Bug 868290 - Thumbslug needs to verify more certificates.
Thumbslug needs to verify more certificates.
Status: CLOSED ERRATA
Product: Subscription Asset Manager
Classification: Red Hat
Component: thumbslug (Show other bugs)
1.2
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Bryan Kearney
Tazim Kolhar
:
Depends On:
Blocks: sam12-tracker
  Show dependency treegraph
 
Reported: 2012-10-19 08:32 EDT by James Bowes
Modified: 2016-04-25 20:54 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Thumbslug now correctly verifies CDN SSL certificates
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-02-21 14:18:22 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description James Bowes 2012-10-19 08:32:44 EDT
Thumbslug doesn't verify the cdn's ssl certificate. This is ok, because the RPMs are all signed and verified by the client, but it is not correct.
Comment 1 James Bowes 2012-10-19 08:55:21 EDT
Verifying the ssl certificate of candlepin isn't needed at all. since we use oauth communication, the shared secret provides us with that identity verification (in both directions).
Comment 2 James Bowes 2012-11-05 12:12:09 EST
Fixed in thumbslug master, b2f0fc7dc. Will be in thumbslug-0.0.26

I've introduced two new config values:

ssl.ca.keystore: typically candlepin's public pem cert
cdn.ssl.ca.keystore: pem to verify the CDN's cert. this is installed by default to be the one to verify our hosted CDN.
Comment 4 James Bowes 2012-11-15 08:29:21 EST
To test:
  Happy path:
    - set up a SAM. (make sure it can talk to the cdn; you'll also need
      the new config values)
    - register a client to the sam, and entitle it
    - yum install something. it should work
  Unverifiable client certificate:
    - register a second client against a different sam
    - change that second client's baseurl to point to the first sam
    - try and install something. it should fail.

  Unverifiable CDN certificate:
     - set the value of cdn.host in /etc/thumbslug/thumbslug.conf to some other
       ssl capable host
     - try to install something on the client. you should see an http 502 error.
Comment 9 errata-xmlrpc 2013-02-21 14:18:22 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0544.html

Note You need to log in before you can comment on or make changes to this bug.