From e537686bcc8248bc0216ce634ae7707fa65e70ba Mon Sep 17 00:00:00 2001 From: Stanislav Laznicka Date: Mon, 18 Sep 2017 16:28:10 +0200 Subject: [PATCH] Don't write p11-kit EKU extension object if no EKU b5732efd introduced a regression because it tries to write EKU that's actually in the CA cert instead of using the LDAP information. However, when no EKU is available, IPACertificate.extended_key_usage_bytes still returned at least EKU_PLACEHOLDER OID to keep the behavior the same as in previous versions. This caused the EKU_PLACEHOLDER to be written in the ipa.p11-kit file which made Firefox report FreeIPA Web UI as improperly configured. https://pagure.io/freeipa/issue/7119 Reviewed-By: Fraser Tweedale --- ipalib/x509.py | 5 ++++- ipaplatform/redhat/tasks.py | 5 +++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/ipalib/x509.py b/ipalib/x509.py index 857245aa3..0b3a423ce 100644 --- a/ipalib/x509.py +++ b/ipalib/x509.py @@ -295,8 +295,11 @@ class IPACertificate(object): @property def extended_key_usage_bytes(self): + eku = self.extended_key_usage + if eku is None: + return + ekurfc = rfc2459.ExtKeyUsageSyntax() - eku = self.extended_key_usage or {EKU_PLACEHOLDER} for i, oid in enumerate(eku): ekurfc[i] = univ.ObjectIdentifier(oid) ekurfc = encoder.encode(ekurfc) diff --git a/ipaplatform/redhat/tasks.py b/ipaplatform/redhat/tasks.py index 99f04353c..e3bb1271e 100644 --- a/ipaplatform/redhat/tasks.py +++ b/ipaplatform/redhat/tasks.py @@ -257,7 +257,7 @@ class RedHatTaskNamespace(BaseTaskNamespace): "\n") has_eku = set() - for cert, nickname, trusted, ext_key_usage in ca_certs: + for cert, nickname, trusted, _ext_key_usage in ca_certs: try: subject = cert.subject_bytes issuer = cert.issuer_bytes @@ -296,7 +296,8 @@ class RedHatTaskNamespace(BaseTaskNamespace): pem=cert.public_bytes(x509.Encoding.PEM).decode('ascii')) f.write(obj) - if ext_key_usage is not None and public_key_info not in has_eku: + if (cert.extended_key_usage is not None and + public_key_info not in has_eku): try: ext_key_usage = cert.extended_key_usage_bytes except PyAsn1Error as e: