mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
9d8d07b850
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #37306 I think we should actually solve this at the osquery level, but this is just an alternative solution. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually #### Setup On a macOS VM: 1. Generated a certificate with Cyrillic characters in CN and O fields: ```bash openssl req -x509 -newkey rsa:2048 -keyout newkey.pem -out newcert.pem -days 365 -nodes -utf8 -subj "/CN=АБВГДЕЖЗИКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯа/O=АБВГДЕЖЗИКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯа" ``` 2. Installed the certificate: ```bash sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain newcert.pem ``` #### Before Refetched vitals and observed certificate field too long error logs: ``` ts=2026-02-18T21:50:47Z level=error msg="truncating certificate field" err="certificate field too long" field=subject_org host_id=32 original_length=304 max_length=255 truncated_value=\xC3\x90\xC2\xA2\xC3\x90\xC2\xB5\xC3\x91\xC2\x81\xC3\x91\xC2\x82\xC3\x90\xC2\xBE\xC3\x90\xC2\xB2\xC3\x90\xC2\xB0\xC3\x91\xC2\x8F\xC3\x90\xC2\x9E\xC3\x91\xC2\x80\xC3\x90\xC2\xB3\xC3\x90\xC2\xB0\xC3\x90\xC2\xBD\xC3\x90\xC2\xB8\xC3\x90\xC2\xB7\xC3\x90\xC2\xB ts=2026-02-18T21:50:47Z level=error msg="truncating certificate field" err="certificate field too long" field=subject_common_name host_id=32 original_length=304 max_length=255 truncated_value=\xC3\x90\xC2\xA2\xC3\x90\xC2\xB5\xC3\x91\xC2\x81\xC3\x91\xC2\x82\xC3\x90\xC2\xBE\xC3\x90\xC2\xB2\xC3\x90\xC2\xB0\xC3\x91\xC2\x8F\xC3\x90\xC2\x9E\xC3\x91\xC2\x80\xC3\x90\xC2\xB3\xC3\x90\xC2\xB0\xC3\x90\xC2\xBD\xC3\x90\xC2\xB8\xC3\x90\xC2\xB7\xC3\x90\xC2\xB ts=2026-02-18T21:50:47Z level=error msg="truncating certificate field" err="certificate field too long" field=issuer_org host_id=32 original_length=304 max_length=255 truncated_value=\xC3\x90\xC2\xA2\xC3\x90\xC2\xB5\xC3\x91\xC2\x81\xC3\x91\xC2\x82\xC3\x90\xC2\xBE\xC3\x90\xC2\xB2\xC3\x90\xC2\xB0\xC3\x91\xC2\x8F\xC3\x90\xC2\x9E\xC3\x91\xC2\x80\xC3\x90\xC2\xB3\xC3\x90\xC2\xB0\xC3\x90\xC2\xBD\xC3\x90\xC2\xB8\xC3\x90\xC2\xB7\xC3\x90\xC2\xB ts=2026-02-18T21:50:47Z level=error msg="truncating certificate field" err="certificate field too long" field=issuer_common_name host_id=32 original_length=304 max_length=255 truncated_value=\xC3\x90\xC2\xA2\xC3\x90\xC2\xB5\xC3\x91\xC2\x81\xC3\x91\xC2\x82\xC3\x90\xC2\xBE\xC3\x90\xC2\xB2\xC3\x90\xC2\xB0\xC3\x91\xC2\x8F\xC3\x90\xC2\x9E\xC3\x91\xC2\x80\xC3\x90\xC2\xB3\xC3\x90\xC2\xB0\xC3\x90\xC2\xBD\xC3\x90\xC2\xB8\xC3\x90\xC2\xB7\xC3\x90\xC2\xB ts=2026-02-18T21:50:47Z level=error msg="truncating certificate field" err="certificate field too long" field=subject_org host_id=32 original_length=256 max_length=255 truncated_value=\xD0\x90\xD0\x91\xD0\x92\xD0\x93\xD0\x94\xD0\x95\xD0\x96\xD0\x97\xD0\x98\xD0\x9A\xD0\x9B\xD0\x9C\xD0\x9D\xD0\x9E\xD0\x9F\xD0\xA0\xD0\xA1\xD0\xA2\xD0\xA3\xD0\xA4\xD0\xA5\xD0\xA6\xD0\xA7\xD0\xA8\xD0\xA9\xD0\xAA\xD0\xAB\xD0\xAC\xD0\xAD\xD0\xAE\xD0\xAF\xD0\xB ts=2026-02-18T21:50:47Z level=error msg="truncating certificate field" err="certificate field too long" field=subject_common_name host_id=32 original_length=256 max_length=255 truncated_value=\xD0\x90\xD0\x91\xD0\x92\xD0\x93\xD0\x94\xD0\x95\xD0\x96\xD0\x97\xD0\x98\xD0\x9A\xD0\x9B\xD0\x9C\xD0\x9D\xD0\x9E\xD0\x9F\xD0\xA0\xD0\xA1\xD0\xA2\xD0\xA3\xD0\xA4\xD0\xA5\xD0\xA6\xD0\xA7\xD0\xA8\xD0\xA9\xD0\xAA\xD0\xAB\xD0\xAC\xD0\xAD\xD0\xAE\xD0\xAF\xD0\xB ts=2026-02-18T21:50:47Z level=error msg="truncating certificate