self signed cert erroneously regenerated when config-changed code runs

[Billy Olsen]

When deploying with a self-signed certificate, the is_selfsigned_cert_stale check erroneously returns True causing the certificate to be regenerated. This results in a new self-signed certificate being generated each time the config-changed hook or any hook which calls the config-changed hook (which is a fair number) is invoked.

This is due to the use of the subjAltName component from the pyasn parsing .getComponent() which returns an OctetString for the output. When converted to a python string, the OctetString does not contain an IP address which is equivalent to what is placed in the unit data (as the data is a byte array containing the octets of the IP address).

This was likely introduced by the change for bug 1779177, which switched over the self signed certificate from using the dns name to the IP address.

[Recreate Steps]
Deploy the following juju bundle

series: bionic
applications:
  haproxy:
    charm: cs:haproxy
    num_units: 1
    options:
      default_timeouts: "queue 60000, connect 5000, client 120000, server 120000"
      services: ""
      source: backports
      ssl_cert: SELFSIGNED
      global_default_bind_options: "no-tlsv10"
  grafana:
    charm: cs:grafana
    num_units: 1
relations:
  - [ "haproxy", "grafana" ]

Change a config value or cause config-changed hook to fire:

$ juju config haproxy global_quiet=True

Observe in the logs the certs are getting regenerated

[Billy Olsen (billy-olsen)]

Note: a workaround for production would be to specify the certs in the charm config.

[Billy Olsen (billy-olsen)]

Relevant unit logs are as follows. Note the comparison between the Cert set and the unit set:

2019-02-12 10:49:37 INFO juju-log Service: landscape-https
2019-02-12 10:49:37 DEBUG worker.uniter.jujuc server.go:181 running hook tool "juju-log"
2019-02-12 10:49:37 INFO juju-log Service: landscape-http
2019-02-12 10:49:37 DEBUG worker.uniter.jujuc server.go:181 running hook tool "juju-log"
2019-02-12 10:49:37 INFO juju-log Using self-signed certificate
2019-02-12 10:49:37 DEBUG worker.uniter.jujuc server.go:181 running hook tool "unit-get"
2019-02-12 10:49:37 DEBUG worker.uniter.jujuc server.go:181 running hook tool "unit-get"
2019-02-12 10:49:37 DEBUG worker.uniter.jujuc server.go:181 running hook tool "juju-log"
2019-02-12 10:49:37 INFO juju-log subjAltName: Cert (set(['\nRp\xa2'])) != Unit (set([u'10.82.112.162'])), assuming stale
2019-02-12 10:49:37 DEBUG worker.uniter.jujuc server.go:181 running hook tool "juju-log"
2019-02-12 10:49:37 INFO juju-log Generating self-signed certificate
2019-02-12 10:49:37 DEBUG config-changed Generating a 1024 bit RSA private key
2019-02-12 10:49:37 DEBUG config-changed ...++++++
2019-02-12 10:49:37 DEBUG config-changed ........++++++
2019-02-12 10:49:37 DEBUG config-changed writing new private key to '/var/lib/haproxy/selfsigned.key'
2019-02-12 10:49:37 DEBUG config-changed -----
2019-02-12 10:49:37 DEBUG worker.uniter.jujuc server.go:181 running hook tool "juju-log"

[Billy Olsen (billy-olsen)]

Fix was released in haproxy charm revision 48