Replace SSLSocket with JSSSocket in CLI #5021

fmarco76 · 2025-03-28T10:16:48Z

The JSSSocket allows both sync and async communication used by modern framework.

The main difference when used with current clients is related to certificate verification. JSSSocket enables OCSP and CRL-DP verification. This could be a problem in some scenario where the server cannot be accessed for the verification. Although it is possible to ignore the error using the pki option --ignore-cert-status <status> a new option allows to skip the verification: --skip-revocation-check.

The client enable the revocation check by default but there are problem when the CA act as a client to perform some operation. For this reason a new option is added, ca.clientRevocationCheck, which default to false. This can be configured with pkispawn using the option pki_client_verify_cert (default False).

The client operations performed during pkispawn/pkidestroy have the revocation check disabled.

An option to control the revocation check during installation and deletion, and some workflow to verify they are working, will be done in separate PR.

fmarco76 · 2025-03-28T11:01:04Z

@rcritten with this update the client validate certificate but IPA is not making available the OCSP endpoint, or at least in the configuration here. For this and other problem, at moment the verification is disabled during installation and in the CA when acting as client. Could OCSP be enabled in IPA?
Additionally, I have disabled in all the installation scenarios I have tried but some cases could fail so it need to be verified.

If IPA uses pki clients for some operation this should be taken in account.

edewata

The code changes are good, but as discussed on Slack I'm a bit concerned because some tests have to be changed to use the --ignore-... or --skip-... options, so it might cause problems for QE automation and end users as well.

I think if we know for certain that this is only affecting a limited set of scenarios (i.e. QE might need to update some tests but not all), we probably can merge it if QE is OK with that.

If this is affecting many of scenarios, I'd suggest to wait until we resolve the actual issue with revocation checking.

Alternatively, we probably can disable the revocation checking by default so the behavior is the same as before. Once we resolve the actual issue with revocation checking we can change the default.

edewata · 2025-03-31T16:01:53Z

.github/workflows/ca-ds-connection-test.yml

@@ -109,6 +109,7 @@ jobs:
          # enrollment should fail
          docker exec pki pki \
              -n caadmin \
+              --ignore-cert-status OCSP_SERVER_ERROR \


I'm wondering if we should set up a separate OCSP server with it's own DS so that it's not affected by CA DS shutdown which is what we're primarily trying to test here.

I guess this could be a scenario also for IPA so it is OK to test with internal OCSP

The PKIConnection is now using NonBlocckingSocketFactory as default to create a socket. The non bloking socket is built in JSSSocket.

During pkispawn some client command c 8000 ould fails because the revocation cannot be verified since the server is down. These cases have to be ignored.

With JSSSocket in the client it is possible to enable OCSP check for the certificate. If not specified it is enabled for all clients operation but it is disabled for all the client commands executed by the server. There are several scenarios where the check are failing because of the presence of other OCSP certificates. This is the case of SubCAs. For this reason it is disabled at the moment but can be disabled. An option could be to enable and making OCSP using KeyHash using the param ca.byName. To disable revocation check from pki cli it has been introduced the option `--skip-revocation-check`.

When CA is running client operation there is no revocation check on certificates. This can be enabled with the option in CS.cfg: ca.clientRevocationCheck=true The opetion can be enabled with pkispawn using the CA configuration: pki_client_verify_cert=True The default value is false

Since clients are moving to JSS which perform OCSP check by default there are situation where these need to be disabled. New option in pkispan and pki command have been added and here documented.

fmarco76 · 2025-04-03T18:27:54Z

@edewata after #5026 the only problem are with the ActivityMonitor which will be fixed in other PRs. The remaining skips are related to situation where expired/revoked certificate are expected. Do we miss cases?

pkispawn during installation does not check certificates, should it have an option to enable? (like the CA acting which acting as a client does not check by default but there is the option to enable).

edewata

8000

Thanks for the update! I do have some additional comments. I think we need @ladycfu's input here.

edewata · 2025-04-03T20:09:48Z

.github/workflows/ca-renewal-system-certs-hsm-test.yml

@@ -271,6 +271,7 @@ jobs:
          docker exec pki pki \
              -u caadmin \
              -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \


Should this be EXPIRED_CERTIFICATE since we're testing with expired certs?

This error is generated by checking the validity of temporary sslserver certificate. In line 211 above it was verified the expired sslserver and the error was EXPIRED_CERTIFICATE as expected. Then it is replaced with a temporary certificate which is valid and not revoked but all the subsystem certificates have expired, including the ocsp_signing certificate. Therefore, testing the temporary sslserver certificate it is valid and good but the validation failed because the OCSP certificate has expired. As a result the certificate is considered REVOKED because our policy is to consider the certificate revoked if validation fails.

I think the "revoked" status is misleading since there's nothing actually revoked, but we can table that for another time. Do you mind adding your explanation as a comment above this line?

edewata · 2025-04-03T20:10:33Z

.github/workflows/ca-renewal-system-certs-test.yml

@@ -234,6 +234,7 @@ jobs:
          docker exec pki pki \
              -u caadmin \
              -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \


Same thing, should this be EXPIRED_CERTIFICATE?

edewata · 2025-04-03T20:15:14Z

.github/workflows/ipa-renewal-test.yml

@@ -187,7 +188,7 @@ jobs:
          docker exec ipa pki nss-cert-show ipa-ca-agent

          # CA admin should be able to access PKI users
-          docker exec ipa pki -n ipa-ca-agent ca-user-find
+          docker exec ipa pki -n ipa-ca-agent --skip-revocation-check ca-user-find


I think we should use --ignore-cert-status EXPIRED_CERTIFICATE since we're trying to fix an expired cert. If the cert is actually revoked we do want the client to know that (i.e. the command should fail).

edewata · 2025-04-03T20:24:02Z

docs/changes/v11.7.0/Server-Changes.adoc

+== Add pki_client_verify_cert parameter ==
+
+A new parameter `pki_client_verify_cert` has been added to
+enable/disable the certificate revocation check for the CA acting as
+client. The default value is `False` which disables the check.


We have other pki_client_* params but they are mainly used to provide the client credentials for the admin user, so the new param could be confusing. Could we use something like pki_connector_verify_cert or pki_kra_connector_verify_cert?

edewata · 2025-04-03T20:28:13Z

base/server/python/pki/server/deployment/__init__.py

+        if config.str2bool(self.mdict['pki_client_verify_cert']):
+            subsystem.set_config('ca.clientRevocationCheck', 'true')


Could we use something like ca.certRevocationCheck instead to avoid confusion, or maybe move it to the connector configuration (e.g. ca.connector.KRA.certRevocationCheck)?

edewata · 2025-04-03T20:29:18Z

.github/workflows/tps-separate-test.yml

+          #TODO: certificate not accepted with this setup
+          docker exec tps pki -n caadmin --ignore-banner \
+              tps-user-show tpsadmin


Is the TODO still needed?

edewata · 2025-04-03T20:31:04Z

.github/workflows/ca-container-existing-config-test.yml

@@ -277,16 +277,19 @@ jobs:

      - name: Check CA admin user again
        run: |
+          #TODO: after migration the OCSPServlet is failing and has to be fixed


Is there a ticket for this issue? Could you add the link into the comment?

It is the same problem with the AuthorityMonitor present with other containers workflows.

I see, AuthorityMonitor is indeed not compatible with containers, but if it's disabled it's breaking other things, and we just discovered that since we're enabling revocation checking. Could you maybe change the comment like this: OCSPServlet fails since AuthorityMonitor is disabled in container?

edewata · 2025-04-03T20:35:07Z

.github/workflows/ca-ds-connection-test.yml

@@ -163,8 +165,10 @@ jobs:
          sleep 60

          # enrollment should work
+          # OCSP is not working because he authorityMonitor is disabled


I think this is another issue with AuthorityMonitor, basically if cannot be disabled without causing issues somewhere elase.

typo: 'he' -> 'the'

edewata · 2025-04-03T20:40:48Z

base/server/etc/default.cfg

@@ -384,6 +384,8 @@ pki_request_id_length=128
 pki_security_domain_setup=True
 pki_registry_enable=True

+pki_client_verify_cert=False


I think we should disable revocation check only if it's causing a chicken and egg problem (e.g. installing CA with certs pointing to its built-in OCSP) so I'm not sure if we should apply the same default policy for all installation cases.

I have update to true. With latest changes to default OCSP there are no problem in workflows.

edewata

Thanks for the update! I have some additional comments, but I think this looks good. Feel free to merge if there's no other objections.

edewata · 2025-04-04T15:32:00Z

.github/workflows/ca-container-existing-config-test.yml

@@ -277,16 +277,19 @@ jobs:

      - name: Check CA admin user again
        run: |
+          #TODO: after migration the OCSPServlet is failing and has to be fixed


I see, AuthorityMonitor is indeed not compatible with containers, but if it's disabled it's breaking other things, and we just discovered that since we're enabling revocation checking. Could you maybe change the comment like this: OCSPServlet fails since AuthorityMonitor is disabled in container?

edewata · 2025-04-04T15:39:12Z

.github/workflows/ca-renewal-system-certs-hsm-test.yml

@@ -271,6 +271,7 @@ jobs:
          docker exec pki pki \
              -u caadmin \
              -w Secret.123 \
+              --ignore-cert-status REVOKED_CERTIFICATE \


