Bug 1255651 - [SSL] Use system trusted CA store by default
[SSL] Use system trusted CA store by default
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openldap (Show other bugs)
Unspecified Unspecified
low Severity low
: rc
: ---
Assigned To: Matus Honek
BaseOS QE Security Team
Depends On: 1270678
Blocks: 1255621
  Show dependency treegraph
Reported: 2015-08-21 05:18 EDT by Alon Bar-Lev
Modified: 2016-02-19 10:22 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-02-19 10:22:46 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Alon Bar-Lev 2015-08-21 05:18:11 EDT
Currently /etc/openldap/ldap.conf has the following reference to trust store:

  TLS_CACERTDIR /etc/openldap/cacerts

This is a specific store for openldap in openssl's certdir format. By default this directory is empty, ldapsearch and other utilities cannot be used to access ssl/startTLS servers with valid system wide trusted certificate chains.

ca-certificates package provide update-ca-trust utility to manage the system trust, for openssl it manages /etc/pki/tls/certs/ca-bundle.crt (/etc/ssl/certs which is symlink to /etc/pki/tls/certs),  openldap uses openssl.

openldap package can be integrated to use this system wide store by adding the following into /etc/openldap/ldap.conf:

  TLS_CACERT /etc/pki/tls/certs/ca-bundle.crt

This will have the impact of using the trust provided by system in addition to what exists in /etc/openldap/cacerts.

Integrating openldap into the system wide trust by default will enable easier and more secure management of system trust.
Comment 4 Nathan Kinder 2016-02-19 10:22:46 EST
We do not want to make changes like this that break backwards compatability for upgrades.  Closing as WONTFIX.

Note You need to log in before you can comment on or make changes to this bug.