commit 69e3c0aac99981f17c76c22111e5c397824b8428
author Ian Cordasco <graffatcolmingov@gmail.com> Mon Sep 26 12:53:14 2016 -0500
committer Clark Boylan <clark.boylan@gmail.com> Mon Sep 26 12:21:41 2016 -0700
tree 5161ff84adf40accaccb94041a2a19a9869ec259
parent 9cea4e8570f6a7e1d022bf9eae09223d3144c695

Update certificate creation for urllib3

urllib3 1.18 was released today and contains new more correct hostname
matching that takes into account the ipAddress portion of a certificate
and disallows matching an IP Address against a DNS hostname.

Change-Id: I37d247b68911dc85f55adec6a7952ed321c1b1d8

lib/tls

diff --git a/lib/tls b/lib/tls
index 2c4e18d..78d476f 100644
--- a/lib/tls
+++ b/lib/tls
@@ -226,7 +226,7 @@
     if [[ ! -r $DEVSTACK_CERT ]]; then
         if [[ -n "$TLS_IP" ]]; then
             # Lie to let incomplete match routines work
-            TLS_IP="DNS:$TLS_IP"
+            TLS_IP="DNS:$TLS_IP,IP:$TLS_IP"
         fi
         make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
 
@@ -249,6 +249,9 @@
         else
             alt_names="$alt_names,DNS:$SERVICE_HOST"
         fi
+        if is_ipv4_address "$SERVICE_HOST" ; then
+            alt_names="$alt_names,IP:$SERVICE_HOST"
+        fi
     fi
 
     # Only generate the certificate if it doesn't exist yet on the disk