Summary
In order to go forward with adoption of SharedSystemCertificates after this change OpenLDAP clients and server will default to use only the system-wide certificates store.
Owner
- Name: Matus Honek
- Email: mhonek@redhat.com
- Release notes owner:
Current status
- Targeted release: Fedora 28
- Last updated: 2018-01-08
- Tracker bug: <will be assigned by the Wrangler>
Detailed Description
Currently, OpenLDAP defaults to trust CA certificates located in /etc/openldap/certs. In order to comply with SharedSystemCertificates we will remove the default explicit configuration options that point to /etc/openldap/certs. Therefore, OpenLDAP will let its crypto library (OpenSSL) load the default CA certificates as described in the SharedSystemCertificates description. For a convenience, where possible, configuration files will contain a commentary with an explanation of the new behaviour.
Benefit to Fedora
Simplification of trust handling which is also the aim of the SharedSystemCertificates effort.
Scope
- Proposal owners: change of default shipped configuration.
- Other developers: check your application trusts whom you want it to trust
- Release engineering: #Releng issue number (a check of an impact with Release Engineering is needed)
- List of deliverables: N/A (not a System Wide Change)
- Policies and guidelines: None.
- Trademark approval: None. (not needed for this Change).
Upgrade/compatibility impact
There should be no upgrade impact at all as the only updated parts are configuration files which are not overwritten when upgraded, only .rpmnew files should appear accordingly. Therefore, only newly installed packages would ship with the changed default configuration.
How To Test
New installations should by default use what system-wide certificates store use. This means one should be able to make use of CA certificates as before but now they should be by default present in the system certificate store. When CA certificate would be migrated to the system certificate store and no explicit CA certificates location would be configured then TLS connections should behave as before.
User Experience
New installations will use the new default configuration, therefore users should alter their provisioning scripts to make use of system certificate store. Of course, explicitly setting the previous location will work as expected.
Dependencies
None.
Contingency Plan
- Contingency mechanism: Revert configuration changes.
- Contingency deadline: beta freeze.
- Blocks release? No.
- Blocks product? No.
Documentation
Follow the Features/SharedSystemCertificates with OpenSSL specifics. Related bugzilla [bug] discussing the change.
Release Notes
Default configuration does not point to /etc/openldap/certs for CA certificates any more. Instead, OpenLDAP now implicitly uses Shared System Certificates.