IR-0010: LDAPS 1024-bit SSL Certificate Login Lockout - Ziraat Teknoloji¶
- Status: Resolved (mitigated via rollback; permanent fix pending customer certificate upgrade)
- Date: 2025-10-01
- Severity: SEV-1 - Critical
- Duration: ~4 hours (09:00 to 13:00, 2025-10-01)
- Affected: Ziraat Teknoloji (Self-Hosted, upgrade v3.29.0 -> v3.29.3) - authentication
- Owners: @halit
Summary¶
After upgrading from v3.29.0 to v3.29.3 in production, Ziraat Teknoloji experienced a complete login failure. Both LDAP-based users and the admin account were locked out. The cause was an incompatibility between the new version's stricter SSL/TLS policy and the customer's legacy 1024-bit LDAP server SSL certificate.
Timeline¶
All times UTC+3 (Istanbul).
| Time | Date | Event |
|---|---|---|
| 09:00 | Oct 1, 2025 | Customer upgrades production to v3.29.3. |
| 09:10 | Oct 1, 2025 | Users report inability to log in. |
| 09:30 | Oct 1, 2025 | Admin account login also fails. |
| 09:51 | Oct 1, 2025 | Support Ticket #806 opened. |
| 11:00 | Oct 1, 2025 | Joint troubleshooting session via Slack. |
| 11:45 | Oct 1, 2025 | Root cause identified: LDAP SSL certificate is RSA 1024-bit, rejected by new policy. |
| 12:10 | Oct 1, 2025 | Customer advised to roll back to v3.29.0. |
| 13:00 | Oct 1, 2025 | System restored after rollback. |
| 15:30 | Oct 1, 2025 | SSL enforcement change confirmed as intended (Halit). |
Root Cause¶
The customer's LDAP server used an outdated 1024-bit RSA SSL certificate. Appcircle v3.29.3 enforces stricter SSL/TLS standards (associated with the Keycloak upgrade and the Java 11 -> 21 transition) and rejects certificates below current encryption strength, so LDAPS connections failed at the SSL handshake. The failure was silent at the handshake level and also blocked admin login, since internal authentication respects the same SSL enforcement. Note: v3.29.0 ran on Java 17, which also does not support 1024-bit RSA yet worked for the customer - the exact behavioral difference was still under analysis (BE-7256).
Impact¶
- Customers affected: Ziraat Teknoloji (self-hosted)
- Services degraded: Full authentication lockout - Dashboard, Testing Distribution, Enterprise Store; CI/CD and distribution halted
- Data loss: No (rollback from backup)
Resolution¶
- Immediate mitigation: customer rolled back to v3.29.0 from their latest backup, restoring access.
- Permanent resolution: customer to upgrade the LDAP server SSL certificate to meet v3.29.3 encryption requirements, then re-attempt the upgrade.
Action Items¶
| # | Action | Owner | Due Date | Status |
|---|---|---|---|---|
| 1 | Upgrade LDAP server SSL certificate to current standards | Ziraat Teknoloji | Pending | |
| 2 | Document SSL/encryption requirements explicitly in release notes and upgrade guide | Appcircle | Pending | |
| 3 | Evaluate an admin-access fallback path when LDAPS handshake fails | Backend | Pending | |
| 4 | Assess feasibility of optional SSL verification toggle (feature request) | Backend | Pending |
Links¶
- Linear issue(s): BE-7255, BE-7256
- Support ticket: Zendesk #806