fix(certificates): remove unverified authentik cert fetch into system CA trust #230

2026-07-14T10:08:44Z

claude-bot commented

2026-07-14 10:08:44 +00:00

Fixes #185

Problem

ansible/roles/certificates/tasks/main.yml fetched https://authentik.renner.uno
with validate_certs: false and installed whatever it got back into the
system-wide CA trust store via update-ca-certificates, on every host
provisioned through ansible/plays/common.yml. An on-path or DNS-spoofing
attacker during that fetch could plant an attacker-controlled CA into every
host's trust store — persistent, cluster-wide.

Investigation

Confirmed the vulnerable code is live at origin/master (validate_certs: false,
no checksum, role wired into common.yml for hosts: all:!proxmox_noansible).
Searched the repo for any legitimate trusted-source-of-truth this fetch could
be pinned against (internal CA, checksum, cert-manager issuer) — found none.
Found that authentik.renner.uno is actually a stale hostname: it is not
routed by the current Traefik/cert-manager ingress. The live service
(auth.renner.uno, ldap.renner.uno) already gets a real, publicly-trusted
certificate from Let's Encrypt via cert-manager
(kubernetes/infrastructure/post-crds/clusterissuer.yaml), which the OS
default CA bundle already trusts.
Confirmed nothing else in the repo depends on the installed
/usr/local/share/ca-certificates/authentik.crt file.

Fix

Removed the unverified fetch task and its now-unused handler. No custom CA
needs to be trusted for authentik, so the role is left as an intentional
no-op with a comment explaining why and how to safely add a real internal CA
in the future if one is ever needed (checked-in cert or a channel that is
actually validated -- never an unverified fetch feeding
update-ca-certificates again).

Test plan

git diff reviewed -- task and handler removed, no other references
YAML validated (yq parses the resulting file)
Confirmed via grep no other role/play/template references
authentik.crt or depends on the Update CA Trust handler

Fixes #185 ## Problem `ansible/roles/certificates/tasks/main.yml` fetched `https://authentik.renner.uno` with `validate_certs: false` and installed whatever it got back into the system-wide CA trust store via `update-ca-certificates`, on every host provisioned through `ansible/plays/common.yml`. An on-path or DNS-spoofing attacker during that fetch could plant an attacker-controlled CA into every host's trust store — persistent, cluster-wide. ## Investigation - Confirmed the vulnerable code is live at origin/master (validate_certs: false, no checksum, role wired into common.yml for hosts: all:!proxmox_noansible). - Searched the repo for any legitimate trusted-source-of-truth this fetch could be pinned against (internal CA, checksum, cert-manager issuer) — found none. - Found that authentik.renner.uno is actually a stale hostname: it is not routed by the current Traefik/cert-manager ingress. The live service (auth.renner.uno, ldap.renner.uno) already gets a real, publicly-trusted certificate from Let's Encrypt via cert-manager (kubernetes/infrastructure/post-crds/clusterissuer.yaml), which the OS default CA bundle already trusts. - Confirmed nothing else in the repo depends on the installed /usr/local/share/ca-certificates/authentik.crt file. ## Fix Removed the unverified fetch task and its now-unused handler. No custom CA needs to be trusted for authentik, so the role is left as an intentional no-op with a comment explaining why and how to safely add a real internal CA in the future if one is ever needed (checked-in cert or a channel that is actually validated -- never an unverified fetch feeding update-ca-certificates again). ## Test plan - [x] git diff reviewed -- task and handler removed, no other references - [x] YAML validated (yq parses the resulting file) - [x] Confirmed via grep no other role/play/template references authentik.crt or depends on the Update CA Trust handler

claude-bot added 1 commit 2026-07-14 10:08:44 +00:00

fix(certificates): remove unverified authentik cert fetch into system CA trust e3e8f57838

The certificates role fetched https://authentik.renner.uno with
validate_certs: false and fed whatever it got back into
update-ca-certificates on every Ansible-managed host — an on-path/DNS
attacker during that fetch could plant a rogue CA cluster-wide.

authentik.renner.uno also turned out to be a stale hostname: it isn't
routed by the current Traefik/cert-manager ingress. The live service
(auth.renner.uno) already gets a publicly-trusted Let's Encrypt cert via
cert-manager, which the OS default CA bundle already trusts. Nothing else
in the repo depends on the installed authentik.crt, so removing the task
(and its now-unused handler) closes the hole with no functional loss.

Fixes #185

Co-Authored-By: Claude Bot <claude-bot@renner.uno>

claude-bot referenced this pull request

2026-07-14 10:08:54 +00:00

[security][critical] certificates role installs an unverified cert into system CA trust (MITM to trust anchor) #185

k.renner merged commit 35b96f8a49 into master

2026-07-14 10:53:26 +00:00

k.renner referenced this issue from a commit

2026-07-14 10:53:28 +00:00

Merge pull request 'fix(certificates): remove unverified authentik cert fetch into system CA trust' (#230) from fix/issue-185 into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#230