Project

General

Profile

Actions

Bug #27462

closed

katello-certs-check (check-ca-bundle) doesn't catch openssl error correctly

Added by Hao Yu almost 5 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
foreman-installer script
Target version:
Fixed in Releases:
Found in Releases:

Description

Description of problem:
Openssl will return 0 exit code and "OK" message for some errors. For example:

  1. openssl verify -CAfile /root/min_bundle.pem -purpose sslserver /root/sat_cert.pem
    /root/sat_cert.pem: C = AU, O = My Org, OU = Web Servers, CN = satellite.example.com
    error 26 at 0 depth lookup:unsupported certificate purpose
    OK
  1. echo $?
    0

The "check-ca-bundle" function only catches the exit code but doesn't catch the error message. This causes the invalid ssl server certificate to pass the test.

Actions #1

Updated by The Foreman Bot almost 5 years ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman-installer/pull/376 added
Actions #2

Updated by Hao Yu almost 5 years ago

This issue seems to only happen in older version of openssl, such as RHEL 7.6 with "openssl-1.0.2k". It doesn't happen in Fedora 27 with "openssl-1.1.0g".

Actions #3

Updated by The Foreman Bot over 3 years ago

  • Assignee set to Eric Helms
  • Pull request https://github.com/theforeman/foreman-installer/pull/617 added
Actions #4

Updated by The Foreman Bot over 3 years ago

  • Fixed in Releases 2.4.0 added
Actions #5

Updated by Hao Yu over 3 years ago

  • Status changed from Ready For Testing to Closed
Actions #6

Updated by Ewoud Kohl van Wijngaarden over 3 years ago

  • Target version set to 2.3.0
  • Triaged changed from No to Yes
  • Fixed in Releases 2.3.0 added
  • Fixed in Releases deleted (2.4.0)
Actions

Also available in: Atom PDF