Bug #26458: Smart Proxy lists valid certificates as expired - Smart Proxy - Foreman

Actions

Copy link

Bug #26458

closed

Smart Proxy lists valid certificates as expired

Added by Alex Fisher about 5 years ago. Updated about 5 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Alex Fisher

Category:

PuppetCA

Target version:

Difficulty:

trivial

Triaged:

Bugzilla link:

Pull request:

https://github.com/theforeman/smart-proxy/pull/644

Fixed in Releases:

Foreman - 1.22.0

Found in Releases:

Foreman - 1.22.0

Red Hat JIRA:

Description

The logic in the new puppetca http api implementation is wrong (when using puppetserver >= 6.3)

The new puppetserver API doesn't return whether a certificate has expired or not. It returns a state of `requested`, `signed` or `revoked` and (since puppetserver 6.3), `not_before` and `not_after`. Clients, (such as the smart-proxy), are required to work out whether a `signed` certificate is expired or not based on the `not_before` and `not_after` dates.

Foreman expects a certificate to be `valid`, `revoked`, or `pending`. The smart-proxy should return `valid` for `signed` certificates that haven't expired, and `revoked` for those that have. It is currently returning `revoked` for non-expired certificates and `valid` for those that have expired.