On Thu, Jul 18, 2019 at 10:02:00AM +0100, lejeczek via FreeIPA-users wrote:
Is changing the chain (apart from the risk attached to doing
something,
anything, and that something can go wrong) healthy? (security) eg.
Having AD CA as root then changing to another AD, then maybe back to
IPA's own.
many thanks, L.
Hi L,
It depends on your objectives. A common reason to re-chain is to
move to a chain with an offline root or keys in HSM, or because your
old external CA has been or will be decommissioned, and so on.
The risk of something going wrong is... low, if you know what to
check for. Things that FreeIPA checks automatically, before
accepting a new chaining, include:
- key sizes of all CAs in the chain are acceptable
- signing algorithms of every CA in the chain are acceptable
- Basic Constraints: CA: True on every cert in the chain
- Sanity checking the PathLenConstraint
- All certs have Subject Key Identifier
- All certs are valid
Things you might need to check yourself include:
- All non-root certs have Authority Key Identifier matching issuer
Subject Key Identifier
- Subject and Issuer DN string attribute encodings match up, and IPA
CA Subject DN string attribute encodings have not changed. (See
blog posts [1] and [2])
- Name constraints on all certs are appropriate (see blog post [3]).
- Probably lots of other things I haven't thought of
[1]
https://frasertweedale.github.io/blog-redhat/posts/2018-03-15-x509-dn-att...
[2]
https://frasertweedale.github.io/blog-redhat/posts/2019-05-28-a-dn-is-not...
[3]
https://frasertweedale.github.io/blog-redhat/posts/2019-01-29-name-constr...
So... changing the chaining should not be done for its own sake.
If you need to do it, do it. Otherwise, do not :)
Cheers,
Fraser