Bug 1671247 - CC: Enable AIA OCSP cert checking for entire cert chain [rhel-7.6.z]
Summary: CC: Enable AIA OCSP cert checking for entire cert chain [rhel-7.6.z]
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: jss
Version: 7.7
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Jack Magne
QA Contact: Asha Akkiangady
URL:
Whiteboard:
Keywords: TestCaseProvided, ZStream
Depends On: 1666872
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-01-31 08:12 UTC by RAD team bot copy to z-stream
Modified: 2019-03-13 18:45 UTC (History)
2 users (show)

(edit)
ause: 

Previously when configuring a CS subsystem to perform ocsp checking based upon the AIA extension of each cert to be evaluated, the feature would only perform the desired ocsp check on the leaf cert and not the rest of the certificate chain.

Consequence: 
This resulted in a possibly incomplete ocsp verification of a certficate and its chain. If a member of the chain had been revoked, the pki subsystem will still think the leaf cert is valid.

Fix: 

The resolution to this particular issue was to enhance the behavior of the ocsp checking in JSS for ONLY the AIA extension URL checking scenario. When AIA extensions are being consulted, the system has been enhanced to check the leaf cert and the cert chain for verification.

Result: 

As a result, a full verification of a cetificate and its chain can be relied upon to have taken place correctly by interested parties.
Clone Of: 1666872
(edit)
Last Closed: 2019-03-13 18:45:39 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:0505 None None None 2019-03-13 18:45 UTC

Description RAD team bot copy to z-stream 2019-01-31 08:12:17 UTC
This bug has been copied from bug #1666872 and has been proposed to be backported to 7.6 z-stream (EUS).

Comment 5 Asha Akkiangady 2019-02-14 01:11:12 UTC
Marking the bug on Assigned state to fix the ocsp check problem reported by CC lab.

Comment 6 Amol K 2019-03-01 16:41:49 UTC
I tested this bugzilla on 10.5.9-13.el7_6

I followed steps (In #comment 4) which are mentioned by Jack

Observations:
1. I could see the subsystems could hit the Internal OCSP.
2. If key archival is done then it should check the certificate against the CA/SubCA
3. As negative test cases, I revoked RootCA cert. And as expected it was not working.

Verifying this BZ.

Comment 8 errata-xmlrpc 2019-03-13 18:45:39 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0505


Note You need to log in before you can comment on or make changes to this bug.