Bug 43102 – Docker Apps should gain access to the host's CA cert

Bug 43102 - Docker Apps should gain access to the host's CA cert


Summary:	Docker Apps should gain access to the host's CA cert

Status:	RESOLVED WONTFIX

Product:	UCS
Classification:	Unclassified
Component:	App Center
Version:	UCS 4.1
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	App Center maintainers
QA Contact:

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2016-12-02 12:24 CET by Felix Botner
Modified:	2019-01-03 07:18 CET (History)
CC List:	2 users (show)

See Also:	39179
What kind of report is it?:	Feature Request
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Felix Botner

2016-12-02 12:24:08 CET

Like Bug #42016, but for /etc/univention/ssl/ucsCA/CAcert.pem

HostCaCertificateAccess=True


We need this non appbox docker apps (e.g. ldaps/ldap-TLS to the UCS ldap server)

Comment 1 Philipp Hahn

2016-12-03 09:31:31 CET

(In reply to Felix Botner from comment #0)
> Like Bug #42016, but for /etc/univention/ssl/ucsCA/CAcert.pem
> 
> HostCaCertificateAccess=True
> 
> 
> We need this non appbox docker apps (e.g. ldaps/ldap-TLS to the UCS ldap
> server)

Please do it right and fix Bug #39179 instead!

Comment 2 Felix Botner

2016-12-05 10:14:23 CET

(In reply to Philipp Hahn from comment #1)
> (In reply to Felix Botner from comment #0)
> > Like Bug #42016, but for /etc/univention/ssl/ucsCA/CAcert.pem
> > 
> > HostCaCertificateAccess=True
> > 
> > 
> > We need this non appbox docker apps (e.g. ldaps/ldap-TLS to the UCS ldap
> > server)
> 
> Please do it right and fix Bug #39179 instead!

However Bug #39179 is fixed, we can't assume any docker container to be a "host in the domain".
Some docker images may not be based on the appbox UCS image and never will be real hosts in the domain, so we need a way to access the root CA (either */ssl/ucsCA/CAcert.pem or */ca-certificates/ucsCA.crt) from the container.
That is what this bug is about.

Comment 3 Erik Damrose

2017-07-17 12:48:08 CEST

I was just asked by an ISV about this feature, reason was the same as comment 0: ldaps/ldap-TLS to the UCS ldap server

Comment 4 Stefan Gohmann

2019-01-03 07:18:42 CET

This issue has been filled against UCS 4.1. The maintenance with bug and security fixes for UCS 4.1 has ended on 5st of April 2018.

Customers still on UCS 4.1 are encouraged to update to UCS 4.3. Please contact
your partner or Univention for any questions.

If this issue still occurs in newer UCS versions, please use "Clone this bug" or simply reopen the issue. In this case please provide detailed information on how this issue is affecting you.