1349710 – Upgraded CA lacks ca.sslserver.certreq in CS.cfg

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1349710 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg

Summary: Upgraded CA lacks ca.sslserver.certreq in CS.cfg

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	pki-core
Sub Component:
Version:	7.3
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	7.3
Assignee:	RHCS Maintainers
QA Contact:	Asha Akkiangady
Docs Contact:
URL:
Whiteboard:
Depends On:	1258630
Blocks:	1258964 1266634
TreeView+	depends on / blocked

Reported:	2016-06-24 05:17 UTC by Matthew Harmsen
Modified:	2020-10-04 21:11 UTC (History)
CC List:	9 users (show)
Fixed In Version:	pki-core-10.3.3-3.el7
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:	1258630
Environment:
Last Closed:	2016-11-04 05:25:23 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Github	dogtagpki pki issues 2505	0	None	closed	Upgraded CA lacks ca.sslserver.certreq in CS.cfg	2021-02-03 19:36:24 UTC
Red Hat Product Errata	RHBA-2016:2396	0	normal	SHIPPED_LIVE	pki-core bug fix and enhancement update	2016-11-03 13:55:03 UTC

Comment 1 Matthew Harmsen 2016-06-24 05:28:40 UTC

Associated Bugs:

* https://bugzilla.redhat.com/show_bug.cgi?id=1258630 - RHEL 7.2 - pki-core-10.2.5-6.el7 (VERIFIED)
* https://bugzilla.redhat.com/show_bug.cgi?id=1266634 - RHCS 9.0.1 - pki-core-10.2.6-9.el7pki

The reason for the creation of this bug was that the following error was incorrectly reported against the RHCS 9.0.1 bug (RHCS 9.0.1 is based upon PKI version 10.2.6, NOT PKI version 10.3.x!).

That being said, what is being shown below appears to represent a regression between 10.2.5 (RHEL 7.2)/10.2.6 (RHCS 9.0.1) and 10.3.x (RHEL 7.3):

Roshni 2016-06-20 15:44:34 EDT

Using pki-ca-10.3.2-5.el7.noarch

[root@pki1 ~]# pki-server subsystem-cert-find ca
Traceback (most recent call last):
  File "/usr/sbin/pki-server", line 107, in <module>
    cli.execute(sys.argv)
  File "/usr/sbin/pki-server", line 102, in execute
    super(PKIServerCLI, self).execute(args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/server/cli/subsystem.py", line 377, in execute
    results = subsystem.find_system_certs()
AttributeError: 'NoneType' object has no attribute 'find_system_certs'

