// kube-apiserver usage of certs.
func GetHumanCertDetail(certificate *x509.Certificate) string {
	humanName := certificate.Subject.CommonName
	signerHumanName := certificate.Issuer.CommonName
	if certificate.Subject.CommonName == certificate.Issuer.CommonName {
		signerHumanName = "<self>"
	}

	usages := []string{}
	for _, curr := range certificate.ExtKeyUsage {
		if curr == x509.ExtKeyUsageClientAuth {

// the expected SubjectCommonName
func AssertCertificateHasCommonName(t *testing.T, cert *x509.Certificate, commonName string) {
	if cert.Subject.CommonName != commonName {
		t.Errorf("cert has Subject.CommonName %s, expected %s", cert.Subject.CommonName, commonName)
	}
}

// AssertCertificateHasOrganizations is a utility function for kubeadm testing that asserts if a given certificate has

				[]string{org}, cert.Issuer.Organization)
		}

		if cn := expectedFields.CommonName; cn != cert.Subject.CommonName {
			return fmt.Errorf("unexpected value for 'CommonName' field: want %v but got %v",
				cn, cert.Subject.CommonName)
		}
	}
	return nil
}

func sortExtKeyUsage(extKeyUsage []x509.ExtKeyUsage) []int {
	data := make([]int, len(extKeyUsage))

countryName_default = US
stateOrProvinceName = CA
stateOrProvinceName_default = CA
localityName = Sunnyvale
localityName_default = Sunnyvale
organizationalUnitName = Istio
organizationalUnitName_default = Istio
commonName = Intermediate CA
commonName_default = Intermediate CA
commonName_max  = 64

[v3_req]
basicConstraints = CA:TRUE

countryName_default = US
stateOrProvinceName = CA
stateOrProvinceName_default = CA
localityName = Sunnyvale
localityName_default = Sunnyvale
organizationalUnitName = Istio
organizationalUnitName_default = Istio
commonName = Intermediate CA2
commonName_default = Intermediate CA2
commonName_max  = 64

[v3_req]
basicConstraints = CA:TRUE

	ret = n.appendRDNs(ret, n.PostalCode, oidPostalCode)
	ret = n.appendRDNs(ret, n.Organization, oidOrganization)
	ret = n.appendRDNs(ret, n.OrganizationalUnit, oidOrganizationalUnit)
	if len(n.CommonName) > 0 {
		ret = n.appendRDNs(ret, []string{n.CommonName}, oidCommonName)
	}
	if len(n.SerialNumber) > 0 {
		ret = n.appendRDNs(ret, []string{n.SerialNumber}, oidSerialNumber)
	}
	for _, atv := range n.ExtraNames {

			IsDualUse:  true,
		}

		csr, err := GenCSRTemplate(opts)
		if err != nil {
			t.Error(err)
		}

		if csr.Subject.CommonName != tc.expectedCN {
			t.Errorf("unexpected value for 'CommonName' field: want %v but got %v", tc.expectedCN, csr.Subject.CommonName)
		}
	}

	if !kubeletServingRequiredUsages.Equal(usages) && !kubeletServingRequiredUsagesNoRSA.Equal(usages) {
		return fmt.Errorf("usages did not match %v", kubeletServingRequiredUsages.List())
	}

	if !strings.HasPrefix(req.Subject.CommonName, "system:node:") {
		return commonNameNotSystemNode
	}

	return nil
}

var (
	kubeletClientRequiredUsagesNoRSA = sets.NewString(
		string(UsageDigitalSignature),
		string(UsageClientAuth),
	)

kind: Certificate
metadata:
  name: istio-ingressgateway-certs
  namespace: istio-system
spec:
  secretName: istio-ingressgateway-certs
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  commonName: bookinfo.example.com
  dnsNames:
  - bookinfo.example.com
  acme:
    config:
    - http01:
        ingressClass: none
      domains:

// See the License for the specific language governing permissions and
// limitations under the License.

package util

import (
	"fmt"
	"strings"
)

// DualUseCommonName extracts a valid CommonName from a comma-delimited host string
// for dual-use certificates.
func DualUseCommonName(host string) (string, error) {
	// cn uses one hostname, drop the rest
	first := strings.SplitN(host, ",", 2)[0]