Improve TLS certificate generated by LXD

[simondeziel]

The global TLS ecosystem has moved away from using the Common Name (CN) in the Subject field in favor of the better specified Subject Alternative Name (SANs). ATM, client certificate generated by lxc typically don't have any SANs field, just an Organization and a Common Name:

root@s3:~# snap install lxd
...
root@s3:~# lxc remote add foo https://127.0.0.1
Generating a client certificate. This may take a minute...
Error: Get "https://127.0.0.1:8443": Unable to connect to: 127.0.0.1:8443 ([dial tcp 127.0.0.1:8443: connect: connection refused])
root@s3:~# openssl x509 -noout -text -in ~/snap/lxd/common/config/client.crt 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b1:6b:78:43:49:57:ac:eb:78:8d:53:15:40:f6:9f:cd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: O = LXD, CN = root@s3
        Validity
            Not Before: Sep 16 18:23:02 2024 GMT
            Not After : Sep 14 18:23:02 2034 GMT
        Subject: O = LXD, CN = root@s3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
                    04:bd:4f:cc:4b:8f:c0:78:78:d4:ab:5d:e2:57:87:
                    5e:50:a6:a3:fb:8e:e4:40:39:e6:47:80:2a:1b:09:
                    66:1a:1c:8f:30:df:61:09:30:a0:17:bd:8f:dc:80:
                    69:82:08:12:ce:be:28:a6:af:a3:79:e3:17:22:7c:
                    76:3f:44:a9:e2:26:67:ba:36:7e:73:13:39:bb:1e:
                    4a:b1:64:35:13:82:4b:b5:e9:bc:75:40:51:64:ec:
                    06:e7:90:90:ed:fa:a6
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: ecdsa-with-SHA384
    Signature Value:
        30:64:02:30:5f:2e:41:9d:39:c3:4b:6a:c2:91:cb:e8:5c:69:
        0a:f9:95:d6:df:87:f2:77:00:80:ee:c5:73:54:8d:04:2b:17:
        b5:20:51:cb:39:4c:3b:7b:25:d6:e3:7e:b2:59:6c:35:02:30:
        5c:00:64:de:8a:7a:bc:04:3d:46:f0:90:19:ed:55:41:7e:14:
        68:a7:8b:25:ed:d6:d5:6c:f3:67:2b:86:86:1b:74:0b:48:48:
        e8:38:d5:7a:28:75:95:22:18:31:23:32

root@s3:~# openssl x509 -noout -subject -ext subjectAltName -in ~/snap/lxd/common/config/client.crt 
subject=O = LXD, CN = root@s3
No extensions in certificate

This is not an issue as client certificates have their trust verified by checking their fingerprint against the server's trusted list. However, it makes those TLS certs needlessly different.

While not directly applicable to LXD, the certificates used in the web PKI adhere to the CAB forum baseline requirements that recommends leaving out the Subject field and instead have a list of SANs. Web browsers are also ignoring CN in favor of SANs (since Chrome 58 and Firefox 48).

As such, I think LXD should stop populating the Subject line or at least remove the Organization (O = LXD) part of it and instead always add a SANs section.