Project

Profile

Help

Issue #531

pulp.bindings.server.DEFAULT_CA_PATH does not point to a valid certificate pack

Added by rbarlow over 6 years ago. Updated over 1 year ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
High
Assignee:
Category:
-
Sprint/Milestone:
-
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Version:
2.4.0
Platform Release:
2.6.0
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:

Description

Description of problem:
pulp.bindings.server.DEFAULT_CA_PATH is set to '/etc/pki/tls/certs/' when it should be set to '/etc/pki/tls/certs/ca-bundle.crt'. This means that the bindings will not work with real root certificates unless the user explicitly sets the PulpConnection's ca_path init parameter explicitly.

Version-Release number of selected component (if applicable):
2.4.0-1

How reproducible:
Every time

Steps to Reproduce:
1. Use the Pulp bindings to make a connection to a server that is using an SSL certificate that is signed by a CA that you have installed into /etc/pki/tls/certs/ca-bundle.crt, but do not pass the ca_path parameter to PulpConnection.__init__().

Actual results:
You should see an SSL trust failure raised from M2Crypto.

Expected results:
By default, we should work with root certificates installed at /etc/pki/tls/certs/ca-bundle.crt with no additional configuration.

+ This bug was cloned from Bugzilla Bug #1142376 +

History

#2 Updated by cduryee over 6 years ago

merged to 2.5-dev and master

+ This comment was cloned from Bugzilla #1142376 comment 2 +

#3 Updated by cduryee over 6 years ago

fixed in pulp 2.6.0-0.2.beta

+ This comment was cloned from Bugzilla #1142376 comment 3 +

#4 Updated by pthomas@redhat.com over 6 years ago

verified
Default in server.conf is
[database]

  1. verify_ssl: true
  2. ca_path: /etc/pki/tls/certs/ca-bundle.crt

+ This comment was cloned from Bugzilla #1142376 comment 4 +

#5 Updated by bmbouter over 6 years ago

  • Severity changed from Medium to 2. Medium

#6 Updated by rbarlow over 6 years ago

  • Status changed from 6 to CLOSED - CURRENTRELEASE

#8 Updated by bmbouter over 2 years ago

  • Tags Pulp 2 added

#9 Updated by bmbouter over 1 year ago

  • Category deleted (14)

We are removing the 'API' category per open floor discussion June 16, 2020.

Please register to edit this issue

Also available in: Atom PDF