Bug 1318154

Summary:	SSL - client accepts server's certificate even if server's root CA is expired
Product:	[JBoss] JBoss Data Virtualization 6	Reporter:	Juraj Duráni <jdurani>
Component:	Teiid	Assignee:	Van Halbert <vhalbert>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Juraj Duráni <jdurani>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.3.0	CC:	aszczucz, blafond, jolee, mbaluch, thauser, vhalbert
Target Milestone:	ER2
Target Release:	6.3.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-08-24 11:40:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Juraj Duráni 2016-03-16 07:52:07 UTC

Description of problem:
If SSL is enabled (1-way or 2-way) server provides to the client certificate which must be signed by valid certificate of trusted CA.
If server provides certificate which is signed by certificate of root CA which already expired client accepts this certificate. Client should not accept such certificate.

This affects 1-way and 2-way authentication modes.

Comment 1 Van Halbert 2016-03-18 19:32:01 UTC

*** Bug 1318167 has been marked as a duplicate of this bug. ***

Comment 2 JBoss JIRA Server 2016-03-21 19:03:36 UTC

Steven Hawkins <shawkins> updated the status of jira TEIID-4080 to Resolved

Comment 3 Juraj Duráni 2016-05-09 08:26:17 UTC

New client property (org.teiid.ssl.checkExpired) and transport property (truststore-check-expired) have been added. User needs to set those to prevent accepting certificates which are signed with untrusted or expired certificates of CA.