[release-4.17] OCPBUGS-49390: Reject All CA-Signed Certs Using SHA1 #650
Conversation
Previously, only SHA1 leaf certs were rejected. However, in 4.16, any SHA1 cert that is CA-signed (not self-signed) is unsupported. This led to cases were routes with SHA1 intermediate CA certs were accepted, but HAProxy rejects them. Self-signed SHA1 certificates (i.e. root CA) remain supported since they are not subject to verification. This update ensures all route certs, including the server, CA, and destination CA certs, are inspected, and any SHA1 cert that is not self-signed is rejected. Similar to SHA1, this fix also allows self-signed MD5 certificates which were incorrectly rejected previously. Additionally, explicitly reject DSA SHA1 certificates. While all DSA certificates are already rejected by the router, this change provides a clearer and more precise rejection error message. Lastly, explicitly reject MD2 certificates. Since MD2 certificates also cause HAProxy to fail to start, they should be explicitly rejected too.
|
@openshift-cherrypick-robot: Detected clone of Jira Issue OCPBUGS-45290 with correct target version. Will retitle the PR to link to the clone. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-49390, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/assign |
|
/jira refresh |
|
@candita: This pull request references Jira Issue OCPBUGS-49390, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
|
@candita: This pull request references Jira Issue OCPBUGS-49390, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
tested it with 4.17.0-0.ci.test-2025-03-14-014945-ci-ln-9lhmi6k-latest |
|
/label qe-approved |
|
@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-49390, which is valid. 7 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm This is a clean backport. However, it's worth noting we will not be backporting this past 4.16, which results in the following behavior: versions 4.12-4.15 reject ALL MD5 certs (even though self-signed MD5 certs don't break HAProxy), whereas 4.16+ will allow self-signed MD5 certs. See details in https://github.com/openshift/router/pull/642/files#r1937407274. /label backport-risk-assessed |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: candita The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/refresh |
|
/label cherry-pick-approved |
|
@openshift-cherrypick-robot: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1e29d8c
into
openshift:release-4.17
|
@openshift-cherrypick-robot: Jira Issue OCPBUGS-49390: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-49390 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[ART PR BUILD NOTIFIER] Distgit: ose-haproxy-router-base |
|
[ART PR BUILD NOTIFIER] Distgit: openshift-enterprise-haproxy-router |
|
Fix included in accepted release 4.17.0-0.nightly-2025-05-23-045753 |
This is an automated cherry-pick of #642
/assign openshift-ci-robot