fix wildcard dnsname

main.go

@@ -59,6 +59,7 @@ var (
 	tmpCaDestination          string
 	tmpKeyDestination         string
 	certTmpDir                string
+	wildcardTrue              bool
 	key                       *x509.Certificate
 	cert                      *x509.Certificate
 	httpClient                = &http.Client{Timeout: 10 * time.Second}
@@ -95,10 +96,14 @@ func getUpstreamVersion(url string) string {
 }
 
 // check certificates
-func checkCertificates(dnsname string, certificate string, fullchain string, ca string, key string, days int, fail bool) bool {
+func checkCertificates(dnsname string, certificate string, fullchain string, ca string, key string, days int, wildcard bool, fail bool) bool {
 
 	Seconds := days * 86400
 	daysNumber := time.Now().Local().Add(time.Second * time.Duration(Seconds))
+	modifiedDnsname := dnsname
+	if wildcard == true {
+		modifiedDnsname = fmt.Sprintf("*.%v", dnsname)
+	}
 
 	certPEM, err := ioutil.ReadFile(certificate)
 	if err != nil {
@@ -182,7 +187,7 @@ func checkCertificates(dnsname string, certificate string, fullchain string, ca
 
 	opts := x509.VerifyOptions{
 		Roots:         roots,
-		DNSName:       dnsname,
+		DNSName:       modifiedDnsname,
 		CurrentTime:   daysNumber,
 		Intermediates: x509.NewCertPool(),
 	}
@@ -506,6 +511,7 @@ Options:
 	VaultBaseURL = "https://vault.geant.org/v1"
 	if arguments["--wildcard"] == true {
 		modifiedCertName = fmt.Sprintf("wildcard_%v", CertName)
+		wildcardTrue = true
 		if TeamName == "puppet" {
 			VaultURL = fmt.Sprintf("%v/%v/common/vault_sectigo_ov_wildcard_%v_key", VaultBaseURL, TeamName, CertNameUnderscored)
 			RedisCertURL = fmt.Sprintf("%v/%v:common:redis_sectigo_ov_%v_pem.txt", RedisBaseURL, TeamName, CertNameUnderscored)
@@ -519,6 +525,7 @@ Options:
 		}
 	} else {
 		modifiedCertName = fmt.Sprintf(CertName)
+		wildcardTrue = false
 		VaultURL = fmt.Sprintf("%v/%v/%v/vault_%v_key", VaultBaseURL, TeamName, CertName, CertNameUnderscored)
 		RedisCertURL = fmt.Sprintf("%v/%v:%v:redis_%v_pem.txt", RedisBaseURL, TeamName, CertName, CertNameUnderscored)
 		RedisCAURL = fmt.Sprintf("%v/%v:%v:redis_%v_chain_pem.txt", RedisBaseURL, TeamName, CertName, CertNameUnderscored)
@@ -547,7 +554,7 @@ Options:
 	}
 
 	// check if there is a certificate installed and it is valid
-	existingCert := checkCertificates(CertName, certificateDestination, fullchainDestination, caDestination, keyDestination, Days, false)
+	existingCert := checkCertificates(CertName, certificateDestination, fullchainDestination, caDestination, keyDestination, Days, wildcardTrue, false)
 	existingKey := checkPrivkey(keyDestination, certificateDestination, false)
 	if existingCert == true && existingKey == true {
 		fmt.Printf("%v the certificate is still valid\n", infoMsg)
@@ -564,7 +571,7 @@ Options:
 	WriteToFile(ca, tmpCaDestination, 0644)
 	WriteToFile(privKey, tmpKeyDestination, 0640)
 
-	checkCertificates(CertName, tmpCertificateDestination, tmpFullchainDestination, tmpCaDestination, tmpKeyDestination, Days, true)
+	checkCertificates(CertName, tmpCertificateDestination, tmpFullchainDestination, tmpCaDestination, tmpKeyDestination, Days, wildcardTrue, true)
 	checkPrivkey(tmpKeyDestination, tmpCertificateDestination, true)
 
 	// move certificates in place