Bug 1763108 - [downstream clone - 4.3.7] Fix invalid host certificates by filling-in subject alternate name during host installation
Summary: [downstream clone - 4.3.7] Fix invalid host certificates by filling-in subjec...
Keywords:
Status: CLOSED DUPLICATE of bug 1763109
Alias: None
Product: Red Hat Enterprise Virtualization Manager
Classification: Red Hat
Component: ovirt-host-deploy
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ovirt-4.3.7
: ---
Assignee: Martin Perina
QA Contact: Lucie Leistnerova
URL:
Whiteboard:
Depends On: 1763084
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-10-18 09:20 UTC by RHV bug bot
Modified: 2019-10-18 12:31 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1763084
Environment:
Last Closed: 2019-10-18 12:31:16 UTC
oVirt Team: Infra
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
oVirt gerrit 103318 0 master MERGED ansible: Put host names into SAN in certificates 2021-02-18 11:05:36 UTC

Description RHV bug bot 2019-10-18 09:20:59 UTC
+++ This bug is an upstream to downstream clone. The original bug is: +++
+++   bug 1763084 +++
======================================================================

We currently put Hostname/IP into Common Name (CN) in the host
certificate subject.  This is not good for two reasons:

- Using CN for host name matching in certificates is obsolete and
  should be no longer used [1].

- CN may not contain an IP address.

In the latter case, migrations don't work on el8 since libvirt refuses
to connect to a destination host having invalid data in its
certificate.

The correct way to handle the certificates is to put the host name or
IP addresses to the Subject Alternative Name [2].  This is what this
patch does.

[1] http://wiki.cacert.org/FAQ/subjectAltName
[2] https://libvirt.org/remote.html#Remote_TLS_server_certificates

(Originally by Martin Perina)

Comment 1 Martin Perina 2019-10-18 12:31:16 UTC
The in ovirt-host-deploy is not needed to cover adding a new host or reinstall existing, we are OK with engine fix only.

*** This bug has been marked as a duplicate of bug 1763109 ***


Note You need to log in before you can comment on or make changes to this bug.