When certificate is missing the 0a new line the haproxy config is failing

Bug #2023304 reported by Márton Kiss
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
charm-haproxy
New
Undecided
Unassigned

Bug Description

If the certificate in ssl_cert option is missing the 0a new line character from the end of the certficate data (what is base64 encoded), the /var/lib/haproxy/default.pem contains an invalid value, that haproxy is unable to process:

```
unit-landscape-haproxy-1: 13:37:05 WARNING unit.landscape-haproxy/1.reverseproxy-relation-changed [ALERT] 158/133705 (7472) : parsing [/etc/haproxy/haproxy.cfg:66] : 'bind 0.0.0.0:443' : unable to load SSL private key from PEM file '/var/lib/haproxy/default.pem'.
unit-landscape-haproxy-1: 13:37:05 WARNING unit.landscape-haproxy/1.reverseproxy-relation-changed [ALERT] 158/133705 (7472) : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg
```

The END CERTIFICATE and BEGING PRIVATE KEY headers will be merged:

```
eMmzYdVdaNF0td2wRXBrm2l6QKcKbwwsGXxrkRyo6z5NiX52BLHd+WrJ
-----END CERTIFICATE----------BEGIN PRIVATE KEY-----
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDlEf0970CRJu5y
```

hexdump of the certificate data differences:
```
000007b0 4a 0a 2d 2d 2d 2d 2d 45 4e 44 20 43 45 52 54 49 |J.-----END CERTI|
000007c0 46 49 43 41 54 45 2d 2d 2d 2d 2d 0a |FICATE-----.|
000007cc

000007a0 6f 36 7a 35 4e 69 58 35 32 42 4c 48 64 2b 57 72 |o6z5NiX52BLHd+Wr|
000007b0 4a 0a 2d 2d 2d 2d 2d 45 4e 44 20 43 45 52 54 49 |J.-----END CERTI|
000007c0 46 49 43 41 54 45 2d 2d 2d 2d 2d |FICATE-----|
000007cb
```

I suggest to validate the newline's presence, either throw an error message about that or simply check for the new line, and if it is not there, add the 0a during the concatenation.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.