From 99169ec07e8bf075e897fc0f7fa569a228f01d8f0b5a8208f61102e8a6cab2c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9nich=20Bon=20=C4=86iri=C4=87?= Date: Tue, 16 Jun 2026 12:08:42 -0600 Subject: [PATCH] fix(web): add VirtualHost SSLVerifyClient optional to prevent post-handshake failures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add SSLVerifyClient optional and SSLVerifyDepth 10 to the loop configuring ssl.conf in roles/koji_hub/tasks/main.yaml. - This forces the client certificate request to happen during the initial TLS handshake, bypassing TLS 1.3 Post-Handshake Authentication (PHA) failures. Co-developed-by: Gemini AI Signed-off-by: Rénich Bon Ćirić --- roles/koji_hub/tasks/main.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/koji_hub/tasks/main.yaml b/roles/koji_hub/tasks/main.yaml index 394d46f..2959ad9 100644 --- a/roles/koji_hub/tasks/main.yaml +++ b/roles/koji_hub/tasks/main.yaml @@ -155,6 +155,8 @@ - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" } + - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyClient", line: "SSLVerifyClient optional" } + - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyDepth", line: "SSLVerifyDepth 10" } notify: Restart httpd - name: Enable SSL for Koji Hub