Security Guide refers to SSL in many places where TLS is more appropriate

Bug #1343571 reported by Robert Clark
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
openstack-manuals
Fix Released
High
Brian Moss

Bug Description

The security guide refers to the use of SSL in many places, SSL is a decade old, long replaced by TLS. We should be referring to TLS when we are discussing transport layer security with X509.

Tags: sec-guide
Bryan D. Payne (bdpayne)
Changed in openstack-manuals:
status: New → Confirmed
importance: Undecided → High
Revision history for this message
Alexandra Settle (alexandra-settle) wrote :

After a quick grep through the current security guide, it seems that this bug could be altered or closed.

All instances of SSL now are SSL/TSL.

Unless the aim is to remove the SSL completely?

Changed in openstack-manuals:
assignee: nobody → Alexandra Settle (alexandra-settle)
Changed in openstack-manuals:
assignee: Alexandra Settle (alexandra-settle) → nobody
assignee: nobody → Alexandra Settle (alexandra-settle)
Tom Fifield (fifieldt)
Changed in openstack-manuals:
milestone: none → kilo
Changed in openstack-manuals:
assignee: Alexandra Settle (alexandra-settle) → nobody
Revision history for this message
Bryan D. Payne (bdpayne) wrote :

Action here is to remove SSL in favor of TLS or SSL/TLS throughout the entire guide.

Changed in openstack-manuals:
importance: High → Medium
importance: Medium → High
Brian Moss (bmoss)
Changed in openstack-manuals:
assignee: nobody → Brian Moss (bmoss)
Revision history for this message
N Dillon (sicarie) wrote :

Found another section - Chapter 9 Object Storage (as of Feb 2015), contains several references to SSL only in the 'Load balancer' and 'Object Storage authentication' sections

Revision history for this message
N Dillon (sicarie) wrote :

And another section - in Ch 13 Databases - both Database access control section and Database transport security section references SSL (without TLS) frequently as well.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to security-doc (master)

Fix proposed to branch: master
Review: https://review.openstack.org/154315

Changed in openstack-manuals:
status: Confirmed → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to security-doc (master)

Reviewed: https://review.openstack.org/154315
Committed: https://git.openstack.org/cgit/openstack/security-doc/commit/?id=3c53e10e06c6e8667926904ad400e8f79600f655
Submitter: Jenkins
Branch: master

commit 3c53e10e06c6e8667926904ad400e8f79600f655
Author: kallimachos <email address hidden>
Date: Tue Feb 10 11:23:18 2015 +1000

    Updated SSL to TLS

    References to SSL have been updated to TLS
    as TLS is generally recommended. Some examples
    in the text are specific to SSL; these have not
    been changed.

    Change-Id: I40a0e935f5050d041a849bf4835adcd3c29a398f
    Closes-Bug: #1343571

Changed in openstack-manuals:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.