Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 637365

Summary: There is now way to configure the list of acceptable CA's for client authentication
Product: Red Hat Enterprise Linux 5 Reporter: Wolter Eldering <wolter.eldering>
Component: mod_nssAssignee: Rob Crittenden <rcritten>
Status: CLOSED WONTFIX QA Contact: Chandrasekar Kannan <ckannan>
Severity: low Docs Contact:
Priority: low    
Version: 5.4CC: benl, dpal
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 719401 (view as bug list) Environment:
Last Closed: 2011-07-06 17:54:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 719401    
Attachments:
Description Flags
add AcceptableCANames option
none
add AcceptableCANames option none

Description Wolter Eldering 2010-09-25 08:30:02 UTC 
Created attachment 449572 [details]
add AcceptableCANames option

Description of problem:
mod_nss will accept all certificates from CA's trusted in the certificate database. There is now way to configure that per server.

Version-Release number of selected component (if applicable):
1.0.8

How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:
All trusted CA names (for SSL) are sent during Client Certificate Requests

Expected results:
The user of mod_nss can control the list sent by apache configuration

Additional info:
The patch included let's the user control the list using:
AcceptableCANames "rfc1845 name" "rfc1845 name"

If this configuration option is omitted all trusted names are sent.
The supplied list is used the filter the CA's in the certificate database.

The code in nss_hook_pre_connection is added as a workaround for: https://bugzilla.mozilla.org/show_bug.cgi?id=597028
Comment 1 Rob Crittenden 2010-09-27 14:50:16 UTC 
I assume an rfc1845 name is an NSS nickname? RFC 1845 is an experimental SMTP extension as far as I can tell.

There is a commented-out block of code starting with:
/* we only wan't to do this onece not for every server */

This doesn't need to be here at all, right?

It looks like this patch mixes in some changes you had submitted in bug 635324, is that right?

Should the error that is printed from "CERT_LIST_EMPTY(ca_certs)" really say something like "acceptable certificates not found in NSS database or something?" It looks like it would be possible to add a CA that doesn't exist in the database as long as you configure at least one that does.
Comment 2 Wolter Eldering 2010-09-27 15:18:04 UTC 
The rfc1845 name is the Subject of the certificate, see CERT_FilterCertListByCANames in certvfy.c

Yes the comment can be removed.

You're right that's also included, I'll attach a new patch on top of the one for bug 635324.

In this patch at least one of the certificates named (by subject) should be in the database as a trusted ca for SSL.

An alternative would be to check if the list after filtering has the same length as the list of acceptable CA's specified. In that way all of the acceptable CA's listed in the option must be in the database.
Comment 3 Wolter Eldering 2010-09-28 02:57:23 UTC 
Created attachment 450077 [details]
add AcceptableCANames option

Processed remarks
Comment 4 Dmitri Pal 2011-07-06 17:52:47 UTC 
The patch will be accepted upstream and will be delivered as a version that will be included into RHEL7.
Comment 5 Dmitri Pal 2011-07-06 17:54:11 UTC 
This feature will not be implemented in RHEL 5.x.