Bug 1671247
| Summary: | CC: Enable AIA OCSP cert checking for entire cert chain [rhel-7.6.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | RAD team bot copy to z-stream <autobot-eus-copy> |
| Component: | jss | Assignee: | Jack Magne <jmagne> |
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.7 | CC: | akahat, mharmsen |
| Target Milestone: | rc | Keywords: | TestCaseProvided, ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | jss-4.4.4-5.el7_6 | Doc Type: | Bug Fix |
| Doc Text: |
ause:
Previously when configuring a CS subsystem to perform ocsp checking based upon the AIA extension of each cert to be evaluated, the feature would only perform the desired ocsp check on the leaf cert and not the rest of the certificate chain.
Consequence:
This resulted in a possibly incomplete ocsp verification of a certficate and its chain. If a member of the chain had been revoked, the pki subsystem will still think the leaf cert is valid.
Fix:
The resolution to this particular issue was to enhance the behavior of the ocsp checking in JSS for ONLY the AIA extension URL checking scenario. When AIA extensions are being consulted, the system has been enhanced to check the leaf cert and the cert chain for verification.
Result:
As a result, a full verification of a cetificate and its chain can be relied upon to have taken place correctly by interested parties.
|
Story Points: | --- |
| Clone Of: | 1666872 | Environment: | |
| Last Closed: | 2019-03-13 18:45:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1666872 | ||
| Bug Blocks: | |||
|
Description
RAD team bot copy to z-stream
2019-01-31 08:12:17 UTC
Test Procedure: * https://bugzilla.redhat.com/show_bug.cgi?id=1666872#c7 * https://bugzilla.redhat.com/show_bug.cgi?id=1666872#c8 Marking the bug on Assigned state to fix the ocsp check problem reported by CC lab. I tested this bugzilla on 10.5.9-13.el7_6 I followed steps (In #comment 4) which are mentioned by Jack Observations: 1. I could see the subsystems could hit the Internal OCSP. 2. If key archival is done then it should check the certificate against the CA/SubCA 3. As negative test cases, I revoked RootCA cert. And as expected it was not working. Verifying this BZ. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0505 |