freeipa

#7027 Use TLS for cert-find
Closed: fixed Opened by cheimes.

Closed: fixed
Reopen Issue

Follow-up ticket for #6966

cert-find has been modified to use HTTP on port 80/TCP instead of 8080/TCP. We should avoid plain HTTP and use HTTPS everywhere. It's not just a matter of privacy protection but also integrity protection. We should consider any network except localhost as untrusted.

There are just a few cases where unprotected communication is necessary or unavoidable: CRL download, OCSP status requests, CA bootstrapping, and AIA chasing. In all but the CA bootstrapping case, integrity is ensured by signatures or similar means.

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.6

Metadata Update from @tkrizek:
- Issue set to the milestone: FreeIPA 4.6.1 (was: FreeIPA 4.6)

Metadata Update from @rcritten:
- Issue assigned to rcritten

PR https://github.com/freeipa/freeipa/pull/1042

Metadata Update from @fbarreto:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1042

master:

  • fa6181293a1bf3207c4da1494d9d6cf9d715377b Use TLS for the cert-find operation

ipa-4-6:

  • 52a18de613458f8cabc81742ddf2e1311d772eb9 Use TLS for the cert-find operation

Metadata Update from @stlaz:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/1042
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.