Bug 1882697 - [RFE] Building clientrpm using rhui-manager should provide additional step to make sslcacert optional.
Summary: [RFE] Building clientrpm using rhui-manager should provide additional step to...
Keywords:
Status: NEW
Alias: None
Product: Red Hat Update Infrastructure for Cloud Providers
Classification: Red Hat
Component: RHUA
Version: 3.1.5
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.x
Assignee: RHUI Bug List
QA Contact: Radek Bíba
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-09-25 11:08 UTC by Akshay Kapse
Modified: 2022-05-03 18:28 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHUI-260 0 None None None 2022-05-03 18:28:33 UTC

Description Akshay Kapse 2020-09-25 11:08:23 UTC
Description of problem:

When an actual legit root CA signed certificate is in place, this line isn't needed because a valid root CA would already be installed (and trusted) on the client via the ca-bundle (usually located in - /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt).

While building clientrpms in rhui-manager, as per RHUI version 2.1, there should be an option to either specify the 1-way trust SSL CA certificate used (or confirm the default) or as a completely new feature,  remove the option entirely. 
i.e. Default option is the self-signed CA cert that the RHUA created, but have an option to override it to be blank (which would therefore remove the sslcaverify= line from the rh-cloud.repo file located in build/SOURCES/${PACKAGE_NAME}-2.0.tar.gz).

When Trusted CA signed SSL certificates are in use on the HAP/CDS', there is no requirement to use sslcaverify= in the rh-cloud.repo file that is packaged up in the client rpm file. In fact, having the entry here actually prevents secure SSL communications between the client and the server due to a certificate signing mismatch. The client would already trust a Trusted CA signed certificate as its CA would be in the CA-Bundle (usually located here - /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt) negating the need to specify it in the repo file.


Note You need to log in before you can comment on or make changes to this bug.