Bug 1608375
| Summary: | CMC Revocations throws exception with same reqIssuer & certissuer | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Geetika Kapoor <gkapoor> | ||||
| Component: | pki-core | Assignee: | Christina Fu <cfu> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 7.5 | CC: | cfu, gkapoor, mharmsen, msauton | ||||
| Target Milestone: | rc | Keywords: | ZStream | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | pki-core-10.5.9-6.el7 | Doc Type: | No Doc Update | ||||
| Doc Text: |
undefined
|
Story Points: | --- | ||||
| Clone Of: | |||||||
| : | 1612880 (view as bug list) | Environment: | |||||
| Last Closed: | 2018-10-30 11:07:14 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1612880 | ||||||
| Attachments: |
|
||||||
Hi Geetika,
While I could not reproduce your reported issue (it works for me), I suspect there might be encoding differences.
Although I think I can produce a fix for it, I think it would help if you could enlighten me with your setup. For example,
Please make sure you keep the instance/setup for helping out with the investigation and testing the fix.
Could you please attach the following to the bug:
1. The Base 64 encoding of the CA Signing certificate (just the cert. Not pkcs7. Not pretty print)
How you issue the CA signing certificate? Please describe.
2. The Base 64 encoding of the user certificate that is to be revoked (just the cert. Not pkcs7. Not pretty print)
Also, please answer the following questions:
1. Does your CS.cfg contain the following setting?
X500Name.directoryStringEncodingOrder
2. If so, what is the value being set to?
thanks!
Hi Christina, I have attached all the certs and needed inputs. Thanks Created attachment 1472828 [details]
patch to resolve possible encoding mismatch between the actual CA cert and the X500Name gleaned from the CMC revocation request
Hi Geetika,
Thanks for the cert info. There are indeed encoding differences between your root CA, sub CA, and the user cert. Of course there is nothing wrong with that.
Enclosed is a patch that contains the "sure" fix that will ensure that the encoding will always match that of the CA, if the string value matches.
Could you please apply this to the latest DOGTAG_10_5_BRANCH and try it out in your environment so we can be sure that it fixes the issue?
thanks,
Christina
Hi Christina,
Yes the patch works.
Debug logs:
[03/Aug/2018:04:39:50][http-bio-28443-exec-1]: CMCOutputTemplate: processRevokeRequestControl: shared secret revocation: checking issuer DN
[03/Aug/2018:04:39:50][http-bio-28443-exec-1]: Geetika:CN=Company Root CA2,O=Company,C=US
[03/Aug/2018:04:39:50][http-bio-28443-exec-1]: Geetika:CN=Company Root CA2,O=Company,C=US
[03/Aug/2018:04:39:50][http-bio-28443-exec-1]: CMCOutputTemplate: processRevokeRequestControl: certificate issuer DN and revocation request issuer DN match
CMCResponse:
Number of controls is 1
Control #0: CMCStatusInfoV2
OID: {1 3 6 1 5 5 7 7 25}
BodyList: 1
Status: SUCCESS
CMC Full Response.
Agent page:
==========
Certificate:
Data:
Version: v3
Serial Number: 0x4E
Signature Algorithm: SHA384withEC - 1.2.840.10045.4.3.3
Issuer: CN=Company Root CA2,O=Company,C=US
Validity:
Not Before: Tuesday, July 24, 2018 1:29:47 PM EDT America/New_York
Not After: Sunday, January 20, 2019 1:29:47 PM EST America/New_York
Subject: UID=test10,CN=test10,O=example.org
Subject Public Key Info:
Algorithm: RSA - 1.2.840.113549.1.1.1
Hi Christina, if the issuerdn is CN=Company Root CA2,O=Company,C=US but in CMCRequest revocation file we mention CN=Company Root CA2,O=company,C=us it will ignore case and treat them as same? Thanks Geetika (In reply to Geetika Kapoor from comment #8) > Hi Christina, > > if the issuerdn is CN=Company Root CA2,O=Company,C=US but in CMCRequest > revocation file we mention CN=Company Root CA2,O=company,C=us it will ignore > case and treat them as same? > > Thanks > Geetika Yes, in a certificate, case is insignificant in the subjectDN as well as SAN. Thank you for testing this out!!! commit 94f28d4d97b83a8f425ebf0d4522aa48bf3d579d (HEAD -> master, origin/master, origin/HEAD, bug1608375-CMC-Revoke-Issuers-master) Author: Christina Fu <cfu> Date: Thu Aug 2 09:31:50 2018 -0700 Bug1608375 - CMC Revocations throws exception with same reqIssuer & certissuer This patch resolves the possible encoding mismatch between the actual CA cert and the X500Name gleaned from the CMC revocation request. Change-Id: I220f5d656a69c90fa02ba38fa21b069ed7d15a9d Test Env: ======== pki-ca-10.5.9-6.el7.noarch Test Case: ========== Follow the same steps as in https://bugzilla.redhat.com/show_bug.cgi?id=1608375#c7. fix works as expected with no errors. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3195 |
Description of problem: When reqIssuer & certissuer are same in during CMC Revocation, it should work but during testing it is observed that it fails with certificate issuer DN and revocation request issuer DN do not match. For debugging purpose, I added some stdout stataments in code and below is what i see: Code : add print message for reqIssuer and cert issuer // for Shared Secret case, check if issuer DN matches if (reqSecret != null) { CMS.debug(method + "shared secret revocation: checking issuer DN"); CMS.debug("Geetika:" + reqIssuerPrincipal); CMS.debug("Geetika:" + certIssuerPrincipal); if ((reqIssuerPrincipal == null) || ! reqIssuerPrincipal.equals(certIssuerPrincipal)) { msg = " certificate issuer DN and revocation request issuer DN do not match"; CMS.debug(method + msg); Output: [24/Jul/2018:13:14:52][http-bio-28443-exec-2]: CMCOutputTemplate: processRevokeRequestControl: shared secret revocation: checking issuer DN [24/Jul/2018:13:14:52][http-bio-28443-exec-2]: Geetika:CN=Company Root CA2,O=Company,C=US [24/Jul/2018:13:14:52][http-bio-28443-exec-2]: Geetika:CN=Company Root CA2,O=Company,C=US [24/Jul/2018:13:14:52][http-bio-28443-exec-2]: CMCOutputTemplate: processRevokeRequestControl: certificate issuer DN and revocation request issuer DN do not match Version-Release number of selected component (if applicable): rpm -qa pki-ca pki-ca-10.5.1-14.el7_5.noarch How reproducible: always Steps to Reproduce: 1. Create a certificate.Use any mechanism let it be selfsigned(unsigned) or UserSigned. 2. Try to revoke that certificate. 3. Actual results: Seeing error " certificate issuer DN and revocation request issuer DN do not match". Expected results: Ideally, it should work and proceed with revocation. Additional info: