| Summary: | certutil fails while trying to generate a self signed cert | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | IBM Bug Proxy <bugproxy> | ||||||||
| Component: | nss | Assignee: | Elio Maldonado Batiz <emaldona> | ||||||||
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 6.1 | CC: | amarecek, eparis, hannsj_uhl, rrelyea, sforsber | ||||||||
| Target Milestone: | rc | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | s390x | ||||||||||
| OS: | All | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2013-12-08 09:42:07 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Bug Depends On: | |||||||||||
| Bug Blocks: | 855142 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
IBM Bug Proxy
2011-05-02 11:50:42 UTC
Created attachment 496232 [details]
PKCS#11 trace of teh certutil -S step
Created attachment 496233 [details]
PKCS#11 trace of the certutil -R step
Created attachment 496234 [details]
PKCS#11 trace of the certutil -C step
Since RHEL 6.1 External Beta has begun, and this bug remains unresolved, it has been rejected as it is not proposed as exception or blocker. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. (In reply to comment #0) I haven't been able to reprodice the problem yet because I am having problems with step 3. > 3. modutil -add ock -libfile /usr/local/lib64/opencryptoki/libopencryptoki.so > -mechanisms > "RSA:AES:SHA1:SHA256:SHA512:SSL:TLS:RANDOM" -dbdir ock_db modutil is failing for me here and I'm trying to investigate why. I do have some questions about step 5 and step 7. > 5. certutil -S -h ibmtest -d ock_db -n cacert -s "CN=KlausK Certificate > Authority, O=IBM.COM, C=US" -x -t CTu,CTu,CTu -g 1024 -m 1 -v 48 -2 -1 -5 I notice that you pass "-n cacert" for the nickname here but then on step 7 > 7. certutil -C -h ibmtest -d ock_db -c ibmtest:cacert -i ock_db/tempcertreq -o > ock_db/tempcert.der .... you pass "-c ibmtest:cacert". According to the documentation at http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html that value should be either "the exact nickname or alias of the CA certificate" or "the CA's email address". "ibmtest:cacert: != "cacert" (as used on step 5) nor is it the ca's email address. ------- Comment From hannsj_uhl.com 2013-10-21 12:46 EDT------- fyi .. IBM is not pursuing this bugzilla and therefore this bugzilla can be closed ... |