Details
-
Bug
-
Resolution: Done
-
Critical
-
None
-
4.12.0
-
None
-
Important
-
5
-
Sprint 227
-
1
-
Rejected
-
False
-
Description
Manual mirror of https://bugzilla.redhat.com/show_bug.cgi?id=2117524 to allow backports to be tracked correctly.
Original bug description:
Description of problem:
On routers configured with mTLS and CRL defined in the CA with a CDP ; new CRL is downloaded only when restarting the ingress-operator.
2022-07-20T23:36:26.943Z INFO operator.clientca_configmap_controller controller/controller.go:298 reconciling {"request": "openshift-ingress-operator/service-bdrc"}
2022-07-20T23:36:26.943Z INFO operator.crl crl/crl_configmap.go:69 certificate revocation list has expired {"subject key identifier": "6aa909992e9890457b2a8de5659a44cab8e867a8"}
2022-07-20T23:36:26.943Z INFO operator.crl crl/crl_configmap.go:69 retrieving certificate revocation list {"subject key identifier": "6aa909992e9890457b2a8de5659a44cab8e867a8"}
2022-07-20T23:36:26.943Z INFO operator.crl crl/crl_configmap.go:169 retrieving CRL distribution point {"distribution point": "http://crl.domain.com/der/CN=XXXX,OU=XXX,O=XXX,C=XXX"}
Version-Release number of selected component (if applicable):
4.9.33
How reproducible:
Enable mTLS with a CRL
Actual results:
CRL is not download when expired
Clients get "SSL client certificate not trusted" errors while accessing resources
Expected results:
ingress-operator triggers CRL download when approaching expiration date so that the configmap is updated without manual action
Attachments
Issue Links
- is depended on by
-
-
- Closed
-