certs: add master2.ldap.test as a SAN on the LDAP certificate

data/certs/master.ldap.test.crt

@@ -1,31 +1,32 @@
 -----BEGIN CERTIFICATE-----
-MIIFTDCCAzSgAwIBAgIUX5BFcLnQi8PTz0LyuRMmfu1wa3gwDQYJKoZIhvcNAQEL
-BQAwKzENMAsGA1UECgwEdGVzdDENMAsGA1UECwwEc3NzZDELMAkGA1UEAwwCY2Ew
-HhcNMjIwMzA3MTA0NDIwWhcNNDExMTIyMTA0NDIwWjA5MQ0wCwYDVQQKDAR0ZXN0
-MQ0wCwYDVQQLDARzc3NkMRkwFwYDVQQDDBBtYXN0ZXIubGRhcC50ZXN0MIICIjAN
-BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtTVnGwHnMPbOoviCl/uSfl/FUpAA
-5Z/2LwZ9d3Jn1qdVJR+aiVdS0L/eZqTyovNnXdMhpaxCqCsytjwKuZvql9h1HeoH
-CZ5P3sSWntOf3UMhMg4MR9VngovKb0gYJQUXzTev0M9ve2qBFf8OiTCsJeMlACcK
-u7FYOkpLZNvP1Rh9zPlJMyx7m9r7a4d5YvUR02RrynRBOnTcL8+1dOhDCqGcguZ0
-W5dJUNceF7Qks4DWSEtM4tmyPPQXyuAwCNEore6b12mNeHAMXd72W/E5+5ohfD9Q
-P4aLjRAUnE1JvWtaQBKtgnr3+tUgGCwOmXHn0gAec9UyjGRuW9qidsQLVWnqQycT
-0iwRplU1WP11I75EfbIjxQqsnatpVBL5cA2T/6GS4SjSb+PnRyOaBjIxMeQnPLKI
-DXA8Zii+GsON3WJ1kfSiXtfv3WpHbNjvQ+8pOMfP3hwW3gmkWJqybuda0rZy+Y2f
-lB+hUtleEBg5+0hkAU0xm+dqblTvOdg5Y7Q6C+P4/YIwBOOUIC7lBtV67Emepd0A
-xUH3nQ30Wvzc2HNbjtE6s/Q+RvGGB/6Zpcj2K/KNXdzt9LE2qM40Rm7UNdYvafEt
-kCqRGZQ040ySNdirViQl4hQX4zzBnjKUFj8XbLeh0v/PZw99PRMB3Zu3Rnm3Qi2u
-+N2HL5EutqLc0TMCAwEAAaNaMFgwHwYDVR0jBBgwFoAUEjy3xbVnEZuxbtPGee5h
-0fTCBn0wCQYDVR0TBAIwADALBgNVHQ8EBAMCBPAwHQYDVR0OBBYEFBLHpP7EbMLK
-XYOLEXMxjOaFbfKkMA0GCSqGSIb3DQEBCwUAA4ICAQC5heiNDU7iHo7H+tgvSbD7
-TTW/Gcgk120v6qdbDEDNESUeNggGvethd0IGjhJUu1GeX/2AIuPX3YOgS+wNHgvI
-Vyi2BAbdwDwS9DQsH8uqm9UhKUbriXFQfumcluNzAQmTMjWhGeYIUC385xyFkvHl
-kncE40zpglYvcBum+9iMlH5mma07SQElIks//kn1SU3Po1IL1DKIVZRD+E6CyU4/
-e1e3xRHC2mt1l18A1KLvE+giP4hFpYfrxGWHSvZNdV6A8EyMHaZCzlsv07wr1LWG
-LHxZF7P/76M4vEY5crP4/si9kOlX3WS6F3NVEYRFIxrz/irgK4uBLzooJnBcpJ1n
-FFuGOvHe79/2L0BOdTOwJKzV6oj0VUln+Bc2iTt8eAHsDDiutTLkRxqBO/Qsv0RT
-0BlOD8UHkD+WKG9jC41DCQAs4Uirr9h+g2mcnvBpuXRV+NBQhm64zn87WV9zy/+f
-DCvCGbl3+JGhrlk/cEve/glF3zP7VSntCIF/RzQzP/NSxYLaUfIg8CwkmfugflwV
-mYoGSac3hIHE7IVd53RCClSGaQ0Ahp3Lm7i7XxLZZcEhArAxWcNIFe6MwNgJ80oD
-h1o8azLw6+3Zv3wReCZQhKjCjMYkZMcSQhBvFG80B2KskOoeSQGfD9byW/HaRE4k
-asZaEzeO/9Yg3s/QK0E/ng==
+MIIFfTCCA2WgAwIBAgITAigKBzJ3CIa5ziijaH5skaN6WjANBgkqhkiG9w0BAQsF
+ADArMQ0wCwYDVQQKDAR0ZXN0MQ0wCwYDVQQLDARzc3NkMQswCQYDVQQDDAJjYTAe
+Fw0yNjEwMTYwMTI4MzRaFw00NjA3MDMwMTI4MzRaMDkxDTALBgNVBAoMBHRlc3Qx
+DTALBgNVBAsMBHNzc2QxGTAXBgNVBAMMEG1hc3Rlci5sZGFwLnRlc3QwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1NWcbAecw9s6i+IKX+5J+X8VSkADl
+n/YvBn13cmfWp1UlH5qJV1LQv95mpPKi82dd0yGlrEKoKzK2PAq5m+qX2HUd6gcJ
+nk/exJae05/dQyEyDgxH1WeCi8pvSBglBRfNN6/Qz297aoEV/w6JMKwl4yUAJwq7
+sVg6Sktk28/VGH3M+UkzLHub2vtrh3li9RHTZGvKdEE6dNwvz7V06EMKoZyC5nRb
+l0lQ1x4XtCSzgNZIS0zi2bI89BfK4DAI0Sit7pvXaY14cAxd3vZb8Tn7miF8P1A/
+houNEBScTUm9a1pAEq2Cevf61SAYLA6ZcefSAB5z1TKMZG5b2qJ2xAtVaepDJxPS
+LBGmVTVY/XUjvkR9siPFCqydq2lUEvlwDZP/oZLhKNJv4+dHI5oGMjEx5Cc8sogN
+cDxmKL4aw43dYnWR9KJe1+/dakds2O9D7yk4x8/eHBbeCaRYmrJu51rStnL5jZ+U
+H6FS2V4QGDn7SGQBTTGb52puVO852DljtDoL4/j9gjAE45QgLuUG1XrsSZ6l3QDF
+QfedDfRa/NzYc1uO0Tqz9D5G8YYH/pmlyPYr8o1d3O30sTaozjRGbtQ11i9p8S2Q
+KpEZlDTjTJI12KtWJCXiFBfjPMGeMpQWPxdst6HS/89nD309EwHdm7dGebdCLa74
+3YcvkS62otzRMwIDAQABo4GLMIGIMB0GA1UdDgQWBBQSx6T+xGzCyl2DixFzMYzm
+hW3ypDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIE8DAfBgNVHSMEGDAWgBQSPLfFtWcR
+m7Fu08Z57mHR9MIGfTAuBgNVHREEJzAlghBtYXN0ZXIubGRhcC50ZXN0ghFtYXN0
+ZXIyLmxkYXAudGVzdDANBgkqhkiG9w0BAQsFAAOCAgEArikxTXTOX8dmT0lbJ4Zs
+J8hEDjAY75hrodMQU2AnYZyhAwUCTpmT752as22ReZ5RzN8rTVLrPV+FjlGhJ8AJ
+qiyuMdl79pTxGNIaVqsrI5MQMneCNLqrJoaZS/GKwLKgTWtsWHCF3PnIwWD6kAfI
+jEnpL3TUaECt81IEXrUfYV5/Xtdeqb3/6oiI0k8FD8Z329RPfxff+yHAdIG0MegG
+3hYiel4SIxkxb/s9CMpgU/0gOxvqfKSFstM2zjBdPWXel1eR325R0ENynm3aX9T6
+t8Hgm1S210+yGXkXvbOzDpiRLH/cegr3uEIgEFXQ/yIOmaeenv5G3CEuoMhHw/uG
+5mRlimGzol2eaKcD36IeRZoZO5ZMtXGgjJ5Z14ib7rDlMvl08KCRzx7zsYh1Ros4
+xC9rLysrNWHJnLqnjvUzNVIVpg7ZLXY9iY2YOt8eu6y9rnRvFBTQrioEVe/OATZg
+cRmahz4trWPieBQXSWe+0fx7jdav03Ck/ePr6gVO2NWYV4IwI+xRiv16+t0jKNse
+4G73QYv83na29/6HjRoZhySCSUlrdGgiHWOQL1NxmKu/WD898kQx9w8sYYSxRyeO
+ZOGsukgRcTCqp9NGZCjH7LlP9ToU0BEpmVrgU0oN/ZQTBRnDl8Iaccz+dATz/93u
+G7ATKGNphIBEgXs8pMxlz3I=
 -----END CERTIFICATE-----

src/tools/gen-certs.sh

@@ -22,11 +22,30 @@ mkdir -p $OUT
 # Create non-encrypted self-signed root certificate authority
 openssl req -new -x509 -days 7200 -config "$REQ_CONFIG" -subj "$SUBJECT/CN=ca" -keyout "$OUT/ca.key" -out "$OUT/ca.crt"
 
+# Extra names a service certificate must also be valid for, besides its own
+# hostname. master2.ldap.test is an alias of master.ldap.test, used by failover
+# topologies that need two distinct LDAP server names.
+declare -A ALIASES=(
+    [master.ldap.test]="master2.ldap.test"
+)
+
 # Create certificates
 for service in master.ldap.test dc.samba.test master.keycloak.test; do
+    # Modern TLS stacks match the hostname against subjectAltName and ignore
+    # CN, so each certificate lists its own name as a SAN as well.
+    san="DNS:$service"
+    for alias in ${ALIASES[$service]}; do
+        san="$san,DNS:$alias"
+    done
+
+    # The base extensions are shared, the SAN is per service.
+    ext="$OUT/$service.ext"
+    cp "$X509_CONFIG" "$ext"
+    echo "subjectAltName=$san" >> "$ext"
+
     openssl req -new -config "$REQ_CONFIG" -subj "$SUBJECT/CN=$service" -keyout "$OUT/$service.key" -out "$OUT/$service.csr"
-    openssl x509 -req -days 7200 -extfile "$X509_CONFIG" -CA "$OUT/ca.crt" -CAkey "$OUT/ca.key" -CAcreateserial -in "$OUT/$service.csr" -out "$OUT/$service.crt"
-    rm -f "$OUT/$service.csr"
+    openssl x509 -req -days 7200 -extfile "$ext" -CA "$OUT/ca.crt" -CAkey "$OUT/ca.key" -CAcreateserial -in "$OUT/$service.csr" -out "$OUT/$service.crt"
+    rm -f "$OUT/$service.csr" "$ext"
 done
 
 rm -f "$OUT/ca.srl"