[DOC] pemtrustedcas_content

[landon-lengyel]

What do you want to do?

• Request a change to existing documentation
• Add new documentation
• Report a technical problem with the documentation
• Other

Tell us about your request. Provide a summary of the request and all versions that are affected.
The pemtrustedcas_content examples on multiple pages is incorrect, as far as I can tell. I will use OpenID Connect as an example, but this seems to affect anywhere pemtrustedcas_content option is used.

Essentially, the example shows this:

config:
  openid_connect_idp:
    enable_ssl: true
    pemtrustedcas_content: |-
      MIID/jCCAuagAwIBAgIBATANBgkqhkiG9w0BAQUFADCBjzETMBEGCgmSJomT8ixk
      ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
      bGUgQ29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEh
      ...

This example seems to imply that one should remove these lines from the certificate:

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

However in my testing, that is not the case and the security plugin will only work properly with those lines. As such, I believe the example used in the documentation should be:

config:
  openid_connect_idp:
    enable_ssl: true
    pemtrustedcas_content: |-
      -----BEGIN CERTIFICATE-----
      MIID/jCCAuagAwIBAgIBATANBgkqhkiG9w0BAQUFADCBjzETMBEGCgmSJomT8ixk
      ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4YW1wbGUxGTAXBgNVBAoMEEV4YW1w
      bGUgQ29tIEluYy4xITAfBgNVBAsMGEV4YW1wbGUgQ29tIEluYy4gUm9vdCBDQTEh
      ...
      -----END CERTIFICATE-----

I can submit pull request(s) for these changes if this is in fact the case, and my environment isn't behaving differently for some other reason.

What other resources are available? Provide links to related issues, POCs, steps for testing, etc.
Testing should just require adding/removing those lines and testing if authentications are successful. It is possible that this is actually a bug with the OpenID Connect code, and that the example is correct for the other SSO methods. I do not have a test environment setup to confirm that though.

[hdhalter]

Thanks for submitting this issue, @landon-l8 ! It would be great if you could submit the pull request.

@scrawfor99 - Is this something you can verify? Thanks.

[landon-lengyel]

Pull request submitted. I would assume that the private key behaves the same way, but my environment doesn't work to test this very well. Hopefully @scrawfor99 can confirm if I'm correct there.