Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-49389

[4.18] Routes with SHA1 CA certificate break HAProxy reloading

XMLWordPrintable

    • Moderate
    • None
    • 1
    • NI&D Sprint 268
    • 1
    • Rejected
    • False
    • Hide

      None

      Show
      None
    • Hide
      * Previously, the router incorrectly assumed that only `SHA1` leaf certificates were rejected by HAProxy. This caused the router to fail as it rejected `SHA1` intermediate certificates. With this release, the router now inspects all non-self-signed certificates and rejects any that use `SHA1`. The router no longer crashes because of the existence of `SHA1` intermediate certificates. Self-signed `SHA1` certificates are no longer rejected. Root CAs can continue to use `SHA1`. (link:https://issues.redhat.com/browse/OCPBUGS-49389[*OCPBUGS-49389*])
      Show
      * Previously, the router incorrectly assumed that only `SHA1` leaf certificates were rejected by HAProxy. This caused the router to fail as it rejected `SHA1` intermediate certificates. With this release, the router now inspects all non-self-signed certificates and rejects any that use `SHA1`. The router no longer crashes because of the existence of `SHA1` intermediate certificates. Self-signed `SHA1` certificates are no longer rejected. Root CAs can continue to use `SHA1`. (link: https://issues.redhat.com/browse/OCPBUGS-49389 [* OCPBUGS-49389 *])
    • Bug Fix
    • Done

      This is a clone of issue OCPBUGS-45290. The following is the description of the original issue:
      —
      Description of problem:

          Routes with SHA1 CA certificates (spec.tls.caCertificate) break HAProxy preventing reload

      Version-Release number of selected component (if applicable):

          4.16

      How reproducible:

          Always

      Steps to Reproduce:

          1. create Route with SHA1 CA certificates
    2.
    3.

      Actual results:

          HAProxy router fails to reload

      Expected results:

          HAProxy router should either reject Routes with SHA1 CA certificates, or reload successfully

      Additional info:

          [ALERT]    (312) : config : parsing [/var/lib/haproxy/conf/haproxy.config:131] : 'bind unix@/var/lib/haproxy/run/haproxy-sni.sock' in section 'frontend' : 'crt-list' : error processing line 1 in file '/var/lib/haproxy/conf/cert_config.map' : unable to load chain certificate into SSL Context '/var/lib/haproxy/router/certs/test:test.pem': ca md too weak.

[ALERT]    (312) : config : Error(s) found in configuration file : /var/lib/haproxy/conf/haproxy.config

[ALERT]    (312) : config : Fatal errors found in configuration.

      This is a continuation/variance of https://issues.redhat.com/browse/OCPBUGS-26498

              mmasters1@redhat.com Miciah Masters
              openshift-crt-jira-prow OpenShift Prow Bot
              Shudi Li Shudi Li
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: