Bug 1628957
| Summary: | Use sha256 for content certificates for RHUI clients | ||
|---|---|---|---|
| Product: | Red Hat Update Infrastructure for Cloud Providers | Reporter: | Radek Bíba <rbiba> |
| Component: | RHUA | Assignee: | Martin Minar <mminar> |
| Status: | CLOSED ERRATA | QA Contact: | Radek Bíba <rbiba> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 3.0.5 | CC: | lwilliam, mkubik, mminar |
| Target Milestone: | 3.0.6 | ||
| Target Release: | 3.0.x | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-11-07 14:05:07 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Update: this happens when running rhui-manager on RHEL 6 only. On RHEL 7 the cert is signed using sha256 by default. It seems that the newer version of openssl on RHEL 7 uses sha256, whereas openssl on RHEL 6 defaults to sha1. In both cases sha256 can be enforced by adding -sha256 on the openssl command line in /usr/lib/python2.*/site-packages/rhui/common/cert_utils.py, line 376, like this:
cmd = 'openssl x509 -req -days %s -in %s -CA %s -CAkey %s -CAserial %s -out %s -sha256' % \
(days, csr_filename, ca_cert_filename, ca_key_filename,
ca_srl_filename, crt_filename)
I've verified that a client config RPM created with this entitlement certificate works well where the default crypto policy settings are used.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3520 |
Description of problem: [root@rhua ~]# rhui-manager client cert --repo_label <LABEL> --name shatest --days 31 --dir /tmp ..............................................................................+++ ...........................+++ Entitlement certificate created at /tmp/shatest.crt [root@rhua ~]# openssl x509 -noout -text -in /tmp/shatest.crt | grep sha Signature Algorithm: sha1WithRSAEncryption Signature Algorithm: sha1WithRSAEncryption Please switch to sha256. Sha1 is considered insecure and may be unsupported in new Linux distributions, in which case yum/dnf would fail to communicate with RHUI. Version-Release number of selected component (if applicable): 3.0.5 How reproducible: Always Steps to Reproduce: 1. Add a repo and sync it. 2. Generate an entitlement certificate for the repo. 3. Create a client config RPM with the certificate. 4. Copy the RPM to a system where sha1 is unsupported. Actual results: dnf cannot consume content from the repo. /var/log/dnf.log on the system reads: DEBUG error: Curl error (58): Problem with the local SSL certificate for <REPO URL> [could not load PEM client certificate, OpenSSL error error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak, (no key found, wrong pass phrase, or wrong file format?)] Expected results: SSL communication works well. Additional info: Workaround on the client: update-crypto-policies --set LEGACY