Un-mucking Quickstart

[ekoby]

This is proposal and discussion on how to bring older quickstart environments in line with proper CA bundle setup
see #1121

Proposal:

1. modify software -- these changes are independent and could be done in parallel
   • ziti controller: check proper CA bundle setup at startup, do not start if there is no path from controller cert to a root included in the bundle (same for router router certts -- there should be a chain of trust from issuer to a root in the bundle). Output the subject name of root CA that is missing.
   • SDKs - modify SDK to issue an event if CA bundle change is detected -- SDK can get CA bundle (/.well-known/est/cacerts) on startup and compare against current config. This solution is similar to the controller address change event. The application using SDK will modify the stored configuration
     These changes are useful even in absence of quickstart issues.
2. when user upgrades controller they will need to modify their configuration
3. updated client software (ziti-edge-tunnel) will update the stored identity file

[qrkourier]

Is the observed problem that C-SDK edge clients using libssl fail to verify the presented router server cert partial chains during TLS negotiation? If so, is it because libssl requires trust anchors to be self-signed (root) and MBed-TLS does not?

[ekoby]

focusing on C-sdk clients muddies the water. Any software using OpenSSL (including openssl s_client) wasn't be able to connect with CA bundle provided by controller

[ekoby]

but that's correct OpenSSL requires roots to be present in the CA bundle

[qrkourier]

OK, trying again to accurately summarize the observed problem.

Edge clients using the OpenSSL library fail to verify presented router server cert partial chains during TLS negotiation because, when enrolled, the controller's CA bundle contained a trust anchor for the server cert partial chain that is an intermediate, not self-signed (root). OpenSSL requires the full chain, so the bundle must contain the root CA, whereas MBed-TLS does not distinguish between intermediate and self-signed trust anchors.

[qrkourier]

Does that match your understanding of the observed problem, @ekoby?

[ekoby]

ziti C sdk issue: openziti/ziti-sdk-c#545