handshake, and when I execute openssl x509 -in combined.crt -noout -text, only then first CERTIFICATE block display.

But if you concatenate multi CA certs to combined-ca.crt, and use it to verify cert, it's OK. for example, execute openssl verify -CAfile combined-ca.crt foobar.crt, it will return OK if one block of combined.crt can verify the foobar.crt

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .