Jira (PUP-1407) PR (2238): puppet CA generates CRL that does not conform to RFC5280

[Joshua Cooper (JIRA)]

Title: Message Title

Joshua Cooper commented on an issue   Re: PR (2238): puppet CA generates CRL that does not conform to RFC5280 To verify, wipe out the master's ssl directory /etc/puppet/ssl, and install a puppetmaster without this change. Start the master, and it will generate a /etc/puppet/ssl/crl.pem. Dump this file using: # openssl crl -in /etc/puppet/ssl/ca/ca_crl.pem -noout -text Certificate Revocation List (CRL): Version 2 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: /CN=Puppet CA: puppetmaster.solar.lan Last Update: Jan 10 04:52:25 2014 GMT Next Update: Jan 9 04:52:26 2019 GMT CRL extensions: X509v3 CRL Number: 0 No Revoked Certificates. Signature Algorithm: sha1WithRSAEncryption Note there is only the one CRL extension for crlNumber. Next wipe out the ssl directory, install a new puppetmaster (or run from source bundle exec puppet master ...) and do the same thing, but you should see an additional extension for authority key identifier. The extension will be of the form: X509v3 Authority Key Identifier: 0B:46:40:EC:0D:8B:39:14:FB:5F:AB:56:3C:D2:82:98:8A:9E:EC:AC Next verify that the value of the extension matches the subject key identifier in the ca's certificate: # openssl x509 -in /etc/puppet/ssl/ca/ca_crt.pem -noout -text Finally, revoke a host certificate, e.g. for the puppetmaster # puppet cert revoke puppetmaster Next run # openssl crl -in /etc/puppet/ssl/ca/ca_crl.pem -noout -text And verify that the CRL serial number has been incremented, that the CRL lists the revoked certificate's serial number along with reason of key compromise, and that the CRL authority key identifier extension is the same. Add Comment   Puppet / PUP-1407 PR (2238): puppet CA generates CRL that does not conform to RFC5280 according to http://tools.ietf.org/html/rfc5280#section-5.2.1 a conforming CA MUST provide the authorityKeyIdentifier extension in the CRL to identify the issuer of the CRL. I have a patch that adds that functionality and will submit a pull request. This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/groups/opt_out.