Bug 175811 - Custom ca-bundle.crt overwritten on upgrade
Summary: Custom ca-bundle.crt overwritten on upgrade
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: openssl   
(Show other bugs)
Version: 4.0
Hardware: All
OS: Linux
Target Milestone: ---
: ---
Assignee: Tomas Mraz
QA Contact: Brian Brock
Depends On:
TreeView+ depends on / blocked
Reported: 2005-12-15 10:35 UTC by Tomas Mraz
Modified: 2007-11-30 22:07 UTC (History)
1 user (show)

Fixed In Version: RHSA-2006-0661
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-09-06 20:21:37 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2006:0661 normal SHIPPED_LIVE Important: openssl security update 2006-09-06 04:00:00 UTC

Description Tomas Mraz 2005-12-15 10:35:00 UTC
+++ This bug was initially created as a clone of Bug #170740 +++

Description of problem:
ca-bundle.pem is not listed as a configuration file, causing it to be replaced
during upgrades of the openssl package.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. customize /usr/share/ssl/certs/ca-bundle.pem
2. install new version of openssl
Actual results:
ca-bundle.pem is replaced

Expected results:
ca-bundle.pem should be untouched during an upgrade

Additional info:
This is the same bug as 158568 reported for Fedora Core 3

-- Additional comment from tmraz@redhat.com on 2005-10-14 07:40 EST --
We will consider fixing this bug in future if the openssl packages are updated
for other reasons (security or critical bug fixes).

-- Additional comment from tmraz@redhat.com on 2005-10-14 07:41 EST --
Note to myself: Applies to RHEL4 as well.

-- Additional comment from slawomir@ezono.com on 2005-10-14 08:35 EST --
This bug causes severe problems if the server is using TLS with LDAP and a
certificate signed by a locally created certification authority.
After ca-bundle.crt gets overwritten all the services which use LDAP stop
working because server can't validate the certificate used by TLS. On one of the
servers even logging in as root or local user wasn't working.

-- Additional comment from tmraz@redhat.com on 2005-10-14 09:59 EST --
I agree that this bug is serious but I see no point in updating the package just
for this bug. It's just necessary to fix the bug if an updated package is
released again (for other reasons).

-- Additional comment from slawomir@ezono.com on 2005-10-14 10:25 EST --
Is it possible to issue a release note or some warning so other people don't get
affected by this bug? We've spent about 20 hrs here before we've found the
reason for the outage of our servers.

Comment 2 RHEL Product and Program Management 2006-08-18 16:51:38 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update

Comment 7 Red Hat Bugzilla 2006-09-06 20:21:41 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.