Status: ON_QA → ASSIGNED
Verified: FailedQA

Comment 3 Matthew Harmsen 2016-06-24 05:39:28 UTC

Upstream ticket:
https://fedorahosted.org/pki/ticket/2385

Comment 4 Matthew Harmsen 2016-06-24 05:41:13 UTC

Per PKI Bug Council of 06/23/2016: 10.3.4

Comment 5 Roshni 2016-06-28 14:04:43 UTC

Seeing the following failure using pki-ca-10.3.3-1.el7.noarch

1. [root@pki1 ~]# pki-server subsystem-cert-find ca -i topology-05-CA --show-all
-----------------
5 entries matched
-----------------
  Cert ID: signing
  Nickname: caSigningCert cert-topology-05-CA CA
  Token: Internal Key Storage Token
  Certificate: MIIDszCCApugAwIBAgIBATANBgkqhkiG9w0BAQsFADBIMSUwIwYDVQQKDBx0b3BvbG9neS0wNV9Gb29iYXJtYXN0ZXIub3JnMR8wHQYDVQQDDBZDQSBTaWduaW5nIENlcnRpZmljYXRlMB4XDTE2MDYyNzE4MjQ1OFoXDTM2MDYyNzE4MjQ1OFowSDElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzEfMB0GA1UEAwwWQ0EgU2lnbmluZyBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL0kaNY/yOTqJE5fZmPDKnj6iytYRYeONATyTOLRrQ4PZ46b6MDmOLSG3gOgSMlxIW/MI5zlQwcOV2lcKvCqZJaqelYofq21HsFpJRW8MLT/rHknK+GrGncaB1/qVBp1qY1myNzL1FMA6EZ6VlKFXTOmIC47JLXJvE9O0W/uTwtDWnEWtB4hrUW2bz6R7r4+n7x9bug5Yo7M2NAa3iJWlZxcTyJz6dvHJXezKYPLWoFLGntHTOQyn9FBsUGemIXwTfe0NS40oznvWAfkMoen5CvbxwPLlV9vNtPxjfPCr8fPATVZ+SPiGfjOtTcJfTec+fOIUN+v5Qa7WknYLfSWDdECAwEAAaOBpzCBpDAfBgNVHSMEGDAWgBQRef2cWPbz3EZtBNXVcblgpeEMXjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQUEXn9nFj289xGbQTV1XG5YKXhDF4wQQYIKwYBBQUHAQEENTAzMDEGCCsGAQUFBzABhiVodHRwOi8vcGtpMS5leGFtcGxlLmNvbToyMDA4MC9jYS9vY3NwMA0GCSqGSIb3DQEBCwUAA4IBAQA1s16fV9x/ptYo98HQUXf+kQBDdbobFYkR+hyaiXMwdWrqdNEE7XmKRoX84+XzqDhxh2VkP22n4io0kSMF5rxq7n7+I5xG/UI6mF9WRUadd1id+ETvUQtT6o/8PS5ZHuLqYKQFwOCnPIdWVGkmDHsQqsNRoW1vkxVnJYb5NccrUmKx8PjOevaZic70Xtqhs8eVAcaJOdFkyS3uWwzfz/n3YKTL4DvIpmJ2ESEZrfszYSdvUI/LUvL+VZVbNiL32r6vmkdFhS4q3j1HPcFKGOD6VgOnKbU26bO93CbSzZgIkaEcJu1jEQzIfUiW/tttt4M/ZeYEAXKDqHBtFK1dDn8H
  Request: MIICvzCCAacCAQAwSDElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzEfMB0GA1UEAwwWQ0EgU2lnbmluZyBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL0kaNY/yOTqJE5fZmPDKnj6iytYRYeONATyTOLRrQ4PZ46b6MDmOLSG3gOgSMlxIW/MI5zlQwcOV2lcKvCqZJaqelYofq21HsFpJRW8MLT/rHknK+GrGncaB1/qVBp1qY1myNzL1FMA6EZ6VlKFXTOmIC47JLXJvE9O0W/uTwtDWnEWtB4hrUW2bz6R7r4+n7x9bug5Yo7M2NAa3iJWlZxcTyJz6dvHJXezKYPLWoFLGntHTOQyn9FBsUGemIXwTfe0NS40oznvWAfkMoen5CvbxwPLlV9vNtPxjfPCr8fPATVZ+SPiGfjOtTcJfTec+fOIUN+v5Qa7WknYLfSWDdECAwEAAaAyMDAGCSqGSIb3DQEJDjEjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwDQYJKoZIhvcNAQELBQADggEBAJlqAQgXIBoDvryOKcvrZP5+jCmToQT6kI1Evmdy81XTqixXctC0cdZaeyCaLCjrQFSVys4obbBo4sfUfkoaZ/AHAASWv1mh+VWvVZoVAd3EyqNy/8vTwfgut/x3K6Qa7rENT8SUd1P9yofJ6gXTTsgVWflbtcLrOECvVN13r4ynUKmr23zYPNvfSjU7jlw65aXA7FdkoRDlWCdh6eX9VZEkhROn4xG4P4ukLW8jQE9C4QXG7+vL8KRoEbvu5j45Lhfc9zaikqJxd7ydEf8cB1xzX/24lIvSYiFPLYTDmxJNCfQDNxqk/UOkVEyJpafTKhwSS77AxHYA0rJ9JGWkUTE=

