subject:"Jira \(PUP\-2354\) agent is confused about cert state"

Jira (PUP-2354) agent is confused about cert state

2019-03-21 Thread Heston Hoffman (JIRA)

Title: Message Title


 
 
 
 

 
 
 

 
   
 Heston Hoffman updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Puppet /  PUP-2354  
 
 
  agent is confused about cert state   
 

  
 
 
 
 

 
Change By: 
 Heston Hoffman  
 
 
Labels: 
 redmine  resolved-issue-added  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)  
 
 

 
   
 

  
 

  
 

   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Jira (PUP-2354) agent is confused about cert state

2019-03-20 Thread Josh Cooper (JIRA)

Title: Message Title


 
 
 
 

 
 
 

 
   
 Josh Cooper updated an issue  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
 Puppet /  PUP-2354  
 
 
  agent is confused about cert state   
 

  
 
 
 
 

 
Change By: 
 Josh Cooper  
 
 
Release Notes Summary: 
 Puppet agents no longer get stuck if the server has a CSR or cert from a previous instance of the agent. This enables the `allow_duplicate_certs` setting to work as expected.  
 
 
Release Notes: 
 Known Issue Bug Fix  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)  
 
 

 
   
 

  
 

  
 

   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Jira (PUP-2354) agent is confused about cert state

2019-03-20 Thread Josh Cooper (JIRA)

Title: Message Title


 
 
 
 

 
 
 

 
   
 Josh Cooper commented on  PUP-2354  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
  Re: agent is confused about cert state   
 

  
 
 
 
 

 
 In the upcoming 6.4 release, it will be possible to set allow_duplicate_certs=true, and the agent can submit a CSR even if there is a CSR or signed cert with the same name. If/when the administrator revokes the old cert and signs the new cert, then the agent will download the new cert and proceed as expected. Some of the gotchas described by the OP and in comments have been fixed, such as caching mismatched CSRs from the server. For example, if a node has a valid client cert and you clean it, it will create a new private key and download the previous instance of the cert. Since the cert is mismatched, the agent will error and discard it:  
 
 
 
 
 $ bx puppet ssl clean --certname mars  
 
 
 Notice: Removed private key /tmp/ssltest26/private_keys/mars.pem  
 
 
 Notice: Removed certificate /tmp/ssltest26/certs/mars.pem  
 
 
    
 
 
 $ bx puppet agent -t --certname mars  
 
 
 Info: Creating a new SSL key for mars  
 
 
 Info: csr_attributes file loading from /etc/puppetlabs/puppet/csr_attributes.yaml  
 
 
 Info: Creating a new SSL certificate request for mars  
 
 
 Info: Certificate Request fingerprint (SHA256): 09:50:AC:D9:55:43:D2:33:C7:CA:FF:B2:08:58:03:E7:1B:C9:AC:6D:01:4D:C7:34:43:85:64:67:22:03:64:DA  
 
 
 Info: Downloaded certificate for mars from puppet.delivery.puppetlabs.net

Jira (PUP-2354) agent is confused about cert state

2019-03-12 Thread Mohak Sharma (JIRA)

Title: Message Title


 
 
 
 

 
 
 

 
   
 Mohak Sharma commented on  PUP-2354  
 

  
 
 
 
 

 
 
  
 
 
 
 

 
  Re: agent is confused about cert state   
 

  
 
 
 
 

 
 Hi Josh, I have set autosign to a bash script which return zero or non-zero status according to some logic and enables autosigning from a legitimate source. Just want to make sure according to the limitations listed by you, will it work if I set allow_duplicate_certs to true?  
 

  
 
 
 
 

 
 
 

 
 
 Add Comment  
 

  
 

  
 
 
 
  
 

  
 
 
 
 

 
 This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)  
 
 

 
   
 

  
 

  
 

   





-- 
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Jira (PUP-2354) agent is confused about cert state

2019-02-07 Thread Josh Cooper (JIRA)

Title: Message Title

Josh Cooper commented on PUP-2354

Re: agent is confused about cert state

There are a few issues here. Newly provisioned agents generate a key pair, but optimistically try to download an issued cert before sending a CSR. This is due to the byzantine logic in Puppet::SSL::Host. If there happens to be an issued cert from the previous agent instance, then the agent prints the error message about a mismatched key and cert, and to make matters worse, saves the mismatched cert to disk. This breaks all future attempts to bootstrap the agent's cert. I am working on fixing this mess as described in other tickets in this Epic. But I have a few questions for watchers on this specific ticket. Assuming allow_duplicate_certs=true, I'm proposing:

If the agent submits a CSR and there is already a CSR present on the server (same or different content), then the server will overwrite its version with whatever the agent sent.
If the agent submits a CSR and there is already an issued cert (from possibly a previous instance), the server will save the agent's CSR, but leave the issued cert as-is.
We have to be careful about "automatically" revoking old certs and signing new ones, because a malicious unauthenticated user could submit a CSR for the ca or puppetserver node.
Would it be sufficient to restrict the scope of this to:

If you set allow_duplicate_certs=true then autosign must be false or you must provide an autosigning policy to conditionally clean the old instance and issue a new cert? In particular autosign=true would not be allowed.
If an autosign policy is used, then it's up to the user to define when it it acceptable to clean a node's cert, such as using the AWS instance-id Eric Sorenson mentions above?
We should blacklist the ca node and any node name whose cert contains the isCA: TRUE basic constraint
We could only allow certs to be revoked if they contain a cert extension indicating they are "recycle-able", something like pp_ephemeral=true. Infrastructure nodes like compiler, etc wouldn't have that extension in their cert.
Thoughts?

50 matches

Mail list logo