Installing openstack certificate with misconfigured "X509v3 Subject Alternative Name" renders system inoperable
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
StarlingX |
Fix Released
|
Medium
|
Teresa Ho |
Bug Description
Brief Description
-----------------
Installing openstack certificate with misconfigured "X509v3 Subject Alternative Name" renders system inoperable
* Where the subjectAltName is not a Fully Qualified Domain Name
* Both controllers end up in stand-by mode
Severity
--------
Major: System/Feature is usable - renders the system inoperable
Steps to Reproduce
------------------
Install 1+1 system (aka: AIO-DX)
Enable https on the system
Add FQDN system paramer: penstack helm endpoint_domain
Install openstack certificate with mismatched FQDN in the "X509v3 Subject Alternative Name" field
Expected Behavior
------------------
After installing https Openstack certificate, even if the "X509v3 Subject Alternative Name"
is misconfigured system should still be operational
Actual Behavior
----------------
Both controllers end up in stand-by mode
Reproducibility
---------------
100% reproducible
System Configuration
-------
1+1 system (aka: AIO-DX)
( Internal Lab name: yow-cgcs-
Branch/Pull Time/Commit
-------
BUILD_ID=
JOB="STX_
<email address hidden>"
Last Pass
---------
n/a (First time feature testing)
Timestamp/Logs
--------------
See attached logs:
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
ALL_NODES_
To reconstruct original log file:
1) Download all the logs
2) execute: cat ALL_NODES_
Test Activity
-------------
Feature Testing
Other
-----
Example of certificate with misconfigured subjectAltName
cwinnick@
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 144787479105097
Signature Algorithm: sha256WithRSAEn
Issuer: C=US, ST=California, L=Alameda, O=Wind River Inc, <email address hidden>
Validity
Not Before: Apr 12 14:11:30 2019 GMT
Not After : Apr 11 14:11:30 2020 GMT
Subject: C=CA, ST=Ont, L=ott, O=wrs, OU=tis, CN=*.<email address hidden>
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
X509v3 extensions:
X509v3 Subject Alternative Name:
Signature Algorithm: sha256WithRSAEn
Changed in starlingx: | |
status: | New → Triaged |
tags: | added: stx.retestneeded |
tags: | added: stx.config |
tags: | added: stx.security |
tags: | removed: stx.retestneeded |
Marking as release gating; medium priority as the system should not be in dual standby mode when using an incorrect certificate.