Validations in VMware Aria Suite Lifecycle while generating a Certificate / Certificate Signing Request from Locker

Products

• VMware vRealize Suite Lifecycle Manager 8.x

Issue/Introduction

This article outlines the current input validations implemented during certificate and certificate signing request generation. It also provides reasoning for why additional field validations are not required.

Environment

VMware Aria Suite Lifecycle 8.x environment

Resolution

The following validations are available in Locker's Certificate Generation and Certificate Signing Request features:

• Country Code must be no more than 2 characters.
• CN (Common Name) is mandatory.
• IP Address must adhere to proper syntax

 

Additional validations are not necessary because the React framework used in our UI prevents any potential exploitability.

One of the key advantages of React is its use of JSX, a syntax extension that enables writing HTML-like code within JavaScript. JSX is both convenient and secure because it automatically escapes any user input or dynamic values before rendering them to the DOM.

This process ensures that potentially harmful scripts or HTML tags are converted to plain text, preventing their execution and reducing the risk of XSS (Cross-Site Scripting) attacks.

This process is certified and is alligned to VMware's security standards and procedures.