Support for "-partial_chain" openssl option while verifying client certificate chain against configured CA

[vipingoel]

Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see https://kubernetes.io/docs/tasks/debug-application-cluster/troubleshooting/.):No

What keywords did you search in NGINX Ingress controller issues before filing this one? (If you have found any duplicates, you should instead reply there.):
partial_chain

Is this a BUG REPORT or FEATURE REQUEST? (choose one): FEATURE REQUEST

NGINX Ingress controller version:
Release: 0.24.1
Build: git-ce418168f

Kubernetes version (use kubectl version):
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:11:31Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"13+", GitVersion:"v1.13.8-eks-a977ba", GitCommit:"a977bab148535ec195f12edc8720913c7b943f9c", GitTreeState:"clean", BuildDate:"2019-07-29T20:47:04Z", GoVersion:"go1.11.5", Compiler:"gc", Platform:"linux/amd64"}

Environment:

• Cloud provider or hardware configuration:
• OS (e.g. from /etc/os-release):
• Kernel (e.g. uname -a):
• Install tools:
• Others:

What happened:
Setting auth-tls-secret as one of the CA cert which is not the root is failing with below error:
Client SSL certificate verify error: (2:unable to get issuer certificate) while reading client request headers

What you expected to happen:
I am looking for an option similar to "-partial_chain" in open ssl which should make it work. Let me know if this is already supported?

How to reproduce it (as minimally and precisely as possible):
Create a self signed cert and cert chain as follows:
root <-- a <-- b <-- c <-- d
Set "b" as CA in auth-tls-secret and present client cert with "d" as leaf with "c" as intermediate.

Anything else we need to know:
Above scenario works when I set -partial_chain option in openssl
openssl verify -partial_chain -verify_depth 5 -verbose -CAfile ~/b.crt -untrusted ~/c.crt ~/d.crt

If I remove -partial_chain option than it respond with below error which is same as what nginx-ingress reported:
error 2 at 2 depth lookup:unable to get issuer certificate

[aledbf]

@vipingoel this will possible (verify_depth) in the next feature #4327

[tarunp]

I was wondering is --enable-ssl-chain-completion=false flag for this purpose only? Basically we want to disable complete chain verification and verify only upto the CA which is configured in the ingress irrespective of whether it is rootCA or not.

[aledbf]

I was wondering is --enable-ssl-chain-completion=false flag for this purpose only?

No. Enabling this flag requires an Internet connection, something is not enabled in restricted environments. Also, a complete chain is required for OCSP.

[vipingoel]

this will possible (verify_depth) in the next feature #4327

@aledbf : looking at #4327, it looks like they are for proxy-ssl annotations which is different from what I was looking for.
I am looking for an option similar to -partial_chain in openssl which allows us setting intermediate cert from a chain as a CA cert when we set "nginx.ingress.kubernetes.io/auth-tls-secret" annotation in nginx-ingress rule.

Could you point me to code changes which support this if possible?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.