From 60a6827c3c4a0e57fdb67a56ff629e7e6e213efca9db7a53db7cd95481d3f963 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?= Date: Tue, 16 Jun 2026 12:11:08 -0600 Subject: [PATCH] fix(web): make SSLVerifyClient configurable and document staging workaround MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Define koji_hub_ssl_verify_client in vars/default.yaml with a warning comment. - Update roles/koji_hub/tasks/main.yaml to use the new variable. - Helps document why it is optional in dev/staging (avoid TLS 1.3 PHA) and require in production. Co-developed-by: Gemini AI Signed-off-by: Rénich Bon Ćirić --- roles/koji_hub/tasks/main.yaml | 2 +- vars/default.yaml | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml index 2959ad9..70bcd66 100644 --- a/roles/koji_hub/tasks/main.yaml +++ b/roles/koji_hub/tasks/main.yaml @@ -155,7 +155,7 @@ - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" } - - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyClient", line: "SSLVerifyClient optional" } + - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyClient", line: "SSLVerifyClient {{ koji_hub_ssl_verify_client }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyDepth", line: "SSLVerifyDepth 10" } notify: Restart httpd diff --git a/vars/default.yaml b/vars/default.yaml index 7f9e5bb..b040116 100644 --- a/vars/default.yaml +++ b/vars/default.yaml @@ -102,6 +102,11 @@ kojid_mock_root: /var/lib/mock/mxos0-build-x86_64 # HTTPD/Web Paths koji_hub_httpd_ssl_config_file: /etc/httpd/conf.d/ssl.conf +# WARNING: Set to "require" in production for security. "optional" is used in +# development/staging to avoid TLS 1.3 Post-Handshake Authentication (PHA) +# browser errors (like "Cannot perform Post-Handshake Authentication") when +# logging in to Koji Web (which enforces client certificate validation). +koji_hub_ssl_verify_client: optional koji_cleanup_script_path: /usr/local/bin/koji_cleanup.sh koji_cleanup_service_path: /etc/systemd/system/koji-cleanup.service koji_cleanup_timer_path: /etc/systemd/system/koji-cleanup.timer