Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1520778

Summary: Can't log in to the director UI with Firefox
Product: Red Hat OpenStack Reporter: Udi Kalifon <ukalifon>
Component: openstack-tripleo-uiAssignee: Juan Antonio Osorio <josorior>
Status: CLOSED CURRENTRELEASE QA Contact: Arik Chernetsky <achernet>
Severity: urgent Docs Contact:
Priority: medium    
Version: 12.0 (Pike)CC: alee, asimonel, beth.white, hrybacki, jjoyce, jrist, jschluet, rcritten, slinaber, tvignaud, ukalifon
Target Milestone: ---Keywords: Triaged, ZStream
Target Release: 12.0 (Pike)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1546364 1546366 (view as bug list) Environment:
Last Closed: 2018-11-01 19:59:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1551635    
Bug Blocks: 1546364, 1546366    

Description Udi Kalifon 2017-12-05 07:01:16 UTC
Description of problem:
When trying to connect to the director UI with Firefox, you get:

Certificate extension value is invalid. Error code: SEC_ERROR_EXTENSION_VALUE_INVALID

This error means that a certificate has an extension with an empty value. Re-generate the certificate without the extension, or re-generate it with a non-empty value.


Version-Release number of selected component (if applicable):
openstack-tripleo-ui-7.4.3-4.el7ost.noarch


How reproducible:
100%


Steps to Reproduce:
1. Use Firefox to connect to the UI


Actual results:
Connection error. You also can't add an exception and accept this certificate.

Comment 1 Udi Kalifon 2017-12-05 09:24:19 UTC
This happens to me only on my bare metal setup, and not with my virtual environments which are set up with IR... It could be a configuration issue but I need help figuring out how the certificate is generated and what options control it.

Comment 2 Jason E. Rist 2018-01-03 15:15:51 UTC
What version of Firefox?

Comment 3 Udi Kalifon 2018-01-03 15:42:44 UTC
Firefox version 57.0.1

Comment 4 Harry Rybacki 2018-01-10 16:23:47 UTC
Udi, could you provide the certificate that is being presented please?

Comment 11 Ade Lee 2018-03-02 16:38:45 UTC
Figured out which cert it is ..

Comment 12 Rob Crittenden 2018-03-02 19:33:35 UTC
I've duplicated this outside of OpenStack using just certmonger and Apache. It looks like an issue with the CA cert that certmonger is generating.

I don't know if you want to re-assign this to certmonger or generate a new bug.

Comment 13 Rob Crittenden 2018-03-02 20:00:06 UTC
I should clarify that I'm not 100% sure I'm completely duplicating things. I can get a similar error message in Firefox but if you could provide the getcert usage you are using that would help me be sure I'm seeing exactly the same thing.

Comment 14 Ade Lee 2018-03-02 21:57:39 UTC
Just to update -- the certmonger getcert request comes from puppet-tripleo

https://github.com/openstack/puppet-tripleo/blob/b3d0b2f25a120501e1dafa9e0c289bc5630dbc29/manifests/certmonger/haproxy.pp#L108

which passes in key usages etc.  Thats one of the things that is weird about this cert -- no key usages.

Looking at puppet-certmonger, looks like we're passing the ekus in -U arguments.


Udi, in your environment, can you provide the output of :

sudo getcert list   (on the undercloud)

Comment 16 Rob Crittenden 2018-03-05 16:41:39 UTC
I think I have a handle on the issue now. certmonger is not setting the CA basic constraint properly which results in improper DER-encoding.

Comment 18 August Simonelli 2018-05-18 00:46:52 UTC
I still see this with RHEL 7.4 with firefox-52.2.0-2.el7.x86_64 and an OSP 12 director using ssl. I'm not sure which certs to load into Firefox to get around it. From the director host what certs do I need to bring down to my client to load into Firefox?
Thanks!

Comment 19 Rob Crittenden 2018-05-18 13:48:31 UTC
The issue isn't in Firefox or OSP, it is in certmonger. This is fixed in EL 7.5. You need certmonger-0.78.4-3.el7.1. See https://bugzilla.redhat.com/show_bug.cgi?id=1560961

Comment 20 August Simonelli 2018-05-19 22:17:34 UTC
I see. Thanks!

Comment 21 Harry Rybacki 2018-11-01 19:59:55 UTC
This does not apply to recent versions of OSP, as it was an issue in certmonger and resolved in RHEL7.5+ Closing as CURRENT_RELEASE.