Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-14455

mtls CRL not working when using an intermediate CA (4.12)

    XMLWordPrintable

Details

    • Critical
    • No
    • 2
    • Sprint 237
    • 1
    • Rejected
    • False
    • Hide

      None

      Show
      None
    • Hide
      * Previously, because client TLS (mTLS) was configured on an Ingress Controller, mismatches between the distributing certificate authority (CA) and the issuing CA caused the incorrect certificate revocation list (CRL) to be downloaded. As a result, the incorrect CRL was downloaded instead of the correct CRL, causing connections with valid client certificates to be rejected with the error message `unknown ca`. With this update, downloaded CRLs are now tracked by the CA that distributes them. This ensures that valid client certificates are no longer rejected. (link:https://issues.redhat.com/browse/OCPBUGS-14455[*OCPBUGS-14455*])
      Show
      * Previously, because client TLS (mTLS) was configured on an Ingress Controller, mismatches between the distributing certificate authority (CA) and the issuing CA caused the incorrect certificate revocation list (CRL) to be downloaded. As a result, the incorrect CRL was downloaded instead of the correct CRL, causing connections with valid client certificates to be rejected with the error message `unknown ca`. With this update, downloaded CRLs are now tracked by the CA that distributes them. This ensures that valid client certificates are no longer rejected. (link: https://issues.redhat.com/browse/OCPBUGS-14455 [* OCPBUGS-14455 *])
    • Bug Fix
    • Done

    Description

      This is a clone of issue OCPBUGS-9464. The following is the description of the original issue:
      —
      Description of problem:

      mtls connection is not working when using an intermetiate CA appart from the root CA, both with CRL defined.
      The Intermediate CA Cert had a published CDP which directed to a CRL issued by the root CA.

      The config map in the openshift-ingress namespace contains the CRL as issued by the root CA. The CRL issued by the Intermediate CA is not present since that CDP is in the user cert and so not in the bundle.

      When attempting to connect using a user certificate issued by the Intermediate CA it fails with an error of unknown CA.

      When attempting to connect using a user certificate issued by the to Root CA the connection is successful.

      Version-Release number of selected component (if applicable):

      4.10.24

      How reproducible:
      Always

      Steps to Reproduce:

      1. Configure CA and intermediate CA with CRL
      2. Sign client certificate with the intermediate CA
      3. Configure mtls in openshift-ingress

      Actual results:

      When attempting to connect using a user certificate issued by the Intermediate CA it fails with an error of unknown CA.
      When attempting to connect using a user certificate issued by the to Root CA the connection is successful.

      Expected results:

      Be able to connect with client certificated signed by the intermediate CA

      Additional info:

      Attachments

        Issue Links

          clones

          Bug - A problem that impairs or prevents the functions of the product. OCPBUGS-13964 mtls CRL not working when using an intermediate CA

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          is blocked by

          Bug - A problem that impairs or prevents the functions of the product. OCPBUGS-13964 mtls CRL not working when using an intermediate CA

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. OCPBUGS-14457 mtls CRL not working when using an intermediate CA (4.11)

          • Critical - To be worked on immediately following BLOCKER issues.
          • Closed
          is depended on by

          Bug - A problem that impairs or prevents the functions of the product. OCPBUGS-14457 mtls CRL not working when using an intermediate CA (4.11)

          • Critical - To be worked on immediately following BLOCKER issues.
          • Closed
          links to

          GitHub openshift/cluster-ingress-operator#941: [release-4.12] OCPBUGS-14454, OCPBUGS-14455: Handle mTLS CRLs, and fix accidental CRL duplication

          GitHub openshift/router#491: [release-4.12] OCPBUGS-14454, OCPBUGS-14455: Handle mTLS CRLs, and fix accidental CRL duplication

          Activity

            People

              rfredett@redhat.com Ryan Fredette
              openshift-crt-jira-prow OpenShift Prow Bot
              Hongan Li Hongan Li
              Red Hat Employee
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: