Icinga2 CA isn’t RFC5280 compliant

Hi there,

During a recent upgrade of a client that sends requests to the icinga2 API using python’s urllib3, we noticed some weird TLS validation errors.

Upon further investigation, we figured out, that urllib3 introduced stricter TLS validation (see create_urllib3_context() should set ssl.VERIFY_X509_PARTIAL_CHAIN and ssl.VERIFY_X509_STRICT · Issue #3571 · urllib3/urllib3 · GitHub).

And after digging a bit deeper, we noticed that the default icinga2 CA isn’t compliant to RFC5280.
The CA, which was generated with icinga2 api setup, has no subject key identifier and no authority key identifier in the CA and the certificate that was signed by that CA is missing the AKI as well.

RFC5280 (4.2.1.2 - Subject Key Identifier) states:

To facilitate certification path construction, this extension MUST appear in all conforming CA certificates, that is, all certificates including the basic constraints extension (Section 4.2.1.9) where the value of cA is TRUE.

If you check the icinga2 certificate using openssl x509 -text -noout -in /var/lib/icinga2/ca/ca.crt, you can see that CA:TRUE is present but the CA has no SKI.

Given that “Own CA for Icinga Cluster/API communication?” strongly suggests that people don’t bring their own CA, the CA generated by Icinga2 should be fully compliant to RFC5280.

Please let me know what you think about this.

Icinga2 version:

icinga2 - The Icinga 2 network monitoring daemon (version: r2.14.6-1)

Copyright (c) 2012-2025 Icinga GmbH (https://icinga.com/)
License GPLv2+: GNU GPL version 2 or later <https://gnu.org/licenses/gpl2.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

System information:
  Platform: Debian GNU/Linux
  Platform version: 12 (bookworm)
  Kernel: Linux
  Kernel version: 6.1.0-37-cloud-amd64
  Architecture: x86_64

Build information:
  Compiler: GNU 12.2.0
  Build host: runner-hh8q3bz2-project-575-concurrent-0
  OpenSSL version: OpenSSL 3.0.16 11 Feb 2025

Application information:

General paths:
  Config directory: /etc/icinga2
  Data directory: /var/lib/icinga2
  Log directory: /var/log/icinga2
  Cache directory: /var/cache/icinga2
  Spool directory: /var/spool/icinga2
  Run directory: /run/icinga2

Old paths (deprecated):
  Installation root: /usr
  Sysconf directory: /etc
  Run directory (base): /run
  Local state directory: /var

Internal paths:
  Package data directory: /usr/share/icinga2
  State path: /var/lib/icinga2/icinga2.state
  Modified attributes path: /var/lib/icinga2/modified-attributes.conf
  Objects path: /var/cache/icinga2/icinga2.debug
  Vars path: /var/cache/icinga2/icinga2.vars
  PID path: /run/icinga2/icinga2.pid

Start by tracing the certificate generation performed by icinga2 api setup, then inspect the generated /var/lib/icinga2/ca/ca.crt and signed certificate with openssl x509 -text -noout. The work is done when the generated CA and issued certificate contain the required SKI and AKI extensions and pass the stricter RFC5280 TLS validation described in the report.