crypto/x509: verification fails with "cannot parse dnsName" in intermediate

[trunet]

Error starting nginx-ingress-controller:

-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:    0.11.0
  Build:      git-9d0ce7c
  Repository: https://github.com/kubernetes/ingress-nginx
-------------------------------------------------------------------------------
E0226 11:51:47.736103       7 config.go:330] Expected to load root CA config from /var/run/secrets/kubernetes.io/serviceaccount/ca.crt, but got err: error reading /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: x509: cannot parse dnsName "Trunet.co AMS Kubernetes Intermediate CA"
I0226 11:51:47.736577       7 main.go:183] Creating API client for https://10.96.0.1:443
I0226 11:51:47.738134       7 main.go:203] trying to discover Kubernetes version
I0226 11:51:48.199656       7 main.go:212] unexpected error discovering Kubernetes version (attempt Get https://10.96.0.1:443/version: x509: certificate signed by unknown authority): 0

My intermediate CA generated by hashicorp vault, contains:

X509v3 Basic Constraints: critical
    CA:TRUE
X509v3 Subject Alternative Name: 
    DNS:Trunet.co AMS Kubernetes Intermediate CA

This will probably be fixed on kubernetes/client-go#371 and golang/go#23995

[dkoshkin]

I'm seeing a related issue in 0.11.0 that worked with the same setup in the previous version.

I0308 16:44:26.897598       5 main.go:212] unexpected error discovering Kubernetes version (attempt Get https://172.20.0.1:443/version: tls: failed to parse certificate from server: x509: cannot parse dnsName "1520520257.kismatic.integration-tests."): 6

The contents of the cert for the api:

        Subject: CN=ip-10-0-3-226.ec2.internal
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:kubernetes, DNS:kubernetes.default, DNS:kubernetes.default.svc, DNS:kubernetes.default.svc.cluster.local, DNS:ip-10-0-3-226.ec2.internal, DNS:1520520257.kismatic.integration-tests., IP Address:127.0.0.1, IP Address:172.20.0.1, IP Address:184.73.149.217, IP Address:127.0.0.1, IP Address:10.0.3.226

[trunet]

@dkoshkin this is unrelated, as this specific problem is for CA that doesn't need common, altNames validation.

[dkoshkin]

Thanks opened #2188 with more details.