Set cert fields required by rust-spiffe workload api clients

[glindstedt]

When using rust-spiffe¹ the Workload API client complained about the BasicConstraints extension being missing:

failed to parse X.509 SVID: X.509 extension is missing: 2.5.29.19

SPIFFE spec does not require the pathLenConstraint to be set, so we specify -1 which means that it is unset.²

When verifying the server certificate on the client side while setting up the mTLS connection it failed to parse the certificate with BadEncoding. This turned out to be because NotBefore had not been set, which prevented the certificate from even being parsed before it could be verified.

Footnotes

1. https://github.com/maxlambrecht/rust-spiffe ↩

2. https://spiffe.io/docs/latest/spiffe-specs/x509-svid/#41-basic-constraints ↩

[gemini-code-assist]

Code Review

This pull request updates the InMemoryCA implementation in pkg/spire-devserver/memory-ca.go to include NotBefore timestamps for both CA and SVID certificates, and adds basic constraints to SVIDs for better client compatibility. The review feedback recommends backdating the NotBefore fields by one minute to prevent 'not yet valid' errors caused by clock skew between systems, which is particularly important given the short four-minute lifetime of the SVIDs.

[alec-w]

Thanks @glindstedt 🙂

Is it worth applying those 2 suggestions from Gemini do you think? Stops a small clock drift being a spurious issue in the future (unlikely if this is only used in dev - but code has a funny habit of propagating to production)

[glindstedt]

@alec-w Yeah doesn't hurt, I'll apply them 👍

[alec-w]

Contribution much appreciated 🙂