The router should function properly with SHA-1 CA Certificates in the default certificate chain (given the serving/leaf cert is not using SHA-1). The default certificate is provided on the IngressController at spec.defaultCertificate. The router should be able to start & restart successfully as well as serve traffic.

4.16

0% (see note)  

   1. Create a certificate chain where the root or intermediate CA uses SHA1 but the leaf (serving) certificate does not:

wildcard="*.$(oc get ingresses.config/cluster -o jsonpath={.spec.domain})"

openssl req -x509 -sha1 -newkey rsa:2048 -days 3650 -keyout exampleca.key -out exampleca.crt -addext "keyUsage=cRLSign, digitalSignature, keyCertSign" -addext "extendedKeyUsage=serverAuth,clientAuth" -nodes -subj '/C=US/ST=SC/L=Default City/O=Default Company Ltd/OU=Test CA/CN=www.exampleca.com/emailAddress=example@example.com'
openssl req -newkey rsa:2048 -nodes -keyout example.key -out example.csr -subj '/CN=www.example.com/ST=SC/C=US/emailAddress=example@example.com/O=Example/OU=Example'
openssl x509 -req -days 3650 -sha256 -in example.csr -CA exampleca.crt -CAcreateserial -CAkey exampleca.key -extensions ext -extfile <(echo $'[ext]\nbasicConstraints = CA:FALSE\nsubjectKeyIdentifier = none\nauthorityKeyIdentifier = none\nextendedKeyUsage=serverAuth,clientAuth\nkeyUsage=nonRepudiation, digitalSignature, keyEncipherment\nsubjectAltName = DNS:'$wildcard) -out example.crt


   2. Configure this certificate chain as spec.defaultCertificate on the default IngressController:

cat example.crt exampleca.crt > example-combo.crt
oc create secret -n openshift-ingress tls router-cert --key=example.key --cert=example-combo.crt
oc create configmap custom-ca --from-file=ca-bundle.crt=exampleca.crt -n openshift-config
oc patch proxy/cluster --type=merge --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'

# Now patch router-cert to spec.defaultCertificate.name on default ingresscontroller

   3. Check the ingresscontroller or clusteroperator status
   4. Curl the canary route

Curl succeeds and Cluster is upgradeable

Curl succeeds and Cluster is upgradeable