Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable TLS 1.3 post handshake auth #3236

Closed
wants to merge 1 commit into from
Closed

Enable TLS 1.3 post handshake auth #3236

wants to merge 1 commit into from

Conversation

tiran
Copy link
Member

@tiran tiran commented Jun 6, 2019

No description provided.

@tiran tiran added WIP Work in progress - not ready yet for review ipa-next Mark as master (4.13) only labels Jun 6, 2019
@tiran tiran force-pushed the tls13_pha branch 3 times, most recently from c0ef5e9 to 3f1297c Compare June 6, 2019 08:50
@abbra
Copy link
Contributor

abbra commented Jun 6, 2019 

  [error] NetworkError: cannot connect to 'https://master.ipa.test:8443/ca/rest/account/login': attribute 'post_handshake_auth' of '_ssl._SSLContext' objects is not writable
cannot connect to 'https://master.ipa.test:8443/ca/rest/account/login': attribute 'post_handshake_auth' of '_ssl._SSLContext' objects is not writable

@tiran
Copy link
Member Author

tiran commented Jun 6, 2019

Ah, old OpenSSL version ...

@tiran tiran force-pushed the tls13_pha branch 2 times, most recently from 68e9843 to e5330f9 Compare June 6, 2019 11:44
@rcritten
Copy link
Contributor

rcritten commented Jun 6, 2019

I'm on F29 and communication to the CA is still failng. I added debugging when post_handshake_auth is set to True to confirm that it is being enabled. This is what Apache is logging:

ipa: DEBUG: enabled PHA
AH02263: Re-negotiation handshake failed: Client certificate missing

openssl-1.1.1b-5.fc29

@rcritten rcritten mentioned this pull request Jun 6, 2019
Closed
@rcritten
Copy link
Contributor

Am I reproducing this incorrectly?

@tiran tiran force-pushed the tls13_pha branch 2 times, most recently from d8f978e to 67a4ff2 Compare June 27, 2019 07:55
@freeipa-pr-ci freeipa-pr-ci added the needs rebase Pull Request cannot be automatically merged - needs to be rebased label Jul 1, 2019
@tiran tiran added rejected Pull Request has been rejected and removed WIP Work in progress - not ready yet for review ipa-next Mark as master (4.13) only needs rebase Pull Request cannot be automatically merged - needs to be rebased labels Nov 15, 2019
@tiran tiran closed this Nov 15, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
rejected Pull Request has been rejected
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@tiran @abbra @rcritten @freeipa-pr-ci