CloudAgent changes for HyperV-Socket CAs certificates

pkg/certs/certificateAuthority.go

@@ -162,6 +162,10 @@ func (ca *CertificateAuthority) SignRequest(csrPem []byte, oldCertPem []byte, co
 		extKeyUsage = append(extKeyUsage, x509.ExtKeyUsageServerAuth)
 	}
 
+	if conf != nil && conf.IsCA {
+		keyUsage |= x509.KeyUsageCertSign
+	}
+
 	csr, err := DecodeCertRequestPEM(csrPem)
 	if err != nil {
 		return
@@ -185,9 +189,11 @@ func (ca *CertificateAuthority) SignRequest(csrPem []byte, oldCertPem []byte, co
 
 	offset := (time.Hour * 24 * 365)
 	accessIdentity := []byte{}
+	isCA := false
 	if conf != nil {
 		offset = conf.Offset
 		accessIdentity = []byte(conf.Identity)
+		isCA = conf.IsCA
 	}
 	now := time.Now().UTC()
 
@@ -201,6 +207,8 @@ func (ca *CertificateAuthority) SignRequest(csrPem []byte, oldCertPem []byte, co
 		BasicConstraintsValid: true,
 		DNSNames:              csr.DNSNames,
 		IPAddresses:           csr.IPAddresses,
+		IsCA:                  isCA,
+		MaxPathLenZero:        isCA, // Enable MaxPathLenZero only when is CA
 	}
 
 	csrRenewCertsPEM := []byte{}

pkg/certs/util.go

@@ -37,6 +37,7 @@ type SignConfig struct {
 	Offset     time.Duration
 	Identity   string
 	ServerAuth bool
+	IsCA       bool
 }
 
 // AltNames contains the domain names and IP addresses for a cert

rpc/cloudagent/security/certificate/moc_cloudagent_certificate.proto

@@ -37,6 +37,7 @@ message CertificateSigningRequest {
     string locationName = 8;
     string identity = 9;
     int64 validity = 10;
+    google.protobuf.BoolValue isCA = 11;
 }
 
 message Certificate {