Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-3788

Puppet Agent does not support Chained CRLs

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Normal
    • Resolution: Duplicate
    • Affects Version/s: PUP 3.7.1
    • Fix Version/s: None
    • Component/s: None
    • Labels:
    • Environment:

      CentOS 6 x86_64 Monolithic Puppet Master Running PE 3.7.1
      CentOS 6 x86_64 Puppet Agent Running PE 3.7.1
      CentOS 6 x86_64 Root & Intermediate CA

    • Template:
    • Epic Link:
    • Team:
      Froyo
    • Story Points:
      3
    • Sprint:
      Server 2017-07-25, Platform Core 2017-08-08, Platform Core 2017-08-22
    • CS Priority:
      Major
    • CS Frequency:
      2 - 5-25% of Customers
    • CS Severity:
      3 - Serious
    • CS Business Value:
      5 - $$$$$$
    • CS Impact:
      By not supporting chained CRLS the agent would not know that it should not talk to a master with a revoke cert.
    • Release Notes:
      Bug Fix
    • QA Risk Assessment:
      Automate

      Description

      While trying to test the following configuration: https://docs.puppetlabs.com/puppet/3/reference/config_ssl_external_ca.html#option-2-single-intermediate-ca

      I found that trying to use the CRL of the Root CA or the Intermediate CA OR a bundled version of these did not work. Puppet Agent runs failed with the SSL error "unable to get certificate crl "

      To work around this issue, I have had to disable CRL checking on the agent by using the following command 'puppet config set -section agent certificate_revocation false'.

      We need a way to either accept a bundled CRL or have separate settings for the Root CA CRL and 'Issuer CA' CRL.

        Attachments

        1. bc4day8u22sutut.delivery.puppetlabs.net.cert
          4 kB
        2. bc4day8u22sutut.delivery.puppetlabs.net.key
          2 kB
        3. ca_bundle.pem
          3 kB
        4. ca_crl.pem
          0.7 kB
        5. ca_crt.pem
          2 kB
        6. ca_key.pem
          2 kB
        7. crl_bundle.pem
          1 kB
        8. intermediate.cert.pem
          2 kB
        9. intermediate.key.pem
          2 kB
        10. root_ca_crl.pem
          0.7 kB
        11. to05sy0zz5zlsdj.delivery.puppetlabs.net.cert
          4 kB
        12. to05sy0zz5zlsdj.delivery.puppetlabs.net.key
          2 kB

          Issue Links

          relates to

          Sub-task - The sub-task of the issue PUP-8654 Agents should save all CRLs downloaded from the server

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. PUP-7845 Support leaf certificate CRL checking

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. SERVER-895 SSL configuration with intermediate CA

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. DOCUMENT-59 External CA - Support for CRL - Documentation Update

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. PUP-6697 Allow full downloaded CA bundle to be stored to agent's localcacert file

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              stan Stan Duffy
              QA Contact:
              Stan Duffy Stan Duffy
              Votes:
              2 Vote for this issue
              Watchers:
              21 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Zendesk Support