Bug 689939 - Osad not working with wildcard certificates
Summary: Osad not working with wildcard certificates
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Spacewalk
Classification: Community
Component: Server
Version: 1.3
Hardware: All
OS: All
unspecified
medium
Target Milestone: ---
Assignee: Jan Pazdziora
QA Contact: Red Hat Satellite QA List
URL:
Whiteboard:
Depends On:
Blocks: space16
TreeView+ depends on / blocked
 
Reported: 2011-03-22 20:08 UTC by Trent Johnson
Modified: 2011-12-22 16:47 UTC (History)
2 users (show)

Fixed In Version: osad-5.10.23-1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-12-22 16:47:11 UTC
Embargoed:


Attachments (Terms of Use)

Description Trent Johnson 2011-03-22 20:08:47 UTC
Description of problem:

When using a wildcard certificate purchased from a CA, osad and osa-dispatcher fail to verify the certificate and instead give a "Mismatch: peer name: error

Version-Release number of selected component (if applicable):
spacewalk 1.3 both client and server packages
The problem exists in /usr/share/rhn/osad/jabber_lib.py

How reproducible:

Install a wildcard certificate into spacewalk.  I used the instructions here for installing the certificate:

http://unfuckablelinux.com/2008/07/02/spacewalk-and-avoiding-self-signed-certificates/

Steps to Reproduce:
1. Install wildcard cert
2. Start osa-dispatcher
3.
  
Actual results:
Starting osa-dispatcher: /usr/lib/python2.6/site-packages/jabber/jabber.py:68: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
  import sha, time
RHN 10088 2011/03/12 15:01:59 -05:00: ('Traceback caught:',)
RHN 10088 2011/03/12 15:01:59 -05:00: ('Traceback (most recent call last):\n  File "/usr/share/rhn/osad/jabber_lib.py", line 611, in connect\n    self.verify_peer(ssl)\n  File "/usr/share/rhn/osad/jabber_lib.py", line 692, in verify_peer\n (self._host, common_name))\nSSLVerifyError: Mismatch: peer name: spacesl6.oreillyschool.com; common name: *.oreillyschool.com.\n',) 

Expected results:
osa-dispatcher should start without errors

Additional info:
The check in jabber_lib.py should be fixed to match the commom name against wildcards.

Comment 1 Weiwei Hu 2011-06-05 00:21:58 UTC
Work around:

I commend out line 690 to line 692 to disable the common_name verification. And then osa-dispatcher starts without errors.

Comment 2 Jan Pazdziora 2011-07-20 11:49:19 UTC
Aligning under space16.

Comment 3 Jan Pazdziora 2011-09-30 12:29:00 UTC
Fixed in Spacewalk master, 3801ed7115cc0a5c8573d643173389b4790bb419.

Comment 4 Milan Zázrivec 2011-12-22 16:47:11 UTC
Spacewalk 1.6 has been released.


Note You need to log in before you can comment on or make changes to this bug.