CA Should Fix up CSRs to add FQDN to SAN dNSName field

[Doug Chivers]

The use of FQDNs in the CN field of certificates is deprecated (http://tools.ietf.org/html/rfc2818, https://cabforum.org/wp-content/uploads/BRv1.2.3.pdf etc), so the CA should fix up CSRs that do not specify a FQDN in a SubjectAltName dNSName field with the FQDN from the CN field.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/202134
Committed: https://git.openstack.org/cgit/openstack/anchor/commit/?id=5456abff94b46ddc76094a78622b2f762803aa0a
Submitter: Jenkins
Branch: master

commit 5456abff94b46ddc76094a78622b2f762803aa0a
Author: Stanisław Pitucha <email address hidden>
Date: Wed Jul 15 20:35:14 2015 +1000

    Add fixups configuration / processing

    Fixups allow changing the submitted CSR before signing. This may be
    useful for enforcing rules, like removing deprecated options.

    All fixups are available in the "anchor.fixups" namespace and each one
    returns either a new or a modified CSR when it's finished.

    Partial-bug: #1401580
    Change-Id: Id42802194bbdf36799660899eb34f728782bc893

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/220394
Committed: https://git.openstack.org/cgit/openstack/anchor/commit/?id=81264fb9bb092489a578d655ad3deaa00c333d7e
Submitter: Jenkins
Branch: master

commit 81264fb9bb092489a578d655ad3deaa00c333d7e
Author: Stanisław Pitucha <email address hidden>
Date: Fri Sep 4 14:50:36 2015 +1000

    Add fixup enforcing SAN extension

    Fixup to make sure that if we have a CN, we have a matching SAN entry.

    Change-Id: Ic37a053d909f2411e8f08acfa7cf9606a6316e58
    Closes-bug: 1401580