JSRPC-PKI: Logging incorrect error messages

[yhabteab]

Describe the bug

When I was messing around with a CRL today, I noticed that icinga logs an incorrect error message namely, even though the certificate was issued by the master, in the logg message states it is not signed by the master.

Master:

[2021-03-15 21:38:43 +0100] information/ApiListener: New client connection for identity 'satellite' from [::ffff:127.0.0.1]:50309 (certificate validation failed: code 23: certificate revoked)
[2021-03-15 21:38:43 +0100] information/JsonRpcConnection: Received certificate request for CN 'satellite' not signed by our CA: certificate revoked (code 23)
[2021-03-15 21:38:43 +0100] information/JsonRpcConnection: Certificate request for CN 'satellite' is pending. Waiting for approval.

I think it is due to the fact that every single exception thrown here is passed off as not being signed by our CA and therefore you might have to verify against the thrown exceptions to log more accurate error messages.

icinga2/lib/remote/jsonrpcconnection-pki.cpp

Lines 62 to 75 in 160d0ea

	try {
	signedByCA = VerifyCertificate(cacert, cert, listener->GetCrlPath());
	if (!signedByCA) {
	logmsg << " not";
	}
	logmsg << " signed by our CA.";
	} catch (const std::exception &ex) {
	logmsg << " not signed by our CA";
	if (const unsigned long *openssl_code = boost::get_error_info<errinfo_openssl_error>(ex)) {
	logmsg << ": " << X509_verify_cert_error_string(long(*openssl_code)) << " (code " << *openssl_code << ")";
	} else {
	logmsg << ".";
	}
	}

[Al2Klimov]

Do you think s/not signed by our CA/not valid/ would be sufficient?

[yhabteab]

Isn't it possible to log an exact error message based on the raised error code? e.g. with a revoked certificate, you can log as certificate no longer trusted but generally not valid is better than not signed by our CA when the certificate is actually signed by the master's CA.