From 357c42cb0894f47ffdfc59543cfa4aece3d816e3 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com> Date: Thu, 19 Feb 2026 09:26:22 -0600 Subject: [PATCH] Added Country:US to new CA certs created by Fleet. (#40081) **Related issue:** Resolves #38699 The fix will only apply to new Fleet instances. To fix existing Fleet instances, we need to support rotation: https://github.com/fleetdm/fleet/issues/40080 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually --- changes/38699-ca-cert-country | 1 + ee/server/service/condaccess/config.go | 2 ++ ee/server/service/hostidentity/config.go | 1 + server/mdm/scep/depot/fleet.go | 1 + 4 files changed, 5 insertions(+) create mode 100644 changes/38699-ca-cert-country diff --git a/changes/38699-ca-cert-country b/changes/38699-ca-cert-country new file mode 100644 index 0000000000..be89949315 --- /dev/null +++ b/changes/38699-ca-cert-country @@ -0,0 +1 @@ +- Added Country:US to new CA certs created by Fleet. diff --git a/ee/server/service/condaccess/config.go b/ee/server/service/condaccess/config.go index 99656bb18a..980f366e26 100644 --- a/ee/server/service/condaccess/config.go +++ b/ee/server/service/condaccess/config.go @@ -37,6 +37,7 @@ func initAssets(ctx context.Context, ds fleet.Datastore) error { depot.WithCommonName("Fleet conditional access CA"), // Signal that the CA is local to the deployment and not necessarily managed by Fleet or another external vendor depot.WithOrganization("Local certificate authority"), + depot.WithCountry("US"), ) scepCert, scepKey, err := depot.NewCACertKey(caCert) if err != nil { @@ -69,6 +70,7 @@ func initAssets(ctx context.Context, ds fleet.Datastore) error { depot.WithYears(10), depot.WithCommonName("Fleet conditional access IdP"), depot.WithOrganization("Local certificate authority"), + depot.WithCountry("US"), ) idpCertX509, idpKey, err := depot.NewCACertKey(idpCert) if err != nil { diff --git a/ee/server/service/hostidentity/config.go b/ee/server/service/hostidentity/config.go index 429ef6cfec..cac57d1228 100644 --- a/ee/server/service/hostidentity/config.go +++ b/ee/server/service/hostidentity/config.go @@ -30,6 +30,7 @@ func initAssets(ds fleet.Datastore) error { depot.WithCommonName("Fleet Host Identity CA"), // Signal that the CA is local to the deployment and not necessarily managed by Fleet or another external vendor depot.WithOrganization("Local Certificate Authority"), + depot.WithCountry("US"), ) scepCert, scepKey, err := depot.NewCACertKey(caCert) if err != nil { diff --git a/server/mdm/scep/depot/fleet.go b/server/mdm/scep/depot/fleet.go index 41f6a8b0d1..3efa0b4279 100644 --- a/server/mdm/scep/depot/fleet.go +++ b/server/mdm/scep/depot/fleet.go @@ -33,6 +33,7 @@ func NewSCEPCACertKey() (*x509.Certificate, *rsa.PrivateKey, error) { caCert := NewCACert( WithYears(10), WithCommonName("Fleet"), + WithCountry("US"), ) return NewCACertKey(caCert) }