Repository navigation
Certificate chain with AJP; LCR chain validation; Code stuck in one infinite loop on CRLUtils #20468
Unanswered
camilodotto
asked this question in
Q&A
Certificate chain with AJP; LCR chain validation; Code stuck in one infinite loop on CRLUtils
#20468
Replies: 1 comment
|
I belive you catched same bug issue #20725 as me. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
We have keycloak with apache acting as a reverse proxy with AJP.
With this configuration, keycloak only receives the end user client certificate (javax.servlet.request.X509Certificate), not the chain.
So we developed (based on DefaultClientCertificateLookup and NginxProxySslClientCertificateLookup) a client cert lookup that obtain the client from the request and rebuild the chain with the certificates in the Keycloak truststore.
But the code from NginxProxySslClientCertificateLookup does not include the root certificate on the chain.
So, the first question is: should the root certificate be present on the chain? (see question3)
The second question, about CRL validation, is: wouldn't it be necessary to validate all the CRL, of all certificates on the chain? We examined the code and saw that only cert[0] (the end user certificate) is validated.
We did some modifications on the code to validate all the certificates, of all chain, to see if some of them is revoked. But we got another issue: on the first test, we did not include the root certificate on the chain. So, the code got stuck in one infinite loop on method (while(true)) 'findCRLSignatureCertificateInTruststore' of the class 'CRLUtils', because the root certificate is present on the truststore but not in the CA chain.
All reactions