m/p/pki: set correct authority key identifier
The current code sets the AuthorityKeyId of a signed certificate to the
parent's AuthorityKeyId while it should set it to the parent's
SubjectKeyId. This worked as we do not currently use intermediate CAs.
Change-Id: I74dae8b50fd32d2b158ed95ccf918a6a38a1c699
Reviewed-on: https://review.monogon.dev/c/monogon/+/819
Tested-by: Jenkins CI
Reviewed-by: Mateusz Zalega <mateusz@monogon.tech>
diff --git a/metropolis/pkg/pki/ca.go b/metropolis/pkg/pki/ca.go
index 29d1335..b8c2aed 100644
--- a/metropolis/pkg/pki/ca.go
+++ b/metropolis/pkg/pki/ca.go
@@ -67,7 +67,7 @@
// Set the AuthorityKeyID to the SKID of the signing certificate (or self,
// if self-signing).
if ca != nil {
- req.Template.AuthorityKeyId = ca.AuthorityKeyId
+ req.Template.AuthorityKeyId = ca.SubjectKeyId
} else {
req.Template.AuthorityKeyId = req.Template.SubjectKeyId
ca = &req.Template