Bug 1367434 (rhel7-remove-legacy-cas) - No longer trust legacy CAs in RHEL 7.x
Summary: No longer trust legacy CAs in RHEL 7.x
Keywords:
Status: CLOSED ERRATA
Alias: rhel7-remove-legacy-cas
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ca-certificates
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Kai Engert (:kaie) (inactive account)
QA Contact: Hubert Kario
Mirek Jahoda
URL:
Whiteboard:
: 1335930 (view as bug list)
Depends On: rhel7-openssl1.0.2 1367484 1386616 1386848
Blocks: 1335929 1377248
TreeView+ depends on / blocked
 
Reported: 2016-08-16 11:53 UTC by Kai Engert (:kaie) (inactive account)
Modified: 2017-08-01 21:05 UTC (History)
13 users (show)

Fixed In Version: ca-certificates-2017.2.11-73.el7
Doc Type: Deprecated Functionality
Doc Text:
Previously, to allow older versions of the GnuTLS, OpenSSL and glib-networking libraries to remain compatible with the public web PKI, the ca-certificates package had included a set of legacy CA certificates with 1024-bit RSA keys as trusted by default, although Mozilla had already deprecated them. Because RHEL 7.4.0 contains updated versions of the OpenSSL, GnuTLS and glib-networking libraries, which are able to correctly identify the replacement root CA certificates, trusting these legacy CA certificates is no longer required to be compatible with the public web PKI. This update ca-certificates package removes the legacy CA certificates. The legacy configuration mechanism, which could previously be used to disable the legacy CA certificates, has no longer an effect with this updated ca-certificates package, because the list of legacy CA certificates has been changed to be empty. The ca-certificates packages continues to ship the ca-legacy tool and will keep the current configuration settings, to potentially be reused in the future.
Clone Of:
Environment:
Last Closed: 2017-08-01 21:05:27 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2073 0 normal SHIPPED_LIVE ca-certificates bug fix update 2017-08-01 18:36:39 UTC

Description Kai Engert (:kaie) (inactive account) 2016-08-16 11:53:07 UTC 
We should consider to stop trusting the legacy CAs in RHEL 7, in order to increase security, and to restore alignment with the Mozilla CA list by default.

The original motiviation for having introduced the legacy CA trust is described at
https://fedoraproject.org/wiki/CA-Certificates
and which was added to RHEL 7.2 with bug 1200934.

This work requires that other software in RHEL gets updated to work without having to trusted the legacy CAs.

GnuTLS has already been fixed in an earlier RHEL release.

OpenSSL intends to rebase to version 1.0.2 which contains the required fixes.

Another affected software is glib-networking. It's currently undecided if it can be rebased to include a fix, or if it should block this removal initiative.

If agreed to do, as a result, the legacy CA list in RHEL 7.4 would be changed to be "empty".
Comment 2 Kai Engert (:kaie) (inactive account) 2017-03-01 11:43:27 UTC 
*** Bug 1335930 has been marked as a duplicate of this bug. ***
Comment 7 errata-xmlrpc 2017-08-01 21:05:27 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2073
Note You need to log in before you can comment on or make changes to this bug.