fix(web): disable TLS 1.3 to support SSL client cert renegotiation without PHA

- Set SSLProtocol to disable TLS 1.3 in ssl.conf on Apache, enabling standard TLS 1.2 client certificate renegotiation.

- Revert the temporary global SSLVerifyClient/Depth optional configuration at VirtualHost level.

- Save DB connection to kojihub.context.cnx in sign spooler.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>

Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>

roles/koji_hub/files/koji-sign-spooler

@@ -125,7 +125,7 @@ def process_queue():
     kojihub.db.setDBopts(**db_opts)
 
     try:
-        kojihub.db.connect()
+        kojihub.context.cnx = kojihub.db.connect()
     except Exception as e:
         logger.error(f"Failed to connect to Koji Hub DB: {e}")
         return

roles/koji_hub/tasks/main.yaml

@@ -155,8 +155,7 @@
     - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" }
     - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" }
     - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" }
-    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyClient", line: "SSLVerifyClient {{ koji_hub_ssl_verify_client }}" }
-    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyDepth", line: "SSLVerifyDepth 10" }
+    - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLProtocol", line: "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.3" }
   notify: Restart httpd
 
 - name: Enable SSL for Koji Hub

vars/default.yaml

@@ -102,11 +102,6 @@ kojid_mock_root: /var/lib/mock/mxos0-build-x86_64
 
 # HTTPD/Web Paths
 koji_hub_httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf
-# WARNING: Set to "require" in production for security. "optional" is used in
-# development/staging to avoid TLS 1.3 Post-Handshake Authentication (PHA)
-# browser errors (like "Cannot perform Post-Handshake Authentication") when
-# logging in to Koji Web (which enforces client certificate validation).
-koji_hub_ssl_verify_client: optional
 koji_cleanup_script_path: /usr/local/bin/koji_cleanup.sh
 koji_cleanup_service_path: /etc/systemd/system/koji-cleanup.service
 koji_cleanup_timer_path: /etc/systemd/system/koji-cleanup.timer