Bug 1666907
| Summary: | CC: Enable AIA OCSP cert checking for entire cert chain | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Matthew Harmsen <mharmsen> |
| Component: | jss | Assignee: | Alex Scheel <ascheel> |
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.0 | CC: | aakkiang, cpelland, jmagne, mharmsen, prisingh, rhcs-maint |
| Target Milestone: | rc | Keywords: | TestCaseProvided |
| Target Release: | 8.3 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Enhancement | |
| Doc Text: |
ause:
Previously when configuring a CS subsystem to perform ocsp checking based upon the AIA extension of each cert to be evaluated, the feature would only perform the desired ocsp check on the leaf cert and not the rest of the certificate chain.
Consequence:
This resulted in a possibly incomplete ocsp verification of a certficate and its chain. If a member of the chain had been revoked, the pki subsystem will still think the leaf cert is valid.
Fix:
The resolution to this particular issue was to enhance the behavior of the ocsp checking in JSS for ONLY the AIA extension URL checking scenario. When AIA extensions are being consulted, the system has been enhanced to check the leaf cert and the cert chain for verification.
Result:
As a result, a full verification of a certificate and its chain can be relied upon to have taken place correctly by interested parties.
|
Story Points: | --- |
| Clone Of: | 1666872 | Environment: | |
| Last Closed: | 2020-11-04 03:15:05 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1666872 | ||
| Bug Blocks: | |||
|
Comment 1
Matthew Harmsen
2019-01-16 21:57:52 UTC
(In reply to Matthew Harmsen from comment #1) > Late CC bug required for RHEL 7.6.z. > > > This bug will be scheduled for RHEL 8.0 Batch Update 1 to account for any > reqressions. Make that Internal Release 8.0.1 as this capability is currently only utilized via RHEL 7.6.z Common Criteria packages. Not RPL, not CVE, no customer case information, not regression (e.g. - fixed in an earlier release of the product); moving to RHEL Backlog. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:4847 |