Bug 2225253

Description of problem:

[RFE]: TLS 1.3 Support for Candlepin in Satellite 6

Version-Release number of selected component (if applicable):
satellite-6.14.0-3.el8sat.noarch
candlepin-4.3.1-1.el8sat.noarch

How reproducible:
New installation

Steps to Reproduce:

1. Install the latest version of satellite 6 on RHEL 8
2. Test the connection through openssl/Curl/nmap



Actual results:

# nmap --script +ssl-enum-ciphers localhost -p 23443

PORT      STATE SERVICE
23443/tcp open  unknown
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|     compressors: 
|       NULL
|     cipher preference: client
|     warnings: 
|       Key exchange (secp256r1) of lower strength than certificate key
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 0.50 seconds


# curl --tlsv1.3 -v https://localhost:23443/candlepin --cacert /etc/pki/katello/certs/katello-default-ca.crt
*   Trying ::1...
* TCP_NODELAY set
* connect to ::1 port 23443 failed: Connection refused
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 23443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/katello/certs/katello-default-ca.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, protocol version (582):
* error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version
* Closing connection 0
curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version


[root@vm255-136 ~]# openssl s_client -connect localhost:23443 -tls1_3 -CAfile /etc/pki/katello/certs/katello-default-ca.crt
CONNECTED(00000003)
139807602083648:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:ssl/record/rec_layer_s3.c:1544:SSL alert number 70
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 240 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

Expected results:


Additional info:

The expectation for the Request for Enhancement (RFE) to add TLS 1.3 support in candlepin
TLS 1.3 is the latest version of the TLS protocol and offers enhanced security and performance benefits over earlier versions. The expectation is that supporting TLS 1.3 will improve the overall security posture of Foreman Proxy and Satellite 6.


# /usr/sbin/tomcat version
Server version: Apache Tomcat/9.0.50
Server built:   Jun 24 2022 20:49:41 UTC
Server number:  9.0.50.0
OS Name:        Linux
OS Version:     4.18.0-240.el8.x86_64
Architecture:   amd64
JVM Version:    17.0.8+7-LTS
JVM Vendor:     Red Hat, Inc.