Bug 1308854
| Summary: | ipa-cacert-manage renew failed with validity out of range | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Marcel Kolaja <mkolaja> |
| Component: | pki-core | Assignee: | Matthew Harmsen <mharmsen> |
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.2 | CC: | arubin, cfu, edewata, enewland, jcholast, ksiddiqu, mharmsen, mkolaja, mkosek, nkinder, nsoman, rcritten, snagar, spoore, xdong |
| Target Milestone: | rc | Keywords: | TestBlocker, ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | pki-core-10.2.5-7.el7_2 | Doc Type: | Bug Fix |
| Doc Text: |
The certificate validity was calculated incorrectly when a daylight saving time change occurred in the validity period. Consequently, the "ipa-cacert-manage renew" command failed with a validity error. With this update, the CA Validity Default has been modified to use Calendar API, which calculates the certificate validity range consistently with the Validity
Constraint and Validity Default. As a result, a CA certificate is successfully renewed in this scenario.
|
Story Points: | --- |
| Clone Of: | 1277691 | Environment: | |
| Last Closed: | 2016-05-12 09:57:13 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1277691, 1310200 | ||
| Bug Blocks: | |||
|
Description
Marcel Kolaja
2016-02-16 09:45:21 UTC
Pushed to DOGTAG_10_2_5_RHEL_BRANCH:
commit 05ee3265165f93b357ed17b47fe3f62f9b67ae8b
Author: Endi S. Dewata <edewata>
Date: Sun Dec 20 21:46:56 2015 +0100
Fixed mismatching certificate validity calculation.
The CAValidityDefault has been modified to use Calendar API to
calculate the certificate validity range to be consistent with
the ValidityConstraint and ValidityDefault.
https://fedorahosted.org/pki/ticket/1682
According to https://bugzilla.redhat.com/show_bug.cgi?id=1277691#c15,verified on pki-ca-10.2.5-7.el7_2 [root@auto-hv-02-guest10 ~]# date +%Y%m%d -s "20151102" 20151102 [root@auto-hv-02-guest10 ~]# ipa-server-install --setup-dns --forwarder=$DNSFORWARD --hostname=$(hostname) -r $RELM -n $DOMAIN -p $ADMINPW -a $ADMINPW -U . . . Setup complete Next steps: 1. You must make sure these network ports are open: TCP Ports: * 80, 443: HTTP/HTTPS * 389, 636: LDAP/LDAPS * 88, 464: kerberos * 53: bind UDP Ports: * 88, 464: kerberos * 53: bind * 123: ntp 2. You can now obtain a kerberos ticket using the command: 'kinit admin' This ticket will allow you to use the IPA tools (e.g., ipa user-add) and the web user interface. Be sure to back up the CA certificates stored in /root/cacert.p12 These files are required to create replicas. The password for these files is the Directory Manager password [root@auto-hv-02-guest10 ~]# pki cert-find | grep "CN=Certificate Authority" -A 8 Subject DN: CN=Certificate Authority,O=TESTRELM.TEST Status: VALID Type: X.509 version 3 Key Algorithm: PKCS #1 RSA with 2048-bit key Not Valid Before: Mon Nov 02 00:02:43 EST 2015 Not Valid After: Fri Nov 02 00:02:43 EDT 2035 Issued On: Mon Nov 02 00:02:43 EST 2015 Issued By: system [root@auto-hv-02-guest10 ~]# db_pw="Secret123" [root@auto-hv-02-guest10 ~]# pki -c $db_pw client-init --force ------------------ Client initialized ------------------ [root@auto-hv-02-guest10 ~]# pki -c $db_pw client-cert-request "cn=Certificate Authority" --profile caCACert ----------------------------- Submitted certificate request ----------------------------- Request ID: 11 Type: enrollment Request Status: pending Operation Result: success Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-1042.html |