Bug 1978383

Summary:	[RFE] Include certificate NotBefore date in output of the 'getcert list' command
Product:	Red Hat Enterprise Linux 9	Reporter:	Rob Crittenden <rcritten>
Component:	certmonger	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED NOTABUG	QA Contact:	ipa-qe <ipa-qe>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	9.0	CC:	frenaud, ipa-qe, ksiddiqu, mrhodes, msauton, pcech, rcritten, vvanhaft, wrydberg
Target Milestone:	beta	Keywords:	FutureFeature, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:	1940261	Environment:
Last Closed:	2021-11-16 09:50:40 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1940261
Bug Blocks:

Description Rob Crittenden 2021-07-01 17:00:15 UTC

+++ This bug was initially created as a clone of Bug #1940261 +++

Description of problem:
The 'getcert list' command displays the 'NotAfter' date of tracked certificates, but omits the 'NotBefore' date that indicates when the certificates became valid for use. 
Including the NotBefore date in the command output will be beneficial for administrative and troubleshooting purposes. 

How reproducible:
Always

Steps to Reproduce:
1. Root user runs the 'getcert list' command.

Actual results (example):

Request ID '20200930052944':
	status: MONITORING
	stuck: no
	key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
	CA: dogtag-ipa-ca-renew-agent
	issuer: CN=Certificate Authority,O=IPA.CORP.EXAMPLE.COM
	subject: CN=OCSP Subsystem,O=IPA.CORP.EXAMPLE.COM
	expires: 2021-11-23 18:19:33 UTC
	eku: id-kp-OCSPSigning
	pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
	post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
	track: yes
	auto-renew: yes


Proposed output (example):

Request ID '20200930052944':
	status: MONITORING
	stuck: no
	key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
	CA: dogtag-ipa-ca-renew-agent
	issuer: CN=Certificate Authority,O=IPA.CORP.EXAMPLE.COM
	subject: CN=OCSP Subsystem,O=IPA.CORP.EXAMPLE.COM
        valid from: 2019-11-21 18:19:33 UTC
	expires: 2021-11-23 18:19:33 UTC
	eku: id-kp-OCSPSigning
	pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
	post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
	track: yes
	auto-renew: yes

Comment 1 Rob Crittenden 2021-07-01 17:06:26 UTC

Before cloning I missed that this change, 84d575da7516cae1ee94099317cf0f8fae2c7ea1, is already included in the 0.79.14 rebase, https://bugzilla.redhat.com/show_bug.cgi?id=1969537

Kaleem do you want to keep this BZ open for QE purposes?

Comment 2 Kaleem 2021-11-10 07:22:49 UTC

(In reply to Rob Crittenden from comment #1)
> Before cloning I missed that this change,
> 84d575da7516cae1ee94099317cf0f8fae2c7ea1, is already included in the 0.79.14
> rebase, https://bugzilla.redhat.com/show_bug.cgi?id=1969537
> 
> Kaleem do you want to keep this BZ open for QE purposes?

Rob,

Since change for this already verified in above bug, so we can close this bug with same reasoning.

Comment 3 Rob Crittenden 2021-11-10 15:39:06 UTC

I think verify in this case would just involve ensuring the automated test was successful. I don't think taking a previous release VERIFIED for the current one is generally acceptable. Or we can close this as INVALID as that verification is already going to take place automatically in gating.

Comment 4 Florence Blanc-Renaud 2021-11-16 09:50:40 UTC

As agreed with Rizwan, closing this BZ as invalid since rhel 9.0 already contains the fix (RHEL 9.0 ships certmonger-0.79.14-5.el9 and the fix was included in the rebase to 0.79.14)