From 0e98cb112cde836729d86a29435b699651174b97 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Tue, 28 Jul 2026 15:51:13 +0000 Subject: [PATCH 1/2] fix(cert): reject mismatched CA key --- dstack/ra-tls/src/cert.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dstack/ra-tls/src/cert.rs b/dstack/ra-tls/src/cert.rs index df8f4aa05..96b7e93a6 100644 --- a/dstack/ra-tls/src/cert.rs +++ b/dstack/ra-tls/src/cert.rs @@ -45,6 +45,13 @@ impl CaCert { /// Instantiate a new CA certificate with a given private key and pem cert. pub fn new(pem_cert: String, pem_key: String) -> Result { let key = KeyPair::from_pem(&pem_key).context("Failed to parse key")?; + let (_, parsed_pem) = x509_parser::pem::parse_x509_pem(pem_cert.as_bytes()) + .context("Failed to parse cert PEM")?; + let parsed_cert = parsed_pem.parse_x509().context("Failed to parse cert DER")?; + anyhow::ensure!( + parsed_cert.public_key().raw == key.public_key_der(), + "CA certificate does not match private key" + ); let cert = CertificateParams::from_ca_cert_pem(&pem_cert).context("Failed to parse cert")?; // TODO: load the cert from the file directly, blocked by https://github.com/rustls/rcgen/issues/274 From 40e27dc36a9594832f8c7c967caa0bdc105c9c3b Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Tue, 4 Aug 2026 03:08:48 -0700 Subject: [PATCH 2/2] style(cert): format CA key validation --- dstack/ra-tls/src/cert.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dstack/ra-tls/src/cert.rs b/dstack/ra-tls/src/cert.rs index 96b7e93a6..9b8b3ff52 100644 --- a/dstack/ra-tls/src/cert.rs +++ b/dstack/ra-tls/src/cert.rs @@ -47,7 +47,9 @@ impl CaCert { let key = KeyPair::from_pem(&pem_key).context("Failed to parse key")?; let (_, parsed_pem) = x509_parser::pem::parse_x509_pem(pem_cert.as_bytes()) .context("Failed to parse cert PEM")?; - let parsed_cert = parsed_pem.parse_x509().context("Failed to parse cert DER")?; + let parsed_cert = parsed_pem + .parse_x509() + .context("Failed to parse cert DER")?; anyhow::ensure!( parsed_cert.public_key().raw == key.public_key_der(), "CA certificate does not match private key"