From 08882ba0fefd40073c32ca76390c60ffce7509c144b989d3d26009b96526cfd2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?= Date: Tue, 16 Jun 2026 12:15:03 -0600 Subject: [PATCH] fix(web): disable TLS 1.3 to support SSL client cert renegotiation without PHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Set SSLProtocol to disable TLS 1.3 in ssl.conf on Apache, enabling standard TLS 1.2 client certificate renegotiation. - Revert the temporary global SSLVerifyClient/Depth optional configuration at VirtualHost level. - Save DB connection to kojihub.context.cnx in sign spooler. Co-developed-by: Gemini AI Signed-off-by: Rénich Bon Ćirić --- roles/koji_hub/files/koji-sign-spooler | 2 +- roles/koji_hub/tasks/main.yaml | 3 +-- vars/default.yaml | 5 ----- 3 files changed, 2 insertions(+), 8 deletions(-) diff --git a/roles/koji_hub/files/koji-sign-spooler b/roles/koji_hub/files/koji-sign-spooler index 19e58d0..f78f9f2 100644 --- a/roles/koji_hub/files/koji-sign-spooler +++ b/roles/koji_hub/files/koji-sign-spooler @@ -125,7 +125,7 @@ def process_queue(): kojihub.db.setDBopts(**db_opts) try: - kojihub.db.connect() + kojihub.context.cnx = kojihub.db.connect() except Exception as e: logger.error(f"Failed to connect to Koji Hub DB: {e}") return diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml index 70bcd66..99e5282 100644 --- a/roles/koji_hub/tasks/main.yaml +++ b/roles/koji_hub/tasks/main.yaml @@ -155,8 +155,7 @@ - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" } - - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyClient", line: "SSLVerifyClient {{ koji_hub_ssl_verify_client }}" } - - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyDepth", line: "SSLVerifyDepth 10" } + - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLProtocol", line: "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.3" } notify: Restart httpd - name: Enable SSL for Koji Hub diff --git a/vars/default.yaml b/vars/default.yaml index b040116..7f9e5bb 100644 --- a/vars/default.yaml +++ b/vars/default.yaml @@ -102,11 +102,6 @@ kojid_mock_root: /var/lib/mock/mxos0-build-x86_64 # HTTPD/Web Paths koji_hub_httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf -# WARNING: Set to "require" in production for security. "optional" is used in -# development/staging to avoid TLS 1.3 Post-Handshake Authentication (PHA) -# browser errors (like "Cannot perform Post-Handshake Authentication") when -# logging in to Koji Web (which enforces client certificate validation). -koji_hub_ssl_verify_client: optional koji_cleanup_script_path: /usr/local/bin/koji_cleanup.sh koji_cleanup_service_path: /etc/systemd/system/koji-cleanup.service koji_cleanup_timer_path: /etc/systemd/system/koji-cleanup.timer