DC field not supported in literalSubject field #5582
Description
Describe the bug:
When using the literalSubject in a Certificate like the following:
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: test-cert-subject
spec:
secretName: test
literalSubject: "DC=admin,DC=SENSITIVE,DC=co,DC=uk,OU=SM,OU=SENSITIVE,OU=SIPlatform,OU=NIX,OU=Servers,CN=SENSITIVE"
dnsNames:
- si-int7obgetccv1.nbsdev.co.uk
duration: 2880h0m0s
issuerRef:
group: cert-manager.io
kind: ClusterIssuer
name: vault-issuer
privateKey:
algorithm: RSA
encoding: PKCS1
rotationPolicy: Always
size: 4096
renewBefore: 720h0m0s
secretName: REDACTED
usages:
- server auth
- client auth
We get admission erros like:
oc apply -f cert-subject.yaml
Error from server (NotAcceptable): error when creating "cert-subject.yaml": admission webhook "webhook.cert-manager.io" denied the request: [spec.literalSubject: Invalid value: "DC=admin,DC=nbsnet,DC=co,DC=uk,OU=SM,OU=OpenShift,OU=REDACTED,OU=NIX,OU=Servers,CN=REDACTED": Literal subject contains unrecognized key with value [uk], spec.literalSubject: Invalid value: "DC=admin,DC=nbsnet,DC=co,DC=uk,OU=SM,OU=OpenShift,OU=REDACTED,OU=NIX,OU=Servers,CN=REDACTED": Literal subject contains unrecognized key with value [co], spec.literalSubject: Invalid value: "DC=admin,DC=nbsnet,DC=co,DC=uk,OU=SM,OU=OpenShift,OU=REDACTED,OU=NIX,OU=Servers,CN=REDACTED: Literal subject contains unrecognized key with value [nbsnet], spec.literalSubject: Invalid value: "DC=admin,DC=nbsnet,DC=co,DC=uk,OU=SM,OU=OpenShift,OU=REDACTED,OU=NIX,OU=Servers,CN=rEDACTED": Literal subject contains unrecognized key with value [admin]]
-->
Essentially all DC keys seems to trip up the validating webhook
Expected behaviour:
We expect this certificate to be created as is
Steps to reproduce the bug:
Install v1.9.1 and enable the LiteralSubject feature flag on both deployment and webhook. then use a certificate containing DC alongside the CN somewhere in literalSubject
Environment details::
- Cloud-provider/provisioner: openshift
- cert-manager version: v1.9.1
/kind bug