Removing pathlen information in accordance with RFC5280 4.2.1.9 (google#78)

* Update entity.go

According to https://tools.ietf.org/html/rfc5280 the pathlen information must be omitted if the CA boolean is false. In this case, since you never assert the CA to be true (hence default false) you must remove the pathlen information.

* remove certMaxPathLen variable

* certMaxPathLen needed to generate templateCA cert

Previously I removed the MaxPathLen and MaxPathLenZero information from Template(), however, TemplateCA() assumes this information present when calling Template() thus I've re-added the certMaxPathLen variable and moved the addition of that pathlen information from Template() to TemplateCA()

* remove pathlen from install,rotate,provision certs

The certificates that were being installed on the devices via RPCs install and provision were using signer() func in gnoi_cert.go that took the CSR from the device. signer() used FromSigningRequest() to sign certs and thus was also adding pathlen information to the certificates that would be installed on the device.

Author: alisharif2

utils/entity/entity.go

@@ -102,8 +102,6 @@ func FromSigningRequest(csr *x509.CertificateRequest) (*Entity, error) {
 		DNSNames:              csr.DNSNames,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
 		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
-		MaxPathLen:            certMaxPathLen,
-		MaxPathLenZero:        true,
 		NotAfter:              time.Now().Add(certExpiration),
 		NotBefore:             time.Now(),
 		SignatureAlgorithm:    csr.SignatureAlgorithm,
@@ -214,6 +212,8 @@ func TemplateCA(cn string) *x509.Certificate {
 	ca := Template(cn)
 	ca.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign | x509.KeyUsageCRLSign
 	ca.IsCA = true
+	ca.MaxPathLen = certMaxPathLen
+	ca.MaxPathLenZero = true
 	return ca
 }
 
@@ -240,8 +240,6 @@ func Template(cn string) *x509.Certificate {
 		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
 		// IsCA,
 		KeyUsage:       x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
-		MaxPathLen:     certMaxPathLen,
-		MaxPathLenZero: true,
 		NotAfter:       time.Now().Add(24 * 365 * time.Hour),
 		NotBefore:      time.Now(),
 		// PermittedDNSDomains,