{"action":"opened","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/19878","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/19878/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/19878/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/19878/events","html_url":"https://github.com/openshift/origin/issues/19878","id":327679587,"number":19878,"title":"Invalid certificate created for front-proxy-ca","user":{"login":"lulf","id":19670,"avatar_url":"https://avatars0.githubusercontent.com/u/19670?v=4","gravatar_id":"","url":"https://api.github.com/users/lulf","html_url":"https://github.com/lulf","followers_url":"https://api.github.com/users/lulf/followers","following_url":"https://api.github.com/users/lulf/following{/other_user}","gists_url":"https://api.github.com/users/lulf/gists{/gist_id}","starred_url":"https://api.github.com/users/lulf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lulf/subscriptions","organizations_url":"https://api.github.com/users/lulf/orgs","repos_url":"https://api.github.com/users/lulf/repos","events_url":"https://api.github.com/users/lulf/events{/privacy}","received_events_url":"https://api.github.com/users/lulf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-30T10:59:25Z","updated_at":"2018-05-30T10:59:25Z","closed_at":null,"author_association":"NONE","body":"The certificate generated by 'oc cluster up' in 'front-proxy-ca.crt' is not a valid x509 certificate. This prevents the certificate to be trusted by a x509-compliant implementation, such as Java keystore. This certificate is in turn used in the 'extension-apiserver-authentication' configmap in the field 'requestheader-client-ca-file'. \r\n\r\nAccording to https://tools.ietf.org/html/rfc5280#section-4.1.2.4 \r\n\r\n\"The issuer field MUST contain a non-empty distinguished name (DN).\"\r\n\r\n##### Version\r\n```\r\n$ oc version\r\noc v3.9.0+191fece\r\nkubernetes v1.9.1+a0ce1bc657\r\nfeatures: Basic-Auth GSSAPI Kerberos SPNEGO\r\n```\r\n\r\n##### Steps To Reproduce\r\n1. `oc cluster up`\r\n2. `oc login -u system:admin`\r\n3. `oc get configmap -n kube-system extension-apiserver-authentication -o jsonpath={.data.requestheader-client-ca-file} > ca.crt`\r\n4. `keytool -import -noprompt -file ca.crt -alias firstCA -deststorepass 123456 -keystore truststore.jks`\r\n\r\n##### Current Result\r\n\r\n```\r\nkeytool error: java.lang.Exception: Input not an X.509 certificate\r\n```\r\n\r\n##### Expected Result\r\n\r\n```\r\nCertificate was added to keystore\r\n```\r\n\r\n##### Additional Information\r\n\r\nAfter digging into this issue in the 3.9 source tree, it looks like there are 2 CAs created for the front-proxy.\r\nfront-proxy-ca.crt and frontproxy-ca.crt.\r\n\r\n\r\n"}}
{"actor":{"display_login":"lulf"}}