From 96ea7cefc81e184acebfd508ef83f510ddf26e02 Mon Sep 17 00:00:00 2001
From: Arif Badar <arif.dev@pm.me>
Date: Jun 06 2025 10:21:26 +0000
Subject: [PATCH 1/2] Improve OpenSSL config for RFC 5280 compliance (Python 3.13)


- Added critical keyUsage and extendedKeyUsage fields for client/server auth.
- Marked basicConstraints and keyUsage critical in v3_ca profile.
- Added v3_req profile with proper constraints and SAN support.
- Defined alt_names section using $ENV::DNS_NAME for SAN.

---

diff --git a/docs/source/server_howto.rst b/docs/source/server_howto.rst
index be8a6bd..15f9d1e 100644
--- a/docs/source/server_howto.rst
+++ b/docs/source/server_howto.rst
@@ -165,11 +165,25 @@ koji components.
     nsComment                       = "OpenSSL Generated Certificate"
     subjectKeyIdentifier            = hash
     authorityKeyIdentifier          = keyid,issuer:always
+    keyUsage                        = critical, digitalSignature, keyEncipherment
+    extendedKeyUsage                = clientAuth, serverAuth
+    subjectAltName                  = @alt_names
 
     [v3_ca]
     subjectKeyIdentifier            = hash
     authorityKeyIdentifier          = keyid:always,issuer:always
-    basicConstraints                = CA:true
+    basicConstraints                = critical, CA:true
+    keyUsage                        = critical, digitalSignature, keyCertSign, cRLSign
+    subjectAltName                  = @alt_names
+
+    [v3_req]
+    basicConstraints                = CA:FALSE
+    keyUsage                        = digitalSignature, keyEncipherment
+    extendedKeyUsage                = serverAuth, clientAuth
+    subjectAltName                  = @alt_names
+
+    [alt_names]
+    DNS.1                           = $ENV::DNS_NAME
 
 Although it is not required, it is recommended that you edit the default values
 in the ``[req_distinguished_name]`` section of the configuration to match the
@@ -264,7 +278,11 @@ called ``kojiadmin``.
 
     openssl genrsa -out private/${user}.key 2048
     cat ssl.cnf | sed 's/insert_hostname/'${user}'/'> ssl2.cnf
-    openssl req -config ssl2.cnf -new -nodes -out certs/${user}.csr -key private/${user}.key
+
+    # export variable DNS_NAME for environment substitution in openssl configuration
+    export DNS_NAME=$2
+
+    openssl req -config ssl2.cnf -new -nodes -out certs/${user}.csr -key private/${user}.key -reqexts v3_req
     openssl ca -config ssl2.cnf -keyfile private/${caname}_ca_cert.key -cert ${caname}_ca_cert.crt \
         -out certs/${user}.crt -outdir certs -infiles certs/${user}.csr
     cat certs/${user}.crt private/${user}.key > ${user}.pem

From 6053fdcf5664a3e33ea7d48559198a58e1ddb462 Mon Sep 17 00:00:00 2001
From: Arif Badar <arif.dev@pm.me>
Date: Jun 09 2025 04:09:51 +0000
Subject: [PATCH 2/2] Add firewalld configuration setup


---

diff --git a/docs/source/server_howto.rst b/docs/source/server_howto.rst
index 15f9d1e..0bbf964 100644
--- a/docs/source/server_howto.rst
+++ b/docs/source/server_howto.rst
@@ -853,6 +853,26 @@ allow Apache access to NFS::
 
     root@localhost$ setsebool -P httpd_use_nfs=1
 
+Firewalld Configuration
+^^^^^^^^^^^^^^^^^^^^^^^
+
+To ensure that the Koji web interface and hub can be accessed from other systems,
+the firewall must allow incoming connections on ports 80 (HTTP) and 443 (HTTPS).
+
+Note: The instructions here assume that you are using RHEL 7 or later,
+where firewalld is the default firewall management service.
+For systems running earlier versions (such as RHEL 6 or CentOS 6), firewall
+configuration must be performed using iptables.::
+
+    root@localhost$ firewall-cmd --permanent --zone=public --add-service=http
+    root@localhost$ firewall-cmd --permanent --zone=public --add-port=80/tcp
+
+    root@localhost$ firewall-cmd --permanent --zone=public --add-service=https
+    root@localhost$ firewall-cmd --permanent --zone=public --add-port=443/tcp
+
+    root@localhost$ firewall-cmd --reload
+
+
 Check Your Configuration
 ^^^^^^^^^^^^^^^^^^^^^^^^