openssl rehash
does not handle multiple certificates in a file as c_rehash
does
The switch to openssl rehash
from c_rehash
in !8306 (merged) had an unintended breaking change: certificates in /etc/gitlab/trusted-certs
are no longer processed if they contain multiple certificates.
This effectively caused TLS to stop working because:
- NGINX stop presenting the full certificate bundle
- Clients could not verify the root certificate.
Consider the following GoDaddy certificate bundle:
With c_rehash
it handles multiple certs fine:
$ c_rehash .
Doing .
$ ls -al
total 76
drwxrwxr-x 2 stanhu stanhu 4096 Sep 5 05:12 .
drwxrwxrwt 364 root root 65536 Sep 5 05:07 ..
lrwxrwxrwx 1 stanhu stanhu 11 Sep 5 05:12 27eb7704.0 -> godaddy.crt
lrwxrwxrwx 1 stanhu stanhu 11 Sep 5 05:12 9c8cbefb.0 -> godaddy.crt
-rw-r--r-- 1 stanhu stanhu 3346 Sep 5 05:07 godaddy.crt
However, openssl rehash
spits out a warning message and does nothing:
$ openssl rehash .
rehash: warning: skipping godaddy.crt,it does not contain exactly one certificate or CRL
$ echo $?
0
We could detect this warning message and fall back to c_rehash
. Alternatively, we could detect that there are multiple certificates and split them up automatically.
Relates to https://gitlab.com/gitlab-com/request-for-help/-/issues/3362
Edited by Stan Hu