  Cert ID: ocsp_signing
  Nickname: ocspSigningCert cert-topology-05-CA CA
  Token: Internal Key Storage Token
  Certificate: MIIDnTCCAoWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBIMSUwIwYDVQQKDBx0b3BvbG9neS0wNV9Gb29iYXJtYXN0ZXIub3JnMR8wHQYDVQQDDBZDQSBTaWduaW5nIENlcnRpZmljYXRlMB4XDTE2MDYyNzE4MjUwMFoXDTE4MDYxNzE4MjUwMFowTTElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzEkMCIGA1UEAwwbQ0EgT0NTUCBTaWduaW5nIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtsaElRVBf0usdOpZUSw+YCVrwZf8etn6c0oYMYc+tMG6BCMPvETciHt93yAsb8rzyanhTBtJWM1PRl9aFKuLu2Uca5M89Dy0BQsIeKAJwPSP8JiZPVqGIYTayb7FjePEaX09zhyrNfxtWtGsYUD07se00AqVQ0BvUlvJXc7cmMOHJ++wN/I65bFfSqg0e79m3Gj3HSI4NH/y/DdhzKr3HjSQbEIJkxA/DbNk4lx2n5FewTiC/M8njFZLC2cBMnyl8fvkFoUpJJecEZtZflS8/qfYtFJZ8oRV1urMLkkL00oScOyK/UM0Fvm8iw3AGANf+4PjjAfNOiAyCV3Y4qzvXwIDAQABo4GMMIGJMB8GA1UdIwQYMBaAFBF5/ZxY9vPcRm0E1dVxuWCl4QxeMA4GA1UdDwEB/wQEAwIBxjBBBggrBgEFBQcBAQQ1MDMwMQYIKwYBBQUHMAGGJWh0dHA6Ly9wa2kxLmV4YW1wbGUuY29tOjIwMDgwL2NhL29jc3AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggEBAARPc2zh4PLc8Ken7OBrvUkLK1oYLH+ZN8syzt7ztFBqNe7G6C5diPkr8MKP33GOMpgGDBpxotYtV9OffccUvHitH4oz4ZON8PstJOZcYid2FTEPcY5zNYp1ha4jaWntzKwJiqk8C21yST+848ZiO8GtmyoAvAF7l9ldjh9BskVtQt0u2xRoK4RdjRlcH0G/NSmnqOQy2ag4p3C9orZNd7RrM2MJaszO1oh4QnnektCgyLEJo2HyyiDx1vHeIEz6Fp2Qt5zBWlLvvM/kHZr3s2NpcYm1QsgH3r9lteOqOEH3wJ4fmO1qM3NieSByqCJiG4jDyaim9pr/CWxikaIMhLU=
  Request: MIICkjCCAXoCAQAwTTElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzEkMCIGA1UEAwwbQ0EgT0NTUCBTaWduaW5nIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtsaElRVBf0usdOpZUSw+YCVrwZf8etn6c0oYMYc+tMG6BCMPvETciHt93yAsb8rzyanhTBtJWM1PRl9aFKuLu2Uca5M89Dy0BQsIeKAJwPSP8JiZPVqGIYTayb7FjePEaX09zhyrNfxtWtGsYUD07se00AqVQ0BvUlvJXc7cmMOHJ++wN/I65bFfSqg0e79m3Gj3HSI4NH/y/DdhzKr3HjSQbEIJkxA/DbNk4lx2n5FewTiC/M8njFZLC2cBMnyl8fvkFoUpJJecEZtZflS8/qfYtFJZ8oRV1urMLkkL00oScOyK/UM0Fvm8iw3AGANf+4PjjAfNOiAyCV3Y4qzvXwIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAK/VGcz/daYKICdCIXYwKCNsrKPzevEvUlVvTFw11Yczp8bHHcojFqtjLiLOueGxCUNXmm1OOorMjK3R7Y8E5ixjRIOFZZ7zAAZEJQXqK6T4i7GKAS2w8LcPHajp6YlPPC7JUfNE5zuBr5SpgHue9nyA2mUCYvksf578XHgiZWov6b9a5QOtfdkrMGJxNpAAdTAek0rEYXiphkyYfUzx4RSNDP2L9h0hAwCGrfivEQCzeWwcwMaQfzA2mwinpSwfEFDGx0VWkVuYqfe1R8+YicD6Y+xY/qlzPg2Mp839vcEw/7oehS8MTrMqqlhlkqO6R2SHSgFOl7HJsWZ5w3aqBd8=

