Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1439242

Summary: Console should send the full chain of the certificates
Product: OpenShift Container Platform Reporter: Vadim Rutkovsky <vrutkovs>
Component: apiserver-authAssignee: Jordan Liggitt <jliggitt>
Status: CLOSED NOTABUG QA Contact: Chuan Yu <chuyu>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 3.4.0CC: agolis, aos-bugs, lucarval, vsemushi
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-04-05 14:12:26 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Vadim Rutkovsky 2017-04-05 13:39:22 UTC 
Description of problem:
Openshift console sends only one cert on connection, assuming the user has the same CA file as the one used in openshift-ansible's "cafile" param of "openshift_master_named_certificates" variable

Version-Release number of selected component (if applicable):
3.4.0

How reproducible:
Always

Steps to Reproduce:
1. Prepare a root_ca.crt and full_chain.crt
2. Setup openshift via openshift-ansible having:

openshift_master_named_certificates:
- certfile: "server.crt"
  keyfile: "server.key"
  cafile: "full_chain.crt"

3. Run "openssl s_client -connect console.example.com:8443 -CAfile root_ca.crt"

Actual results:
Command fails with 'unable to verify the first certificate'

Expected results:
Command passes with 'ok'

Additional info:
If a full_chain.crt is used openssl command works fine
Comment 3 Jordan Liggitt 2017-04-05 13:55:52 UTC 
the intermediate chain has to be included in the server cert. the CA file should just contain the roots.