field" err="certificate field too long" field=issuer_org host_id=32 original_length=256 max_length=255 truncated_value=\xD0\x90\xD0\x91\xD0\x92\xD0\x93\xD0\x94\xD0\x95\xD0\x96\xD0\x97\xD0\x98\xD0\x9A\xD0\x9B\xD0\x9C\xD0\x9D\xD0\x9E\xD0\x9F\xD0\xA0\xD0\xA1\xD0\xA2\xD0\xA3\xD0\xA4\xD0\xA5\xD0\xA6\xD0\xA7\xD0\xA8\xD0\xA9\xD0\xAA\xD0\xAB\xD0\xAC\xD0\xAD\xD0\xAE\xD0\xAF\xD0\xB ts=2026-02-18T21:50:47Z level=error msg="truncating certificate field" err="certificate field too long" field=issuer_common_name host_id=32 original_length=256 max_length=255 truncated_value=\xD0\x90\xD0\x91\xD0\x92\xD0\x93\xD0\x94\xD0\x95\xD0\x96\xD0\x97\xD0\x98\xD0\x9A\xD0\x9B\xD0\x9C\xD0\x9D\xD0\x9E\xD0\x9F\xD0\xA0\xD0\xA1\xD0\xA2\xD0\xA3\xD0\xA4\xD0\xA5\xD0\xA6\xD0\xA7\xD0\xA8\xD0\xA9\xD0\xAA\xD0\xAB\xD0\xAC\xD0\xAD\xD0\xAE\xD0\xAF\xD0\xB ``` https://github.com/user-attachments/assets/31b80643-34fb-42ee-b3a1-19d54fe1d516 #### After https://github.com/user-attachments/assets/d49c1643-0920-4607-a2f1-fa6bb658c16b |
||
|---|---|---|
| .. | ||
| victor | ||
| .keep | ||
| 13800-obfuscate-calendar-key | ||
| 13836-cert-batch-del | ||
| 14087-authenticate-carve-block-endpoint-before-parsing-data | ||
| 14115-fix-panic-in-grpc-launcher | ||
| 14236-bootstrap-puppet | ||
| 14284-external-deny-list | ||
| 17972-move-entra-instructions | ||
| 25080-show-manage-automations-queries-policies-pages | ||
| 26405-jetbrains | ||
| 27432-add-ipod-support | ||
| 29076-vuln-freetier-webhook | ||
| 30392-surface-failed-install-details | ||
| 30670-python-cve | ||
| 30691-remove-vpp-install-data-host-delete | ||
| 30967-disable-calendar-manage-policy-automations-no-team | ||
| 31160-fix-setting-automation | ||
| 31663-installed-sw-failure | ||
| 31922-do-not-send-windows-profiles-atomically | ||
| 32619-gitops | ||
| 32965-hash-package-name-filters | ||
| 32997-categories | ||
| 33005-macvim | ||
| 33272-delete-software-pending-installs-nuance | ||
| 33296-disk-encryption | ||
| 33519-url-team-id-param | ||
| 33762-ability-to-set-alternative-browser-host | ||
| 33815-fix-missing-installer-from-inventory-after-wipe-reenroll | ||
| 33990-rhel-kernel-vulns | ||
| 34114-packs-page | ||
| 34122-remove-stable-scrollbar-gutters | ||
| 34359-long-script-names-overflow-tables | ||
| 34398-consistent-icon-buttons | ||
| 34501-fix-fleetd-escrow-multi-sessions-x11 | ||
| 34521-dynamic-scep-challenges-for-okta-certs | ||
| 34620-trim-app-fix | ||
| 34635-fix-cte-syntax-for-frontend | ||
| 34748-tooltip-truncated-host-software-type | ||
| 34990-improve-apns-query-efficiency | ||
| 35044-2-vuln-jobs | ||
| 35086-fix-pkg-decoder-error | ||
| 35141-table-sizes | ||
| 35191-git-cve-false-positive | ||
| 35192-imp-correct-classification | ||
| 35193-libtiff | ||
| 35194-safari-cve-false-positives | ||
| 35281-msrc-companion-apps | ||
| 35366-false-negative-adobe-acrobat-reader-dc | ||
| 35447-fix-cpe-translation-error-logging | ||
| 35528-wrong-title-platform | ||
| 35561-move-textarea-copy-icons | ||
| 35603-optimize-query-results | ||
| 35613-android-profiles-pending | ||
| 35659-android-profiles-dont-reverify | ||
| 35717-dont-enqueue-setup-experience-on-previously-enrolled-hosts | ||
| 36069-fix-patch-categories-software-installer | ||
| 36313-fix-timestamps-label-and-teams-creation | ||
| 36324-fix-permission-issue-custom-software-installer-icon | ||
| 36333-android-google-errors | ||
| 36335-7-zip-false-negative-cve | ||
| 36342-scroll-yml-in-gitops-mode | ||
| 36355-activities-max-per_page | ||
| 36361-more-debug-logging-for-ca-profiles | ||
| 36541-missing-vpp-version-add-software | ||
