Bug 1444888 - Generate engine certs with X509v3 Subject Alternative Name
Summary: Generate engine certs with X509v3 Subject Alternative Name
Keywords:
Status: CLOSED DUPLICATE of bug 1450629
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: PKI
Version: 4.1.1.8
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ovirt-4.1.3
: ---
Assignee: Lev Veyde
QA Contact: Pavel Stehlik
URL:
Whiteboard:
Depends On:
Blocks: 1449503
TreeView+ depends on / blocked
 
Reported: 2017-04-24 13:37 UTC by Andrei Stepanov
Modified: 2017-06-12 07:49 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-06-12 07:49:01 UTC
oVirt Team: Integration
Embargoed:
rule-engine: ovirt-4.1+
rule-engine: exception+


Attachments (Terms of Use)

Description Andrei Stepanov 2017-04-24 13:37:03 UTC
As you know "Internal engine certificate" should be manually installed in Browser. There are at least two cases for this:

1. Browser-Based Console Clients (SPICE-HTML5 and noVNC).
2. Qcow2 image uploader.

This certificate can be downloaded from: http://<engine_url>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA

Problem is: current ovirt certificate doesn't have "X509v3 Subject Alternative Name" entry:

curl -k 'https://<hostname>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA'  | openssl x509  -text  | grep -i 'Subject Alternative Name'

The certificate must be generated with "X509v3 Subject Alternative Name" extension, like next certificate:

openssl x509 -in some.crt -text

 X509v3 extensions:
           ....
            X509v3 Subject Alternative Name: 
                DNS:fully.qualified.domain.name.com

Chrome 58 cannot upload any qcow2 image, even browser was told to trust engine certificate.  https://www.chromestatus.com/features/4981025180483584

This follows a similar change in Firefox 48.

Comment 1 Yaniv Kaul 2017-04-25 06:55:14 UTC
Interesting, I believe we've had it ages ago... Especially for IE actually.

Comment 2 Yaniv Lavi 2017-05-15 09:35:15 UTC
*** Bug 1450629 has been marked as a duplicate of this bug. ***

Comment 3 Allon Mureinik 2017-05-15 12:06:00 UTC
Didi, isn't this a dup of a bug you're already looking into?

Comment 4 Yedidyah Bar David 2017-05-15 12:16:05 UTC
(In reply to Allon Mureinik from comment #3)
> Didi, isn't this a dup of a bug you're already looking into?

Yes, and Yaniv closed it as dup of current, see above. I tend to do the opposite and close current, because I prefer having a bug per each specific issue, but I admit I didn't yet actually try chrome, so not sure about its behavior. Specifically, comment 0 mixes ca cert with https cert. I do not think chrome requires SAN for the ca cert, but didn't try yet.

Comment 5 Sandro Bonazzola 2017-06-12 07:49:01 UTC

*** This bug has been marked as a duplicate of bug 1450629 ***


Note You need to log in before you can comment on or make changes to this bug.