Self-Signed Certificate and Weak Certificate Chain

[Adam Heczko]

Asset Impacted:
FUEL Web Application Port 443

Detailed bug description:
The certificate is unable to be trusted. Because of this the server is more susceptible to a man in the middle attack.

Expected results:
Provide guidance how to change Fuel's default TLS certificates.

[Rodion Tikunov (rtikunov)]

It realised in 7.0 within blueprint https://blueprints.launchpad.net/fuel/+spec/ssl-endpoints. There is the discussion in mailing list: http://osdir.com/ml/openstack-dev/2015-08/msg00407.html
It will be too big/dangerous change to backporting it in 6.1.

[Rodion Tikunov (rtikunov)]

From 7.0 it is possible to change default TLS certificates as described in our documentation [0].

[0] https://docs.mirantis.com/fuel/fuel-master/operations.html#switching-on-ssl-and-secure-access

[Adam Heczko (aheczko-mirantis)]

This is about MITM associated to self signed certs. IMO appropriate solution is to provide guidance how to change Fuel certificates with trusted ones (signed off by trusted CA). AFAIK documentation covering this is available.