The SSL certificate requested by tripleo and provided by certmonger does not include two additional EKUs, or Extended Key Usage attributes, required by Firefox's strict reliance[0] on RFC5280 (Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile)[1] when using a self-signed certificate. Other browsers such as Chrome, and most SSL clients, do not have such strict reliance. Without these added EKUs, Firefox will always generate a 'SEC_ERROR_EXTENSION_VALUE_INVALID' error. This happens even before a prompt to accept a certificate of an unknown issuer, so there's no way to just add an exception like we're used to for self-signed certificates.
When the certificate is generated, a default request will generate a certificate with no additional EKUs. The result is a certificate being created without explicitly specifying two additional EKUs that are required by Firefox: id-kp-serverAuth and id-kp-clientAuth.
At the moment there is no supported option to add EKUs at certificate request time in the earsdown/puppet-certmonger Puppet module, however the addition of EKUs is a good candidate for the postsave_cmd used for other certificate preparation that we currently use. A github issue[2] was created to see if adding a parameter to the earsdown/puppet-certmonger module to add EKUs upon creation, can be a more appropriate long-term solution.
Add the required EKUs by modifying instack-haproxy-cert-update to refresh the certificate immediately after creation, to add these EKUs.
---
[0] https://wiki.mozilla.org/SecurityEngineering/x509Certs
[1] https://www.ietf.org/rfc/rfc5280.txt
[2] https://github.com/earsdown/puppet-certmonger/issues/16
Fix proposed to branch: master
Review: https:/