http://bugzilla.novell.com/show_bug.cgi?id=550395 User jdsn@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=550395#c1 --- Comment #1 from J. Daniel Schmidt 2009-10-27 08:58:24 MDT --- I talked to Michael Calmer about this. The outcome is: SLMS will not ship any certificate. The deployer has to configure one manually (either using a self-signed certificate or using one that was signed by a big trust company). Therefore it makes no sense to include any certificate in the webyast package. Creators of an appliance have to make sure that their CA certificate is included in the image - just like we have to make sure that we ship the package "openssl-certs" with our appliances (beta3 does not contain it). It might be an option to require the package "openssl-certs" from the package "yast2-webservice-registration". -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=550395 User jdsn@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=550395#c2 J. Daniel Schmidt changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |kkaempf@novell.com --- Comment #2 from J. Daniel Schmidt 2009-11-02 10:04:06 MST --- (In reply to comment #0)

The current yast2-webclient ssl certificate is self-generated. It should be replaced by something more trustworthy ...

Please define "something more trustworthy". And btw.: we are not talking about "client certifcates" here - this is an authentication technology based on SSL certificates. We could create a general server certifcate or an entire CA and ship it, but this does not change the trustworthiness. To the contrary: if the certificate key file is published, everybody could decrypt the SSL traffic. So the current situation is the best I can imagine for now. If it comes to deployment every customer has to create his own certificate(s) for his system(s) anyway, as he can only trust a certificate he created and implemented himself and it has to match his domainname(s). We can not do this for him. We can only help by pointing him to the yast2-ca-management module. For his appliances he thus has to use a certificate whose CA is already part of the openssl-certs package and make sure it gets into the appliance _or_ he has to make sure that his own CA certificate file gets into the appliance. I discussed the latter with Michael Calmer and we agreed that SLMS should not import any CA certifcate automatically. As this is a step that touches the trust relationship between two systems, parties or even companies this has to be a deliberate action. So I recommend to close this bug as WORKSFORME or WONTFIX. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=550395 User jdsn@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=550395#c4 J. Daniel Schmidt changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |WONTFIX Summary|Establish trust chain for |Establish trust chain for |client certificate |server certificate --- Comment #4 from J. Daniel Schmidt 2009-11-03 10:27:06 MST --- (In reply to comment #3)

So its up to the vendor to create (and install) a certificate ?!

Yes, exaclty.

...

If it comes to deployment every customer has to create his own certificate(s)

customer ? I guess you mean 'vendor', the one creating the appliance.

Sure, I meant 'vendor'. No customer (in terms of end-user) needs to bother with CA certificates.

Question is, whats the default certificate delivered with yast2-webclient ?

It might sound crazy - but what about "none"? This is the best way to force the vendor to create its own certificates. A server certificate needs to match the hostname or in special cases the IP address of the server. We do not know either of these. For our beta releases or demo images we could ship our self signed certificate - but these images should never be deployed to a production system.

The current one is self-generated ('webyast team') and serves the needs to run over https. Since its packaged inside a(n autobuild) signed package, it has an established chain of trust.

This only deals with encryption of the traffic but not with trust so far. Only we know (or believe the ones who know) how the certificates are created. And I doubt that our security team will allow to ship our CA certificate as a trusted CA.

Can we package a 'Novell Inc' or 'SUSE Linux Products GmbH' certificate instead ?

You mean, we should act as a CA and ship signed certificates and include our CA certificate into the appliance? I would not do this. This is a very big administrative effort. If we act as a CA handing out singed certificates they could be (mis)used for anything else and thus lowering our own trustworthiness. For any abuse of a service with such a certificate we will be contacted.

Which advice can we give appliance vendors ?

I would definitely advise them to create their own certificates and either let them be signed by their own CA or by a known CA whose certificate is alreday shipped with the openssl-certs package. Therefore I'd recommend that we ship no certificate at all with the Add-On product in order to force the vendor to create one. Feel free to comment to this bug but I will close this as WONTFIX now. For any other solution we should setup a meeting together with Michael Calmer (for SLMS and SSL) and the security team and discuss all issues. (Note: I fixed the summary.) -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=550395 Klaus Kämpf changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO Info Provider| |flucifredi@novell.com -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=550395 User flucifredi@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=550395#c7 Federico Lucifredi changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED CC| |flucifredi@novell.com Info Provider|flucifredi@novell.com | --- Comment #7 from Federico Lucifredi 2009-11-09 18:13:12 MST --- #5 - it needs to work out of the box, even if the state is not final. 1. ship with https enabled but with a self-created certificate would be best option as I understand it. Expecting a new partner (vendor) to create and install a certificate will be a pretty hard requirement for their initial proof-of-concept. We should start with self-sing, it should work out of the box, and we should document the steps that the vendor should take further. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=550395 User mc@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=550395#c9 Michael Calmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED Info Provider|mc@novell.com | --- Comment #9 from Michael Calmer 2009-11-13 03:13:40 MST --- You may want to look at the "sfcb" init script. They do the same. So you do not need to re-invent the wheel. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=550395 User kkaempf@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=550395#c11 --- Comment #11 from Klaus Kämpf 2009-11-13 03:23:24 MST --- And one more example: http://openwsman.svn.sourceforge.net/viewvc/openwsman/openwsman/trunk/etc/ow... -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=550395 http://bugzilla.novell.com/show_bug.cgi?id=550395#c13 J. Daniel Schmidt changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #13 from J. Daniel Schmidt 2009-11-20 17:32:05 UTC --- Fixed in yast2-webclient 0.0.18 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.