Bad SSL Certificate CN causes freeze

[jhg03a]

Observed Behavior:

All traffic ceases to flow through ATS with the addition of an improperly crafted SSL wildcard certificate.

Expected Behavior:

ATS should fail to reload config and report an error

Steps to reproduce:

1. Create a self-signed cert and load it as in steps 4-6
2. Test using either openssl or curl to note that traffic flows and you get an SSL response with the specified cert.
3. Create a wildcard SSL certificate with a CN like CN=DNS:*.subdomain.domain.com and SANs like [DNS:*.subdomain.domain.com, DNS:subdomain.domain.com]
4. Replace cert and key from steps 1-2 on disk
5. Update ssl_multicert.config like ssl_cert_name=edge_subdomain_domain_com_cert.cer ssl_key_name=edge.subdomain.domain.com.key
6. Perform an ATS config reload
7. Use either openssl or curl to try and send traffic

Found in:

trafficserver-7.1.4_rc0

[bryancall]

This is resolved in the current 10.1 release (10.1.2). A malformed certificate is now handled gracefully: cert-load validation fails the entry, and on a config reload the new (invalid) config is discarded and the previous config retained with a load-failure error logged, rather than freezing traffic. The Server Name Indication (SNI) lookup is also constant-time with no recursion, so a bad wildcard name can't hang request processing. Closing as fixed; please reopen with a reproduction if you see a freeze on 10.1.2 or later.