Bug 2124934

Summary:	Fix Intermediate Certificate Chains in rsyslog when using ossl driver
Product:	Red Hat Enterprise Linux 8	Reporter:	Sergio Arroutbi <sarroutb>
Component:	rsyslog	Assignee:	Sergio Arroutbi <sarroutb>
Status:	CLOSED ERRATA	QA Contact:	Dalibor Pospíšil <dapospis>
Severity:	unspecified	Docs Contact:	Jan Fiala <jafiala>
Priority:	unspecified
Version:	8.8	CC:	dapospis, jafiala, rsroka
Target Milestone:	rc	Keywords:	AutoVerified, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	rsyslog-8.2102.0-11.el8	Doc Type:	Enhancement
Doc Text:	.OpenSSL driver can now use certificate chains in Rsyslog The `NetstreamDriverCaExtraFiles` directive allows configuring multiple additional certificate authority (CA) files. With this update, you can specify multiple CA files and the OpenSSL library can validate them, which is necessary for SSL certificate chains. As a result, you can use certificate chains in Rsyslog with the OpenSSL driver.	Story Points:	---
Clone Of:	2124849	Environment:
Last Closed:	2023-05-16 08:36:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2124849
Bug Blocks:

Description Sergio Arroutbi 2022-09-07 13:55:45 UTC

+++ This bug was initially created as a clone of Bug #2124849 +++

Description of problem:
rsyslog upstream project has been updated with change to provide additional CA files so that Certificate Chains work appropriately when using OSSL driver.
In particular, change is next: https://github.com/rsyslog/rsyslog/pull/4889
This change should be backported to RHEL8.

Version-Release number of selected component (if applicable):
rsyslog-8.2102.0-10

How reproducible:
Load a configuration with chain certificate files involved, such as:
module(
    load="imtcp"
    StreamDriver.AuthMode="x509/name"
...
    StreamDriver.Name="ossl"
)
input(type="imtcp" Port="6514")
...
global(
    DefaultNetstreamDriver="ossl"
    DefaultNetstreamDriverCAFile="/etc/rsyslogd.d/ca-cert.pem"
    DefaultNetstreamDriverCertFile="/etc/rsyslogd.d/server-cert.pem"
    DefaultNetstreamDriverKeyFile="/etc/rsyslogd.d/server-key.pem"
)
...
When rsyslog is started up, issue: "verify error:num=2:unable to get issuer certificate" is observed in logs. This is because rsyslog version in RHEL8 does not contain appropriate change that allows to specify the ca-root-cert.pem certificate.

Steps to Reproduce:
1. Apply previous configuration
2. Start rsyslog
3. Check logs from rsyslog

Actual results:
rsyslog ossl driver fails on startup

Expected results:
rsyslog ossl driver should not fail on startup. For this fail not to happen, rsyslog RHEL8 version must contain the appropriate changes to handle new configuration option NetstreamDriverCAExtraFiles (https://github.com/rsyslog/rsyslog/pull/4889). Once this is configuration option is handled by rsyslog, an application like this can be applied:
module(
    load="imtcp"
    StreamDriver.AuthMode="x509/name"
...
    StreamDriver.Name="ossl"
)
input(type="imtcp" Port="6514")
...
global(
    DefaultNetstreamDriver="ossl"
    DefaultNetstreamDriverCAFile="/etc/rsyslogd.d/ca-cert.pem"
    DefaultNetstreamDriverCertFile="/etc/rsyslogd.d/server-cert.pem"
    DefaultNetstreamDriverKeyFile="/etc/rsyslogd.d/server-key.pem"
    NetstreamDriverCAExtraFiles="/etc/rsyslogd.d/ca-root-cert.pem"
)
...
Application of previous configuration together with backport of the change in upstream handling OpenSSL configuration will enable chain certificate handling with ossl driver in rsyslog

Additional info:

Comment 2 Dalibor Pospíšil 2022-09-23 12:31:02 UTC

*** Bug 2065760 has been marked as a duplicate of this bug. ***

Comment 13 Sergio Arroutbi 2023-03-09 14:02:45 UTC

Hello. Description in general LGTM.

The only aspect to mention is this sentence: "As a result, you can use certificate chains Rsyslog with the OpenSSL driver."

I would use something like: "As a result, you can use certificate chains in Rsyslog with the OpenSSL driver."

But it might be a matter of taste. I am not sure current sentence is grammatically correct.

Comment 17 errata-xmlrpc 2023-05-16 08:36:49 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (rsyslog bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2831