Bug 1165405
| Summary: | Remove the cacert and cakey settings in server.conf | ||
|---|---|---|---|
| Product: | [Retired] Pulp | Reporter: | Randy Barlow <rbarlow> |
| Component: | async/tasks | Assignee: | pulp-bugs |
| Status: | CLOSED UPSTREAM | QA Contact: | pulp-qe-list |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 2.4.0 | CC: | jortel |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | 3.0.0 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-02-28 22:45:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1165403 | ||
| Bug Blocks: | |||
Moved to https://pulp.plan.io/issues/623 |
Description of problem: The cacert and cakey settings in server.conf are currently used to configure Pulp to use a CA for signing client certificates generated by Pulp. These settings often confuse our users, as they tend to think it should be the CA that signed the httpd SSL certificates. In addition, it is far from ideal that our /login/ API call generates the secret key, certificate, and signature and sends those to the client. This violates the principle that the key should never be transmitted. We have two viable options: 1) Rename these settings to be more descriptive so that they don't confuse users. Something like client_auth_ca{cert,key} might make sense. If we do this, the client should generate the secret key and a CSR, and send that CSR with their credentials to the /login/ call. Then the server signs the CSR and sends back the certificate. 2) Get out of the business of signing certificates entirely, and change /login/ to return a session key or something along those lines. Of course, continue to support client certificates that are generated by users on both ends (through Apache and pulp-admin). Either way, we need to remove these two settings with a major release of Pulp. I would suggest that we should do this with Pulp 3.0.0. This bug is not about changing the /login/ behavior, it is about removing these two settings. Version-Release number of selected component (if applicable): 2.4.0-1 How reproducible: Every time. Steps to Reproduce: 1. Does Pulp have these settings in server.conf? Actual results: Yes. Expected results: No.