Bug 1550739

Summary:	Need ECC-specific Enrollment Profiles for standard conformance
Product:	Red Hat Enterprise Linux 7	Reporter:	Christina Fu <cfu>
Component:	pki-core	Assignee:	Christina Fu <cfu>
Status:	CLOSED ERRATA	QA Contact:	Asha Akkiangady <aakkiang>
Severity:	urgent	Docs Contact:	Marc Muehlfeld <mmuehlfe>
Priority:	urgent
Version:	7.6	CC:	akahat, cfu, edewata, mharmsen, msauton
Target Milestone:	rc	Keywords:	TestCaseProvided, ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:	See Doc Text field in BZ#1554726.	Story Points:	---
Clone Of:
Clones:	1554726 1560225 (view as bug list)		Environment:
Last Closed:	2018-10-30 11:05:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1547802, 1554726, 1560225

Description Christina Fu 2018-03-01 23:15:33 UTC

Description of problem:

Currently many of the enrollment profiles are shared between RSA and ECC certificates. As such the keyUsage extension is not conforming.

This task is to add needed ECC-specific enrollment profiles and make needed adjustments to existing ones for standard conformance.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 3 Christina Fu 2018-03-12 22:06:12 UTC

https://review.gerrithub.io/#/c/403217/

https://pagure.io/dogtagpki/issue/2950#comment-498815

Comment 4 Christina Fu 2018-03-12 22:09:19 UTC

Testing procedure:

* For installation, courtesy of Matt:
http://pki.fedoraproject.org/wiki/PKI_10.5_Pkispawn_ECC_Profile_Workaround

* For other profiles, just make sure the new or changed profiles are exercised.  For example, for the CMC profiles (new or changed), just put that into the HttpClient config file under servlet.

Comment 6 Matthew Harmsen 2018-04-05 22:02:13 UTC

commit 995682153e10393dc46f16090c26f28ca1b6cfc6
Author: Christina Fu <cfu>
Date:   Thu Mar 29 09:59:02 2018 -0700

    quick fix on wrong keyType in profile
    
    Change-Id: I0fa90ebb559e0fb8af123191f7bc7cdedbc55d87

Comment 9 Amol K 2018-08-17 06:37:14 UTC

I tested this Bugzilla on version 10.5.9-5.el7.

I'm able to install CA without the workaround After the CMC request I tested it with different profiles with httpClient.

It working as expected.

Verifying this Bugzilla.

Comment 11 errata-xmlrpc 2018-10-30 11:05:27 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3195