| 36755-add-activity-for-modified-enroll-secrets | ||
| 36770-limit-process-dep-cooldowns | ||
| 36862-fix-flash-message-link-color | ||
| 37006-fix-broken-disk-space-sort | ||
| 37008-manual-agent-install-only-blocks-macos-se-software | ||
| 37072-dep-sync | ||
| 37111-ninxsoft-mist-cve | ||
| 37130-archived-disk-err-msg | ||
| 37146-create-builtin-label-error-msg | ||
| 37155-force-end-user-authentication-host-reenrollment | ||
| 37182-update-policy-membership-when-labels-change | ||
| 37183-unclear-missing-label-error | ||
| 37219-fix | ||
| 37264-gitops-fma-icons | ||
| 37278-okta-fail-my-device-page | ||
| 37290-fix-xcode-vpp-verification | ||
| 37306-fix-certificate-field-truncation | ||
| 37464-installer-size | ||
| 37508-gitops-team-software-display_name | ||
| 37597-ignore-build-version-compare | ||
| 37710-package-parsing | ||
| 37804-filtering-fmas | ||
| 37806-fleet-activities | ||
| 37944-gzip-responses | ||
| 37957-pgadmin-vulnerability | ||
| 38035-android-reenroll | ||
| 38094-ability-to-set-alternative-browser-host | ||
| 38096-alternative-browser-host-gitops | ||
| 38205-remove-incorrect-eua-warning-for-macos | ||
| 38343-use-custom-icon-display-name-in-setup-experience | ||
| 38351-token-auth | ||
| 38369-ui-mdm-commands-off | ||
| 38431-enforce-setup-experience-restrictions | ||
| 38452-display-name | ||
| 38473-add-ipad-screenshot-in-lock-modal | ||
| 38479-otel-shutdown | ||
| 38484-fleet-dev-env-vars | ||
| 38514-android-mdm-empty-state | ||
| 38534-fleet-activities-2 | ||
| 38543-disk-encryption-miscounts | ||
| 38549-okta-cond-access-cert-format | ||
| 38554-populate-idp-host-vitals-android | ||
| 38557-read-users | ||
| 38579-micromdm-scep-fix | ||
| 38582-settings-integration-unfinish-setup-breaks-ui | ||
| 38607-otel-logs | ||
| 38621-add-technician-role | ||
| 38622-vpp-metadata-api-server-config | ||
| 38666-hosts-ui-bug | ||
| 38699-ca-cert-country | ||
| 38704-fail-ipa-installs | ||
| 38756-otel-client-errors | ||
| 38766-uninstall-android-apps-on-fleet-remove | ||
| 38834-update-apple-os-update-time | ||
| 38878-fully-managed-android | ||
| 38880-capture-mdm-enroll-ref-for-ios-ipados | ||
| 38889-slog-1 | ||
| 38911-nextcloud-cve | ||
| 38947-handle-renaming-labels-in-gitops | ||
| 38949-policy-automations-stale-data-after-save | ||
| 38955-bulk-team-transfer-cause-long-db-locks | ||
| 38975-all-teams | ||
| 39000-ca-bypass-per-policy | ||
| 39044-gitops-cal | ||
| 39048-only-default-if-update-new-hosts-not-explictly-set | ||
| 39083-gitops-label-platform-validation | ||
| 39158-cert-auth | ||
| 39215-refetch | ||
| 39228-db-failover | ||
| 39260-fix-enroll-secrets-ui | ||
| 39264-entra-tenants | ||
| 39273-filter-button-hover-fix | ||
| 39293-smallstep-basic-auth | ||
| 39329-rename-teams-and-queries | ||
| 39419-disable-gitops-edit-fma | ||
| 39423-left-align-critical-checkbox-save-policy | ||
| 39437-tarballs-ui-status | ||
| 39522-build-workflow | ||
| 39608-server-worker | ||
| 39613-host-name-not-displayed-hostpage-software-tab | ||
| 39634-bootstrap-migration | ||
| 39687-read-replica-tls | ||
| 39737-dup-kernel | ||
| 39745-notepad-cve | ||
| 39794-alphabetize-host-vitals | ||
| 39871-dep-profile-removed | ||
| 260110-known-mdm-iru | ||
| add-trusted-proxies-config | ||
| clear-sessions-and-tokens-on-password-change | ||
| go-1.25.7 | ||
| issue-36935-better-message-error-token | ||
| issue-37371-not-now-status | ||
| issue-38654-table-wrapping-mdm-card | ||
| issue-39266-update-ui-for-multiple-entra-tenant-ids | ||
| rds-iam-custom-ca-tls | ||