From 6d1de32713dabbb403999f8a0d458d6598fdecb5 Mon Sep 17 00:00:00 2001 From: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com> Date: Fri, 30 Aug 2024 17:36:29 -0500 Subject: [PATCH] Remove APNS certificate validation from server start up (#21728) --- changes/21683-apns-cert-validation-on-start | 2 ++ cmd/fleet/serve.go | 21 +++++---------------- 2 files changed, 7 insertions(+), 16 deletions(-) create mode 100644 changes/21683-apns-cert-validation-on-start diff --git a/changes/21683-apns-cert-validation-on-start b/changes/21683-apns-cert-validation-on-start new file mode 100644 index 0000000000..9f17143599 --- /dev/null +++ b/changes/21683-apns-cert-validation-on-start @@ -0,0 +1,2 @@ +- Removed validation of APNS certificate from server startup. This was no longer necessary because + we now allow for APNS certificates to be renewed in the UI. diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go index 348f20ed42..67ce51f7d0 100644 --- a/cmd/fleet/serve.go +++ b/cmd/fleet/serve.go @@ -22,7 +22,6 @@ import ( "github.com/e-dard/netbug" "github.com/fleetdm/fleet/v4/ee/server/licensing" eeservice "github.com/fleetdm/fleet/v4/ee/server/service" - "github.com/fleetdm/fleet/v4/pkg/certificate" "github.com/fleetdm/fleet/v4/pkg/scripts" "github.com/fleetdm/fleet/v4/server" configpkg "github.com/fleetdm/fleet/v4/server/config" @@ -75,8 +74,10 @@ import ( var allowedURLPrefixRegexp = regexp.MustCompile("^(?:/[a-zA-Z0-9_.~-]+)+$") -const softwareInstallerUploadTimeout = 4 * time.Minute -const liveQueryMemCacheDuration = 1 * time.Second +const ( + softwareInstallerUploadTimeout = 4 * time.Minute + liveQueryMemCacheDuration = 1 * time.Second +) type initializer interface { // Initialize is used to populate a datastore with @@ -510,7 +511,7 @@ the way that the Fleet server works. initFatal(errors.New("inserting APNs and SCEP assets"), "missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key") } - apnsCert, apnsCertPEM, apnsKeyPEM, err := config.MDM.AppleAPNs() + _, apnsCertPEM, apnsKeyPEM, err := config.MDM.AppleAPNs() if err != nil { initFatal(err, "validate Apple APNs certificate and key") } @@ -520,18 +521,6 @@ the way that the Fleet server works. initFatal(err, "validate Apple SCEP certificate and key") } - const ( - apnsConnectionTimeout = 10 * time.Second - apnsConnectionURL = "https://api.sandbox.push.apple.com" - ) - - // check that the Apple APNs certificate is valid to connect to the API - ctx, cancel := context.WithTimeout(context.Background(), apnsConnectionTimeout) - if err := certificate.ValidateClientAuthTLSConnection(ctx, apnsCert, apnsConnectionURL); err != nil { - initFatal(err, "validate authentication with Apple APNs certificate") - } - cancel() - err = ds.InsertMDMConfigAssets(context.Background(), []fleet.MDMConfigAsset{ {Name: fleet.MDMAssetAPNSCert, Value: apnsCertPEM}, {Name: fleet.MDMAssetAPNSKey, Value: apnsKeyPEM},