Skip to content

openssl rehash does not handle multiple certificates in a file as c_rehash does

The switch to openssl rehash from c_rehash in !8306 (merged) had an unintended breaking change: certificates in /etc/gitlab/trusted-certs are no longer processed if they contain multiple certificates.

This effectively caused TLS to stop working because:

  1. NGINX stop presenting the full certificate bundle
  2. Clients could not verify the root certificate.

Consider the following GoDaddy certificate bundle:

godaddy.crt

With c_rehash it handles multiple certs fine:

$ c_rehash  .
Doing .
$ ls -al
total 76
drwxrwxr-x   2 stanhu stanhu  4096 Sep  5 05:12 .
drwxrwxrwt 364 root   root   65536 Sep  5 05:07 ..
lrwxrwxrwx   1 stanhu stanhu    11 Sep  5 05:12 27eb7704.0 -> godaddy.crt
lrwxrwxrwx   1 stanhu stanhu    11 Sep  5 05:12 9c8cbefb.0 -> godaddy.crt
-rw-r--r--   1 stanhu stanhu  3346 Sep  5 05:07 godaddy.crt

However, openssl rehash spits out a warning message and does nothing:

$ openssl rehash .
rehash: warning: skipping godaddy.crt,it does not contain exactly one certificate or CRL
$ echo $?
0

We could detect this warning message and fall back to c_rehash. Alternatively, we could detect that there are multiple certificates and split them up automatically.

Relates to https://gitlab.com/gitlab-com/request-for-help/-/issues/3362

Edited by Stan Hu