Description of problem: ca-bundle.pem is not listed as a configuration file, causing it to be replaced during upgrades of the openssl package. Version-Release number of selected component (if applicable): 0.9.7a-33.17 How reproducible: Always Steps to Reproduce: 1. customize /usr/share/ssl/certs/ca-bundle.pem 2. install new version of openssl Actual results: ca-bundle.pem is replaced Expected results: ca-bundle.pem should be untouched during an upgrade Additional info: This is the same bug as 158568 reported for Fedora Core 3
We will consider fixing this bug in future if the openssl packages are updated for other reasons (security or critical bug fixes).
This bug causes severe problems if the server is using TLS with LDAP and a certificate signed by a locally created certification authority. After ca-bundle.crt gets overwritten all the services which use LDAP stop working because server can't validate the certificate used by TLS. On one of the servers even logging in as root or local user wasn't working.
I agree that this bug is serious but I see no point in updating the package just for this bug. It's just necessary to fix the bug if an updated package is released again (for other reasons).
Is it possible to issue a release note or some warning so other people don't get affected by this bug? We've spent about 20 hrs here before we've found the reason for the outage of our servers.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0661.html