I think the "revoked" status is misleading since there's nothing actually revoked, but we can table that for another time. Do you mind adding your explanation as a comment above this line?

sonarqubecloud · 2025-04-04T17:12:23Z

Quality Gate passed

Issues
9 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.7% Duplication on New Code

See analysis details on SonarQube Cloud

ladycfu

LGTM. Only two minor change suggestions. Feel free to update and merge.

ladycfu · 2025-04-04T17:42:01Z

.github/workflows/ca-ds-connection-test.yml

@@ -163,8 +165,10 @@ jobs:
          sleep 60

          # enrollment should work
+          # OCSP is not working because he authorityMonitor is disabled


typo: 'he' -> 'the'

ladycfu · 2025-04-04T21:05:36Z

docs/changes/v11.7.0/Tools-Changes.adoc

+check in situation where the OCSP server or the CRLs cannot be
+accessed.
+
+Alternatively, the generated error can be ignored using the option


Alternatively, the revocation check will still happen, but the generated error can be ignored using the option

IPA assign AIA to a dedicated host, named "ipa-ca", as described in https://pagure.io/freeipa/issue/8595. The host ipa-ca has to be an alias for the hostname to allow AIA to work properly.

The clientRevocationCheck is used only with KRA connector so it has been moved to the connector configuration and renamed as "ca.connector.KRA.certRevocationCheck". Additionally, the pkispawn parameter "pki_client_verify_cert" has been renamed as "pki_kra_connector_verify_cert".

fmarco76 · 2025-04-07T08:00:58Z

@edewata @ladycfu Thanks!

fmarco76 requested review from edewata, ladycfu and MichalTravnicek March 28, 2025 10:16

fmarco76 force-pushed the SSLSocket2JSSSocket branch from 5107263 to 07d5449 Compare March 28, 2025 13:52

edewata reviewed Mar 28, 2025

View reviewed changes

edewata reviewed Mar 31, 2025

View reviewed changes

edewata mentioned this pull request Mar 31, 2025

Update AuthorityMonitor #5025

Closed

fmarco76 force-pushed the SSLSocket2JSSSocket branch 3 times, most recently from 6bca823 to ef9f3e3 Compare April 2, 2025 16:28

fmarco76 added 5 commits April 3, 2025 20:11

Make PKIConnection default to non blocking

f14d6a7

The PKIConnection is now using NonBlocckingSocketFactory as default to create a socket. The non bloking socket is built in JSSSocket.

Installation steps has to ignore revoked certificate

7655c04

During pkispawn some client command c 8000 ould fails because the revocation cannot be verified since the server is down. These cases have to be ignored.

Update v11.7 for OCSP in client commands

377acbf

Since clients are moving to JSS which perform OCSP check by default there are situation where these need to be disabled. New option in pkispan and pki command have been added and here documented.

fmarco76 force-pushed the SSLSocket2JSSSocket branch from ef9f3e3 to 37dcd92 Compare April 3, 2025 18:16

edewata reviewed Apr 3, 2025

View reviewed changes

fmarco76 force-pushed the SSLSocket2JSSSocket branch from 37dcd92 to 2c3ba22 Compare April 4, 2025 09:54

edewata approved these changes Apr 4, 2025

View reviewed changes

fmarco76 force-pushed the SSLSocket2JSSSocket branch from 837f774 to 96f27e3 Compare April 4, 2025 16:02

ladycfu approved these changes Apr 4, 2025

View reviewed changes

fmarco76 added 4 commits April 7, 2025 09:57

Update CI for JSSSocket in pki CLI

e365a31

Fix network alias for IPA CI

85406db

IPA assign AIA to a dedicated host, named "ipa-ca", as described in https://pagure.io/freeipa/issue/8595. The host ipa-ca has to be an alias for the hostname to allow AIA to work properly.

Update doc for name change in clientRevocationCheck

6aeada3

fmarco76 force-pushed the SSLSocket2JSSSocket branch from 96f27e3 to 6aeada3 Compare April 7, 2025 07:59

fmarco76 merged commit 896cebc into dogtagpki:master Apr 7, 2025
22 of 29 checks passed

fmarco76 deleted the SSLSocket2JSSSocket branch April 7, 2025 08:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace SSLSocket with JSSSocket in CLI #5021

Replace SSLSocket with JSSSocket in CLI #5021

		if config.str2bool(self.mdict['pki_client_verify_cert']):
		subsystem.set_config('ca.clientRevocationCheck', 'true')

Replace SSLSocket with JSSSocket in CLI #5021

Replace SSLSocket with JSSSocket in CLI #5021

Conversation

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Quality Gate passed

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment