Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-9464

mtls CRL not working when using an intermediate CA

    XMLWordPrintable

Details

    • Critical
    • 55
    • Sprint 234, Sprint 235, Sprint 236, Sprint 237
    • 4
    • Rejected
    • Unspecified
    • Hide
      * Previously, when a client mutual TLS (mTLS) was configured on an ingress controller, if any of the client certificate authority (CA) certificates included a certificate revocation list (CRL) distribution point for a CRL issued by a different CA and that CRL expired, the mismatch between the distributing CA and the issuing CA caused the incorrect CRL to be downloaded. Consequently, the CRL bundle would be updated to contain an extra copy of the erroneously downloaded CRL, and the CRL that needed to be updated would be missing. Because of the missing CRL, connections with valid client certificates might have been rejected with the following error: `unknown ca`.
      +
      With this update, downloaded CRLs are now tracked by the CA that distributes them. When a CRL expires, the distributing CA's CRL distribution point is used to download an updated CRL. As a result, valid client certificates are no longer rejected. (link:https://issues.redhat.com/browse/OCPBUGS-9464[*OCPBUGS-9464*])
      Show
      * Previously, when a client mutual TLS (mTLS) was configured on an ingress controller, if any of the client certificate authority (CA) certificates included a certificate revocation list (CRL) distribution point for a CRL issued by a different CA and that CRL expired, the mismatch between the distributing CA and the issuing CA caused the incorrect CRL to be downloaded. Consequently, the CRL bundle would be updated to contain an extra copy of the erroneously downloaded CRL, and the CRL that needed to be updated would be missing. Because of the missing CRL, connections with valid client certificates might have been rejected with the following error: `unknown ca`. + With this update, downloaded CRLs are now tracked by the CA that distributes them. When a CRL expires, the distributing CA's CRL distribution point is used to download an updated CRL. As a result, valid client certificates are no longer rejected. (link: https://issues.redhat.com/browse/OCPBUGS-9464 [* OCPBUGS-9464 *])
    • Bug Fix
    • Done

    Description

      Description of problem:

      mtls connection is not working when using an intermetiate CA appart from the root CA, both with CRL defined.
      The Intermediate CA Cert had a published CDP which directed to a CRL issued by the root CA.

      The config map in the openshift-ingress namespace contains the CRL as issued by the root CA. The CRL issued by the Intermediate CA is not present since that CDP is in the user cert and so not in the bundle.

      When attempting to connect using a user certificate issued by the Intermediate CA it fails with an error of unknown CA.

      When attempting to connect using a user certificate issued by the to Root CA the connection is successful.

      Version-Release number of selected component (if applicable):

      4.10.24

      How reproducible:
      Always

      Steps to Reproduce:

      1. Configure CA and intermediate CA with CRL
      2. Sign client certificate with the intermediate CA
      3. Configure mtls in openshift-ingress

      Actual results:

      When attempting to connect using a user certificate issued by the Intermediate CA it fails with an error of unknown CA.
      When attempting to connect using a user certificate issued by the to Root CA the connection is successful.

      Expected results:

      Be able to connect with client certificated signed by the intermediate CA

      Additional info:

      Attachments

        Activity

          People

            rfredett@redhat.com Ryan Fredette
            rhn-support-malonso Maria Del Mar Alonso
            Hongan Li Hongan Li
            Red Hat Employee
            Votes:
            0 Vote for this issue
            Watchers:
            21 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: