JBevillC opened a new issue #3181: TO API - DeliveryServices AddSSLKeys Incorrectly stores X509 certificate missing Subject/Authority Key as zero length string. URL: https://github.com/apache/trafficcontrol/issues/3181 _Method_: POST _Endpoint_: api/1.4/deliveryservices/sslkeys/add _Description:_ Importing X509 SSL certificate and corresponding intermediate/root X509 certificates that do not contain X509v3 Subject Key Identifier (SKI) and corresponding Authority Key Identifier (AKI) results in the certificate being stored in Traffic Vault as a zero length string. Further, all intermediate CA certificates that follow are ignored for X509 certificate validation. Additionally, the RSA key and certificate-request (csr) do get stored correctly in traffic vault, but the certificate ('crt' field in json) is a zero length string. The response code for this import operation is incorrectly sent back to the client as a 200 indicating a successful import. _Impact_: Traffic Router Languid SSL connector is impacted (partially and fully) upon receiving incomplete/invalid SSL Key/Certificate data from Traffic Ops SSLKeysAPIs. This presents a problem in that the incomplete/invalid SSL key/cert pair causes TrafficRouter to throw an exception related to an invalid X509 certificate. After exception has occurred, any new TLS handshake attempts hang and eventually timeout, thus a HTTPS services have been partially or fully impacted. _Possible Solution_: All X509 certificates that do not contain Subject/Authority Key Identifier X509v3 should be rejected with proper 4XX HTTP code and corresponding JSON error description. Traffic Router should also be updated to handle invalid certificate data received from Traffic Ops without partial/full impact to SSL Languid connector.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
