Jira (PUP-6697) Allow full downloaded CA bundle to be stored to agent's localcacert file

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper commented on PUP-6697   Re: Allow full downloaded CA bundle to be stored to agent's localcacert file AFAIK, the agent doesn't need to download a CA bundle in order to support intermediate CAs. The agent only needs to download the root CA that provides the trust anchor. It will work because SSL handshake will exchange intermediate cert(s) provided: 1. puppetserver's ssl-cert setting points to a file containing the entire server cert chain [leaf, intermediate(s), root] 2. puppetserver's ssl-ca-cert file contains the CAs that the server will trust for client auth (most likely containing the same intermediate and root certs as above). Provided that's true, then you'll see the server send its complete chain to the agent, for example: # openssl s_client -connect wf7kdc7e00jzrbs.delivery.puppetlabs.net:8140 -CAfile /etc/puppetlabs/puppet/ssl/certs/ca.pem CONNECTED(00000003) depth=2 C = US, ST = Oregon, L = Portland, O = Nepo, CN = Root CA verify return:1 depth=1 C = US, ST = Oregon, L = Portland, O = Nepo, CN = Puppet CA verify return:1 depth=0 CN = wf7kdc7e00jzrbs.delivery.puppetlabs.net verify return:1 --- Certificate chain 0 s:/CN=wf7kdc7e00jzrbs.delivery.puppetlabs.net i:/C=US/ST=Oregon/L=Portland/O=Nepo/CN=Puppet CA 1 s:/C=US/ST=Oregon/L=Portland/O=Nepo/CN=Puppet CA i:/C=US/ST=Oregon/L=Portland/O=Nepo/CN=Root CA 2 s:/C=US/ST=Oregon/L=Portland/O=Nepo/CN=Root CA i:/C=US/ST=Oregon/L=Portland/O=Nepo/CN=Root CA Note the intermediate cert s:/C=US/ST=Oregon/L=Portland/O=Nepo/CN=Puppet CA The server will also send a list of CAs that the server trusts for client auth: Acceptable client certificate CA names /C=US/ST=Oregon/L=Portland/O=Nepo/CN=Puppet CA /C=US/ST=Oregon/L=Portland/O=Nepo/CN=Root CA The SSL client must choose a client cert that chains up to one of the CAs specified. Note that the list includes both the intermediate and root CAs. Using wireshark, I verified that the agent only sends a single client cert in its Certificate message back to the server: Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 1466 Certificates Length: 1463 Certificates (1463 bytes) Certificate Length: 1460 Certificate: ... (id-at-commonName=XXX.puppetlabs.net) signedCertificate algorithmIdentifier (sha256WithRSAEncryption) Padding: 0 encrypted: b9e45d5474eae66da886c7b8e1cb9310bdd4be5884c22ba5... It appears ruby/openssl will omit any certificate that the server already has. For example, if I remove the intermediate CA from the puppetserver's ssl-ca-cert, then the agent will send that cert in its response. But it's wasteful to do that, so I recommend including the intermediate CA in the ssl-ca-cert file. I'm still in favor of implementing CA bundle support, as it would allow users to gracefully switch over to a new root CA before the old one expires. That would benefit all Puppet users, not just folks using intermediate certs. It would also help with more complicated cross-signing certification paths. Also nit, it appears that puppetserver 2.7.2 will return the contents of cacert rather than localcacert. The latter is the location that the agent downloads /puppet-ca/v1/certificate/ca to. It's different than cacert in case there's an agent running on the same host as the CA. Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.