Fix CA regeneration (#1013)

When regenerating the TLS CA certificate we must be careful to keep the subject of the new CA exactly the same byte for byte.

Otherwise the old CA is not considered in a cert pool when validating certificates issued by the new CA:
https://github.com/golang/go/blob/497cb7c0c3042d3c6605b46a1bf35b7c3bc8b046/src/crypto/x509/cert_pool.go#L144

How the subject is rended into bytes from a pkix.Name struct is not guaranteed to be stable across go versions.

We actually ran into this issue before and already filed a bug for this:
golang/go#45882

Signed-off-by: Fabian Ruff <fabian.ruff@sap.com>

Author: databus23

pkg/util/certificates.go

@@ -377,6 +377,7 @@ func (cf *CertificateFactory) UserCert(principal *models.Principal, apiURL strin
 
 func loadOrCreateCA(kluster *v1.Kluster, name string, cert, key *string, certUpdates *[]CertUpdates) (*Bundle, error) {
 	var existingKey *rsa.PrivateKey
+	var existingSubject []byte
 	regenerate := false
 
 	if name == "TLS" && *cert != "" {
@@ -400,14 +401,15 @@ func loadOrCreateCA(kluster *v1.Kluster, name string, cert, key *string, certUpd
 			if !isRSAKey {
 				return nil, errors.New("Key does not seem to be of type RSA")
 			}
+			existingSubject = caCert.RawSubject
 		}
 	}
 
 	if *cert != "" && *key != "" && !regenerate {
 		return NewBundle([]byte(*key), []byte(*cert))
 	}
 
-	caBundle, err := createCA(kluster.Name, name, existingKey)
+	caBundle, err := createCA(kluster.Name, name, existingKey, existingSubject)
 	if err != nil {
 		return nil, err
 	}
@@ -512,7 +514,7 @@ func ensureServerCertificate(ca *Bundle, cn string, dnsNames []string, ips []net
 	return nil
 }
 
-func createCA(klusterName, name string, existingKey *rsa.PrivateKey) (*Bundle, error) {
+func createCA(klusterName, name string, existingKey *rsa.PrivateKey, existingSubject []byte) (*Bundle, error) {
 	var privateKey *rsa.PrivateKey
 	var err error
 
@@ -538,6 +540,9 @@ func createCA(klusterName, name string, existingKey *rsa.PrivateKey) (*Bundle, e
 		BasicConstraintsValid: true,
 		IsCA:                  true,
 	}
+	if existingSubject != nil && len(existingSubject) > 0 {
+		tmpl.RawSubject = existingSubject
+	}
 
 	certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, privateKey.Public(), privateKey)
 	if err != nil {