We currently put Hostname/IP into Common Name (CN) in the host certificate subject. This is not good for two reasons: - Using CN for host name matching in certificates is obsolete and should be no longer used [1]. - CN may not contain an IP address. In the latter case, migrations don't work on el8 since libvirt refuses to connect to a destination host having invalid data in its certificate. The correct way to handle the certificates is to put the host name or IP addresses to the Subject Alternative Name [2]. This is what this patch does. [1] http://wiki.cacert.org/FAQ/subjectAltName [2] https://libvirt.org/remote.html#Remote_TLS_server_certificates
Verified on ovirt-host-deploy-common-1.9.0-0.0.master.20191128124417.gitd2b9fa5.el7ev.noarch
I want to display an edited version of the original doc text here: Host certificates used for encrypted communication between engine and VDSM are generated automatically during host installation. We are using the hostname, which can be either an FQDN or IP address, to populate the Common Name (CN) field of the certificate. But there are issues with this approach: 1. CN should not contain an IP address 2. Using CN for hostname matching in certificates is obsolete and should be no longer used [1]. That's why we have changed a way how to generate certificates and we started to populate Subject Alternative Name (SAN) [2] field in the certificate with correct identification if the supplied hostname is FQDN or IP address. In order to fix certificates for existing hosts we have added several improvements: 1. All newly added host will have certificates with correct SAN field 2. During our periodical check for certificate validity, we also check if SAN field is populated and if not error is raised and stored in the audit log, so administrators will know that host's certificate needs to be reenrolled 3. We also check for certificate validity during host upgrade, so we have also added here the check for the SAN field, so the host's certificate can be reenrolled during host upgrade. [1] http://wiki.cacert.org/FAQ/subjectAltName [2] https://libvirt.org/remote.html#Remote_TLS_server_certificates
This bugzilla is included in oVirt 4.4.0 release, published on May 20th 2020. Since the problem described in this bug report should be resolved in oVirt 4.4.0 release, it has been closed with a resolution of CURRENT RELEASE. If the solution does not work for you, please open a new bug report.