Bug 1731344

Summary:	cert-fix tool do not fixes admin certificate in standalone pki environment
Product:	Red Hat Enterprise Linux 8	Reporter:	shalini <skhandel>
Component:	pki-core	Assignee:	RHCS Maintainers <rhcs-maint>
Status:	CLOSED DUPLICATE	QA Contact:	PKI QE <bugzilla-pkiqe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.1	CC:	pcech
Target Milestone:	rc	Keywords:	Reopened
Target Release:	8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-17 16:21:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description shalini 2019-07-19 07:52:38 UTC

Description of problem:
cert-fix tool do not fixes admin certificate in standalone pki environment.
Detailed problem is described in : https://bugzilla.redhat.com/show_bug.cgi?id=1679480#c12


Version-Release number of selected component (if applicable):
python3-pki-10.7.1-2.module+el8.1.0+3386+52d02a00.noarch
pki-server-10.7.1-2.module+el8.1.0+3386+52d02a00.noarch
pki-base-10.7.1-2.module+el8.1.0+3386+52d02a00.noarch
pki-servlet-4.0-api-9.0.7-16.module+el8.1.0+3366+6dfb954c.noarch
pki-tools-10.7.1-2.module+el8.1.0+3386+52d02a00.x86_64
pki-ca-10.7.1-2.module+el8.1.0+3386+52d02a00.noarch
pki-symkey-10.7.1-2.module+el8.1.0+3386+52d02a00.x86_64
pki-base-java-10.7.1-2.module+el8.1.0+3386+52d02a00.noarch
pki-servlet-engine-9.0.7-16.module+el8.1.0+3366+6dfb954c.noarch

How reproducible:
Always

Steps to Reproduce:
1. LDAP/ CA instance install
2. Expire system certs be changing date 
3. Only signing certificate is not expired
4. Use below command to fix expired certs :

pki-server cert-fix \
--ldapi-socket /var/run/slapd-REALM.socket \
--agent-uid admin \
--cert sslserver \
--cert subsystem \
--cert ca_ocsp_signing \
--cert ca_audit_signing \
--extra-cert 0x6


Detailed test steps :
https://bugzilla.redhat.com/show_bug.cgi?id=1679480#c8
https://bugzilla.redhat.com/show_bug.cgi?id=1679480#c9


Actual results:
The admin cert renewed using pki-server cert-fix command creates a new cert for PKI Administrator, but this certificate does not have permissions to do certificate management operations. Thus it does not work after import in database.
Test observations are mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=1679480#c7


Expected results:
The pki-server cert-fix tool should fix admin and agent certs also. 


Additional info:
Detailed informations can be found on below bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1679480

Comment 3 RHEL Program Management 2021-02-01 07:42:18 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.

Comment 7 Petr Čech 2021-09-17 16:21:08 UTC


*** This bug has been marked as a duplicate of bug 1679480 ***