Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-45290

[4.19] Routes with SHA1 CA certificate break HAProxy reloading

XMLWordPrintable

    • Moderate
    • None
    • NE Sprint 263, NE Sprint 264, NE Sprint 265, NI&D Sprint 266
    • 4
    • Rejected
    • False
    • Hide

      None

      Show
      None
    • Hide
      *Cause*: The router incorrectly assumed that only SHA1 leaf certificates were rejected by HAProxy.
      *Consequence*: The router failed to reject SHA1 intermediate certificates causing HAProxy to fail.
      *Fix*: The router now inspects all non-self-signed certificates and rejects any that use SHA1.
      *Result*: The router no longer crashes due to SHA1 intermediate certificates, and self-signed SHA1 certificates are no longer rejected. Root CAs can continue to use SHA1.
      Show
      *Cause*: The router incorrectly assumed that only SHA1 leaf certificates were rejected by HAProxy. *Consequence*: The router failed to reject SHA1 intermediate certificates causing HAProxy to fail. *Fix*: The router now inspects all non-self-signed certificates and rejects any that use SHA1. *Result*: The router no longer crashes due to SHA1 intermediate certificates, and self-signed SHA1 certificates are no longer rejected. Root CAs can continue to use SHA1.
    • Bug Fix
    • In Progress

      Description of problem:

          Routes with SHA1 CA certificates (spec.tls.caCertificate) break HAProxy preventing reload

      Version-Release number of selected component (if applicable):

          4.16

      How reproducible:

          Always

      Steps to Reproduce:

          1. create Route with SHA1 CA certificates
    2.
    3.

      Actual results:

          HAProxy router fails to reload

      Expected results:

          HAProxy router should either reject Routes with SHA1 CA certificates, or reload successfully

      Additional info:

          [ALERT]    (312) : config : parsing [/var/lib/haproxy/conf/haproxy.config:131] : 'bind unix@/var/lib/haproxy/run/haproxy-sni.sock' in section 'frontend' : 'crt-list' : error processing line 1 in file '/var/lib/haproxy/conf/cert_config.map' : unable to load chain certificate into SSL Context '/var/lib/haproxy/router/certs/test:test.pem': ca md too weak.

[ALERT]    (312) : config : Error(s) found in configuration file : /var/lib/haproxy/conf/haproxy.config

[ALERT]    (312) : config : Fatal errors found in configuration.

      This is a continuation/variance of https://issues.redhat.com/browse/OCPBUGS-26498

              gspence@redhat.com Grant Spence
              rhn-support-bshirren Brendan Shirren
              Shudi Li Shudi Li
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated: