Bug 729095
| Summary: | incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Jan Vcelak <jvcelak> |
| Component: | openldap | Assignee: | Jan Vcelak <jvcelak> |
| Status: | CLOSED ERRATA | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.1 | CC: | jplans, jvcelak, omoris, ovasik, rmeggins, tsmetana |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | openldap-2.4.23-17.el6 | Doc Type: | Bug Fix |
| Doc Text: |
- OpenLDAP server with olcVerifyClient setting set 'allow', or client tool setting TLS_REQCERT set to 'allow'. The remote peer certificate is invalid.
- OpenLDAP server/client connection will fail.
- Patches were applied to ignore invalid remote peer certificates when olcVerifyClient (on server side) or TLS_REQCERT (on client side) is set to allow.
- When server's olcVerifyClient setting is set to 'allow', the server allows the connections from remote clients, even if their client certificates are invalid. When client's TLS_REQCERT is set to 'allow', the client allows the connection to remote server, even if the remote server's certificate is invalid.
|
Story Points: | --- |
| Clone Of: | 725819 | Environment: | |
| Last Closed: | 2011-12-06 11:49:36 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 725819 | ||
| Bug Blocks: | |||
|
Description
Jan Vcelak
2011-08-08 17:19:32 UTC
Almost the same problem with client side TLS_REQCERT: http://www.openldap.org/its/index.cgi?findid=7014 Resolved in openldap-2.4.23-17.el6
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
- OpenLDAP server with olcVerifyClient setting set 'allow', or client tool setting TLS_REQCERT set to 'allow'. The remote peer certificate is invalid.
- OpenLDAP server/client connection will fail.
- Patches were applied to ignore invalid remote peer certificates when olcVerifyClient (on server side) or TLS_REQCERT (on client side) is set to allow.
- When server's olcVerifyClient setting is set to 'allow', the server allows the connections from remote clients, even if their client certificates are invalid. When client's TLS_REQCERT is set to 'allow', the client allows the connection to remote server, even if the remote server's certificate is invalid.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1514.html |