Bug 2196889

Summary:	Implement ServerSide KeyGen Password Complexity Checks for pkcs12
Product:	Red Hat Certificate System	Reporter:	Chris Zinda <czinda>
Component:	pki-core	Assignee:	RHCS Maintainers <rhcs-maint>
Status:	NEW ---	QA Contact:	idm-cs-qe-bugs
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	11.1	CC:	dchen
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Chris Zinda 2023-05-10 16:53:14 UTC

Description of problem:
Currently, the Red Hat SSKG via the serverKeygenInputImpl and the pkcs12OutputImpl allow for any password to be used for the generated p12 files.  Would like the ability to have a configurable option to force/enforce password complexity requirements for a user-provided password, or the ability to have a strong password generated and provided to the user upon submission to improve the security of the p12s with strong passwords.


Version-Release number of selected component (if applicable):
RHEL 8.x

How reproducible:
Very

Steps to Reproduce:
1. Configure SSKG - https://access.redhat.com/documentation/en-us/red_hat_certificate_system/9/html/planning_installation_and_deployment_guide/configuration_for_server-side_keygen
2. Test with a password of 1234

Actual results:
Allows pkcs12 to be created with weakened password

Expected results:
Desire a check for password comlpexity

Additional info:

Comment 1 Ding-Yi Chen 2023-05-14 23:48:32 UTC

The bug is related to RHCS, thus product is set to Red Hat Certificate System