Bug 1380624 - Need additional cipher suites for LDAPS authentication
Summary: Need additional cipher suites for LDAPS authentication
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 3.2.1
Hardware: x86_64
OS: Unspecified
unspecified
urgent
Target Milestone: ---
: ---
Assignee: Jordan Liggitt
QA Contact: weiwei jiang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-30 07:41 UTC by Kenjiro Nakayama
Modified: 2019-12-16 06:57 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-28 07:39:32 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Kenjiro Nakayama 2016-09-30 07:41:44 UTC
Description of problem:
===
- OpenShift(Golang) doesn't support enough ciphers suites.
- The customer's environment(Windows AD) only allow:

    DHE-RSA-AES256-GCM-SHA384
    DHE-RSA-AES128-GCM-SHA256
    AES256-GCM-SHA384
    AES128-GCM-SHA256

- We need to use OpenShift's LDAPS authentication with these cipher suites.

Version-Release number of selected component (if applicable):
===
- OCP(OSE) 3.2

Additional info:
===
- The error message in Windows AD side is "An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed."

- We confirmed that signature algorithm is sha256, so it is not the issue in https://access.redhat.com/solutions/2525721

  $ openssl x509 -in ldaps.crt -text -noout
      ...
      Signature Algorithm: sha256WithRSAEncryption

- We confirmed that AD administrator temporarily enabled TLS_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_AES_256_CBC_SHA and it worked fine. However, they don't allow these ciphers in production environment.

- Above requested cipher suites are included in TLS v1.2 cipher list.
  TLS v1.2 cipher suites - https://www.openssl.org/docs/manmaster/apps/ciphers.html
  (e.g) TLS_DHE_RSA_WITH_AES_256_GCM_SHA384       DHE-RSA-AES256-GCM-SHA384

Comment 5 Josep 'Pep' Turro Mauri 2016-10-28 07:39:32 UTC
OCP 3.3 is built with go 1.6 which already addresses the TLS handshake cipher suite negotiation reported here, so I'm closing this bug report as currentrelease.


Note You need to log in before you can comment on or make changes to this bug.