Generate TLS certificates with validity time in the past

Otherwise a slight clock skew may prevent them from working, see
e.g. https://bugzilla.redhat.com/show_bug.cgi?id=1906448.

Change-Id: Icea103af06edef16c0dc4578877dc04cd6ec3b0c
(cherry picked from commit 557293ca6a)

ironic_python_agent/config.py

@@ -72,6 +72,11 @@ cli_opts = [
                      'is False and ironic API version indicates support for '
                      'automatic agent TLS.'),
 
+    cfg.IntOpt('auto_tls_allowed_clock_skew',
+               default=3600, min=0,
+               help='Clock skew (in seconds) allowed in the generated TLS '
+                    'certificate.'),
+
     cfg.StrOpt('advertise_host',
                default=APARAMS.get('ipa-advertise-host', None),
                help='The host to tell Ironic to reply and send '

ironic_python_agent/tests/unit/test_tls_utils.py

@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import datetime
 import ipaddress
 import os
 import tempfile
@@ -36,6 +37,7 @@ class GenerateTestCase(ironic_agent_base.IronicAgentTest):
         result = tls_utils._generate_tls_certificate(self.crt_file,
                                                      self.key_file,
                                                      'localhost', '127.0.0.1')
+        now = datetime.datetime.utcnow()
         self.assertTrue(result.startswith("-----BEGIN CERTIFICATE-----\n"),
                         result)
         self.assertTrue(result.endswith("\n-----END CERTIFICATE-----\n"),
@@ -48,6 +50,11 @@ class GenerateTestCase(ironic_agent_base.IronicAgentTest):
                                               backends.default_backend())
         self.assertEqual([(x509.NameOID.COMMON_NAME, 'localhost')],
                          [(item.oid, item.value) for item in cert.subject])
+        # Sanity check for validity range
+        self.assertLess(cert.not_valid_before,
+                        now - datetime.timedelta(seconds=1800))
+        self.assertGreater(cert.not_valid_after,
+                           now + datetime.timedelta(seconds=1800))
         subject_alt_name = cert.extensions.get_extension_for_oid(
             x509.ExtensionOID.SUBJECT_ALTERNATIVE_NAME)
         self.assertTrue(subject_alt_name.critical)

ironic_python_agent/tls_utils.py

@@ -22,10 +22,16 @@ from cryptography.hazmat.primitives.asymmetric import ec
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives import serialization
 from cryptography import x509
+from oslo_log import log
 
+from ironic_python_agent import config
 from ironic_python_agent import netutils
 
 
+LOG = log.getLogger()
+CONF = config.CONF
+
+
 def _create_private_key(output):
     """Create a new private key and write it to a file.
 
@@ -70,19 +76,25 @@ def _generate_tls_certificate(output, private_key_output,
         x509.NameAttribute(x509.NameOID.COMMON_NAME, common_name),
     ])
     alt_name = x509.SubjectAlternativeName([x509.IPAddress(ip_address)])
+    allowed_clock_skew = CONF.auto_tls_allowed_clock_skew
+    not_valid_before = (datetime.datetime.utcnow()
+                        - datetime.timedelta(seconds=allowed_clock_skew))
+    not_valid_after = (datetime.datetime.utcnow()
+                       + datetime.timedelta(days=valid_for_days))
     cert = (x509.CertificateBuilder()
             .subject_name(subject)
             .issuer_name(subject)
             .public_key(private_key.public_key())
             .serial_number(x509.random_serial_number())
-            .not_valid_before(datetime.datetime.utcnow())
-            .not_valid_after(datetime.datetime.utcnow()
-                             + datetime.timedelta(days=valid_for_days))
+            .not_valid_before(not_valid_before)
+            .not_valid_after(not_valid_after)
             .add_extension(alt_name, critical=True)
             .sign(private_key, hashes.SHA256(), backends.default_backend()))
     pub_bytes = cert.public_bytes(serialization.Encoding.PEM)
     with open(output, "wb") as f:
         f.write(pub_bytes)
+    LOG.info('Generated TLS certificate for IP address %s valid from %s '
+             'to %s', ip_address, not_valid_before, not_valid_after)
     return pub_bytes.decode('utf-8')
 
 

releasenotes/notes/clock-skew-1fbf542b193cec17.yaml

@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Automatically generated TLS certificates now have their validity starting
+    in the past (1 hour by default) to allow for clock skew.