Can you explain a little how Candlepin generates certificates for clients? Does it have a self-signed CA certificate that it uses to sign these client certs? Would it be possible (albeit inconvenient) to use 3rd part signed certs for these client certs?

On Mon, Feb 15, 2016 at 2:52 PM, Alex Wood <awood@redhat.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> To answer your question about Tomcat and the null certificate, you
> are correct in suspecting that Candlepin does it's own certificate
> validation after Tomcat.  We do this to allow multiple forms of
> authentication and we also need some information out of the
> certificate (namely the CN).

Having looked at the code, let me amend that a little.  If a client
cert is provided, Tomcat will verify that it is signed by the CA
listed in the Tomcat connector's truststore.  If so (or if no cert is
provided), the request moves to Candlepin.  Candlepin will examine the
request and perform its own authentication steps.  In the case of
client certificate authentication, Candlepin introspects the
certificate and grabs the CN so we know exactly who we are talking to.
- --------------
Regards,
Alex
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJWwjqEAAoJECmNHVSZd5sYAdkQAMPfwS9NfuZ1CTdfSkkXA3O4
7xtzf+S4NR7vniUggyNeXkyCzQ9Jk/GEGnB5RuXq4DhskLK2Mx19v97+G2uQwktu
YKiY2hgmIFdav4brIY7IZMX2PoP4+JFDhLmp7Baducd1kRNfSbvGPESz9TYfc7wZ
FWZ6UdAthRo0C22EZVqEGYLJHdvH6p1Fie8WlvxTJSCmGbXqNQqVcoq+UCrTaKgk
tzuqNEn2A7MTAREuqkZ66dXK75ab+cvPXTZ3rwbnnr1NBzzUf00bjsi6frGClHku
2Vp28RS1G/Nd4Fgi+oHeJK/bWRduwD4I1xuEg5XDW2ewcwPODHLUUyXM2XKnOpbP
+lsAhrYGjFYHmCxRDIBqYi0XV5vSJmW/VrWjNOo8Dx2c2IceUnxOLId6EwpjbfIK
s4khRES3MZQkmIIBNvK8lU4zJttC2bVK0iQKpvDy83pm8NlvotF2fv8mNWXmLPaV
G6nUN7ryIy51qK3wxaunzG23jgPXNZSPzX++HnJl9BDlKtlqoffvoMnX1k4QOwaf
qOFusn+sOzQ3ETqwyaDy258mHzo+bZjcxxPIz/0bu5DzpulyPshg54cr9lpk1Wiu
cyZWsJFfkibVYaIElyqyXw4MF2mjbrho29WY0uZ3b64YfBFimOS/OxG9veKTs+g9
9mr9MXHqF1I4EgCvWH0n
=R/tw
-----END PGP SIGNATURE-----
_______________________________________________