From 8ea04ab3e3eef431d529c0d99e9d1ea5a65933e1 Mon Sep 17 00:00:00 2001 From: Stanislav Laznicka Date: Thu, 8 Feb 2018 10:07:51 +0100 Subject: [PATCH] httpinstance: verify priv key belongs to certificate Verify the certificate issued during an installation belongs to its private key. Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes Reviewed-By: Stanislav Laznicka Reviewed-By: Rob Crittenden --- ipaserver/install/httpinstance.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py index 574abec73..b1e597a5a 100644 --- a/ipaserver/install/httpinstance.py +++ b/ipaserver/install/httpinstance.py @@ -403,11 +403,16 @@ class HTTPInstance(service.Service): if prev_helper is not None: self.add_cert_to_service() + with open(paths.HTTPD_KEY_FILE, 'rb') as f: + priv_key = x509.load_pem_private_key( + f.read(), None, backend=x509.default_backend()) + # Verify we have a valid server cert - # FIXME: come up with openssl equivalent - # server_certs = db.find_server_certs() - # if not server_certs: - # raise RuntimeError("Could not find a suitable server cert.") + if (priv_key.public_key().public_numbers() + != self.cert.public_key().public_numbers()): + raise RuntimeError( + "The public key of the issued HTTPD service certificate " + "does not match its private key.") # store the CA cert nickname so that we can publish it later on # self.cacert_nickname = db.cacert_name