Jira (PUP-9064) Puppet assumes all SSL certs it verifies have client purpose set

[Casey Williams (JIRA)]

Title: Message Title

Casey Williams created an issue   Puppet / PUP-9064 Puppet assumes all SSL certs it verifies have client purpose set Issue Type: Bug Assignee: Unassigned Created: 2018/08/14 9:30 AM Fix Versions: PUP 6.0.0 Priority: Normal Reporter: Casey Williams This PR is open to update Travis & Appveyor to test puppet's master branch using ruby 2.5; The Appveyor tests have uncovered a legitimate puppet failure (link to the full log here): Failures: 1) Puppet::Indirector::CertificateStatus::File when searching should return a list of all hosts with certificate requests, signed certs, or revoked certs Failure/Error: expect(results).to eq([["ca","signed"],["requested_host","requested"],["revoked_host","revoked"],["signed_host","signed"]]) expected: [["ca", "signed"], ["requested_host", "requested"], ["revoked_host", "revoked"], ["signed_host", "signed"]] got: [["ca", "revoked"], ["requested_host", "requested"], ["revoked_host", "revoked"], ["signed_host", "signed"]] (compared using ==) # ./spec/unit/indirector/certificate_status/file_spec.rb:188:in `block (3 levels) in <top (required)>' # util/rspec_runner:44:in `run' # util/rspec_runner:59:in `<main>' Finished in 49.26 seconds (files took 7.23 seconds to load) A summary of some discussion we've had around this in PRs and chat so far: This happens with Ruby 2.5.x and and OpenSSL 1.1.0. We suspect we're seeing this failure in Appveyor and not Travis because Travis may build their Ruby 2.5.x against an earlier version of OpenSSL We set purpose to SSL_CLIENT, and OpenSSL 1.1.0, unlike earlier versions, takes this as an indication that it should be checking the purpose during verification This failure only manifests when verifying the CA using itself: This normally works because the CA is a self-signed cert But the CA does not have the SSL_CLIENT purpose, so it fails verification now To fix this, we need to find some way not to set the purpose when verifying the CA cert using itself: We may add an optional purpose parameter to the verify method, and have it default to OpenSSL::X509::PURPOSE_SSL_CLIENT. Then, Host's state method could pass OpenSSL::PURPOSE_ANY here. Sean McDonald provided this script to perform a test that creates a CA and attempts to verify it with and without the purpose set (requires system openssl installed). This issue blocks PUP-8614 (adding ruby 2.5 to puppet's Travis/Appveyor config), which blocks the upgrade to ruby 2.5.1 in puppet-agent.     Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.