MxOS/ansible-koji
SHA256
Watch
6
0
Fork
You've already forked ansible-koji
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(web): add VirtualHost SSLVerifyClient optional to prevent post-handshake failures

Browse source 
- Add SSLVerifyClient optional and SSLVerifyDepth 10 to the loop configuring ssl.conf in roles/koji_hub/tasks/main.yaml.

- This forces the client certificate request to happen during the initial TLS handshake, bypassing TLS 1.3 Post-Handshake Authentication (PHA) failures.

Co-developed-by: Gemini AI <renich+gemini@woralelandia.com>

Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
This commit is contained in:
Rénich Bon Ćirić 2026-06-16 12:08:42 -06:00
commit 99169ec07e
Signed by: renich
GPG key ID: AB2A9F49384FE324
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
roles/koji_hub/tasks/main.yaml
View file

@ -155,6 +155,8 @@
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateFile", line: "SSLCertificateFile {{ koji_hub_cert_path }}" }
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^SSLCertificateKeyFile", line: "SSLCertificateKeyFile {{ koji_hub_key_path }}" }
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" } - { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLCACertificateFile", line: "SSLCACertificateFile {{ koji_remote_ca_trust_path }}" }
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyClient", line: "SSLVerifyClient optional" }
- { path: "{{ koji_hub_httpd_ssl_config_file }}", regexp: "^#?SSLVerifyDepth", line: "SSLVerifyDepth 10" }
notify: Restart httpd notify: Restart httpd
- name: Enable SSL for Koji Hub - name: Enable SSL for Koji Hub