Bug 1769985 - etcd: server certs should support client usage
Summary: etcd: server certs should support client usage
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Etcd
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.3.0
Assignee: Sam Batschelet
QA Contact: Mike Fiedler
Depends On:
Blocks: 1769992
TreeView+ depends on / blocked
Reported: 2019-11-07 20:49 UTC by Sam Batschelet
Modified: 2023-09-07 20:57 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1769992 (view as bug list)
Last Closed: 2020-01-23 11:11:43 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift kubecsr pull 16 0 'None' closed Bug 1769985: pkg/certsigner/signer: Add "client" usage to server profile 2020-10-25 17:19:27 UTC
Red Hat Product Errata RHBA-2020:0062 0 None None None 2020-01-23 11:12:09 UTC

Description Sam Batschelet 2019-11-07 20:49:06 UTC
Description of problem: openshift/kubecsr repo is the canonical home for etcd cert signer. PR #22 added client usage and was merged upstream and is part of master downstream.[1] 

[1]: https://github.com/openshift/kubecsr/commit/aad75d333646da657e788db93f2ff75da850b542#diff-654ba8df3be94fe94c9404a7727d1fa2

But this was never backported to the openshift-4.1, openshift-4.2 or openshift-4.3. With etcd 3.3.10 the result is an error message during startup 

> 2019-11-07 14:18:08.592903 I | embed: rejected connection from "" (error "tls: failed to verify client's certificate: x509: certificate specifies an incompatible key usage", ServerName "")

In 3.3.17 we see many more of these errors and the result will be unnecessary bugs and spammy logs. 

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

Actual results:

Expected results: Backport is complete

Additional info:

Comment 2 Mike Fiedler 2019-11-15 16:08:23 UTC
Verified on 4.3.0-0.nightly-2019-11-13-233341

Server certs work well for command line client:

sh-4.2# etcdctl --endpoints, --cacert=/etc/ssl/etcd/ca.crt --cert=/etc/ssl/etcd/system:etcd-server:etcd-0.mffiedler1114.qe.gcp.devcluster.openshift.com.crt  --key=/etc/ssl/etcd/system:etcd-server:etcd-0.mffiedler1114.qe.gcp.devcluster.openshift.com.key endpoint status, 414b83dc8591f685, 3.3.17, 255 MB, false, 125, 634130, 596ac98681085db0, 3.3.17, 257 MB, true, 125, 634130

Comment 4 errata-xmlrpc 2020-01-23 11:11:43 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.