ConfD job cert_update does not check key/certificate validity
Details
| Detail name | Value |
|---|---|
| Changelog Number | 22566 |
| Type | Bug |
| Status | Resolved |
| Affected Versions | Exasol 8.0.0 |
| Fix Versions | Exasol 8.29.10, Exasol 2025.1.0 |
| Resolution Date | 2025-05-15 |
Description
When calling the ConfD job cert_update with invalid keys and/or certificates, and/or the private key not corresponding to the certificate, there is no error message; cert_update simply installs the invalid keys/certificates, and ConfD starts using them. At this point, connecting to ConfD is no longer possible because every connection attempt results in an internal SSL error like
ConnectionResetError: [Errno 104] Connection reset by peer
In particular, cert_update cannot be called again with a correct key/certificate.
Workaround
With the assistance of Exasol support, the correct key and certificate must be manually copied to target location, then cert_update must be invoked again with the correct key/certificate.
Fix
cert_update will now check key/certificate match and validity, and report an error and abort in case of any problems, before installing the key/certificate. Due to current limitations in the available verification library, the certificate chain (CA root, intermediate CAs and server certificate) can currently only be verified according to WebPKI and CA/B rules - which are not mandated for private PKI. If this verification fails, a warning will be shown and the installation of the keys and certificates will proceed regardless.
