RHBA-2010:0169 - Bug Fix Advisory

Topic

Updated pki-ca, pki-common, redhat-pki-ca-ui, pki-setup, and pki-selinux
packages are now available for Red Hat Certificate System 8.0.

Description

Red Hat Certificate System (RHCS) is an enterprise software system
designed to manage enterprise public key infrastructure (PKI) deployments.

The NSS packages released as RHSA-2010:0165 address a session renegotiation
flaw in the TLS/SSL protocols (CVE-2009-3555) by implementing the TLS
Renegotiation Indication Extension, as defined in RFC 5746. With these
updated packages installed, session renegotiations will fail unless both
the client and server have been updated to implement the new protocol
extension.

This affects the CA subsystem end-entity pages. Server-initiated session
renegotiation occurs when a user connects to the end-entity pages (which
do not require client authentication) and requests an enrollment profile
that requires client authentication. Unless the client (such as a web
browser) has been updated to use the new protocol, the session
renegotiation will fail, and the enrollment request will fail.

To prevent this failure, the updated Certificate System packages introduce
a new port that always requires client authentication and that would be
used for end-entity operations. When the user submits data for an
enrollment profile that requires client authentication, the enrollment will
be directed to this new port, thus eliminating the need for
server-initiated
TLS session renegotiation. (BZ#545935)

Note: This scenario does not affect communication between Certificate
System subsystems, as long as all the Certificate System subsystems are
updated with the new NSS packages.

In addition, some profiles which are used internally by the installation
wizard to create system certificates were incorrectly set to be visible on
the end-entity pages. This has been corrected.

The changes in this errata will be applied to all new Certificate System
8.0 CA instances created. For existing instances, required reconfiguration
steps have been detailed in this Red Hat Knowledgebase article:

http://kbase.redhat.com/faq/docs/DOC-28439

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Certificate System 8 x86_64
• Red Hat Certificate System 8 i386

Fixes

CVEs

(none)

References

• http://kbase.redhat.com/faq/docs/DOC-28439