candlepin/thumbslug — pull request #9 by jbowes (2012-10-23 17:20:02+00:00)
Title: 868290: Verify signature on client and CDN X.509 certificates

We previously were not checking that a client's certificate was signed
by the candlepin we talk to, nor did we verify that the CDN's
certificate was signed by the upstream CA we trust.

This wasn't terrible, the client's entitlement UUID would be checked
against the live candlepin, and RPMs are signed, so the client would
verify them. The worst thing that could have happened was a nefarious
third party acting as the CDN, and serving up stale metadata.

Introduce two new config values, ssl.ca.keystore, and
cdn.ssl.ca.keystore. These are both PEM formatted public certificates.
The first is used to verify client certificates. The second is used to
verify cdn certificates. If SSL is enabled, they _must_ be set and
valid.

Add a document outlining the security measures in place in Thumbslug.

Update test ssl certificates (as they had expired), and add a document
describing how to generate them.