  Cert ID: sslserver
  Nickname: Server-Cert cert-topology-05-CA
  Token: Internal Key Storage Token
  Certificate: MIIDkjCCAnqgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBIMSUwIwYDVQQKDBx0b3BvbG9neS0wNV9Gb29iYXJtYXN0ZXIub3JnMR8wHQYDVQQDDBZDQSBTaWduaW5nIENlcnRpZmljYXRlMB4XDTE2MDYyNzE4MjUwMFoXDTE4MDYxNzE4MjUwMFowQjElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzEZMBcGA1UEAwwQcGtpMS5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOmAtNU1VjjWCQlgBiFlAUNIFhbhaAQ0fhYPbxZqPp9w2OxjNs5VwB1SQFoAN9g5xun4t9ccpTHj4tcfOEI8iqRnIvVcamAXI/04JyI93A5VBbppRK+kWjzoBEm7NF5DjjKhFMqFyrULEKSW8Q07Dnv6Tqytug038LD2wAaqw1C96Wlx7aWZFqGxRfdyEwNXsN0KSBFPHCLHc0rbIW3YCukl5RBWW8rhsb3KerfusoMu3/YOjfTpnpxOW/hg/qBrSsVrWLbCTqeIOF9PEAjbeOGLg8wYp051FhOkdDt07SX+EDDfeNCkJ2BwbNi4CYjt9bjglWGSt8MTBh1l4SRDS1kCAwEAAaOBjDCBiTAfBgNVHSMEGDAWgBQRef2cWPbz3EZtBNXVcblgpeEMXjBBBggrBgEFBQcBAQQ1MDMwMQYIKwYBBQUHMAGGJWh0dHA6Ly9wa2kxLmV4YW1wbGUuY29tOjIwMDgwL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4IBAQBOVovM8tiXKN4dG1k25Sbt3xKGEjeZTAYyVH/QCYxPzOwW1NhW/M+51+nAgzOkgThuNPzSo2+EPVGmpG8R2yvAlYU0j66TbrZLzjSCUokJsAaQ8ccXuL1oL3TZubeQz2TAO8cYwu8zS9BhSvOYwKTaZPzJRGtj5a/j+uxiUboaGzMZ1bF0I3wzXEdOwpaj5HHhUscktsLCSwVNq9asw2ab6iC4EA/YgMiP1edeyewmIbTVIO1IdnWxzx3C3f9I1GjxbJYVyonkNEFzyQBUZe0GRo4cJsjsDSEzbm+ufl1QIND1+Q9m2nQmtp0wDIfORGtUGU8Y1/ZLKW8StwEOxTmX
  Request: MIIChzCCAW8CAQAwQjElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzEZMBcGA1UEAwwQcGtpMS5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOmAtNU1VjjWCQlgBiFlAUNIFhbhaAQ0fhYPbxZqPp9w2OxjNs5VwB1SQFoAN9g5xun4t9ccpTHj4tcfOEI8iqRnIvVcamAXI/04JyI93A5VBbppRK+kWjzoBEm7NF5DjjKhFMqFyrULEKSW8Q07Dnv6Tqytug038LD2wAaqw1C96Wlx7aWZFqGxRfdyEwNXsN0KSBFPHCLHc0rbIW3YCukl5RBWW8rhsb3KerfusoMu3/YOjfTpnpxOW/hg/qBrSsVrWLbCTqeIOF9PEAjbeOGLg8wYp051FhOkdDt07SX+EDDfeNCkJ2BwbNi4CYjt9bjglWGSt8MTBh1l4SRDS1kCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQCtw55GFkZohd5jWffElUrP+FH7OgT+PS/sQZSavlKIAwhxFpbaxKxMZT+QOSXfi2WZ4lsxhZ3npW0p5I8ziR0mIEqagLEnVO3RAWPhKThxW5jU82HsuxN0l8u5JjBeHVOADWqRpWcSFkkD5T8ba2/c1N43aCuuNmqgYZ2vwb0eyjPHAt2NCu6ynFFzGOXlJCrQcUKIZAVHcLNY9LZuNfRuITyt/AgiUd3cQGAA1DxlrIS0LHoqsQVd2B5U1q0VVBR2SB8arWqagVLbF5Zltq1Dc7wNbM+zAGbfj34MQs1rnt/XgBOzEOFLu3n7kPCH6EKmXUiRmUpXI0djMUtidcem

  Cert ID: subsystem
  Nickname: subsystemCert cert-topology-05-CA
  Token: Internal Key Storage Token
  Certificate: MIIDoTCCAomgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBIMSUwIwYDVQQKDBx0b3BvbG9neS0wNV9Gb29iYXJtYXN0ZXIub3JnMR8wHQYDVQQDDBZDQSBTaWduaW5nIENlcnRpZmljYXRlMB4XDTE2MDYyNzE4MjUwMFoXDTE4MDYxNzE4MjUwMFowRzElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzEeMBwGA1UEAwwVU3Vic3lzdGVtIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtiFeRslkAPO+cqj926Tj3RrhPfmYC1Ng05sH3THd4Dog/9swa06eAh9h87b+wE8dxOfPKWNhqrG6TawHiJgTguHMrmp+6/+CvoZT5gfT1zd7jbtiFe2XJZeCpD6WId6yi/WrwUM3nEeAM9hJpx0QFp+0bMwnIXS2e6TYyAN2Efoi+6H8jxR5VP9vSjHIYSn67lkj4NaziYEwF6Vy3J2Ai0I3/L+T12+6zE3K12Bav8Ppfm4YJEHVvUhl0eCW6jB9yQ64oU+rJdA1ZDt5b9duWVp3xIrvYf+nVdMYflxljEv4sbwuU6DtPGzF66Sv5qARl7PY4ySsAar4S3avm3iu6wIDAQABo4GWMIGTMB8GA1UdIwQYMBaAFBF5/ZxY9vPcRm0E1dVxuWCl4QxeMEEGCCsGAQUFBwEBBDUwMzAxBggrBgEFBQcwAYYlaHR0cDovL3BraTEuZXhhbXBsZS5jb206MjAwODAvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBPAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQBEHAX82Uio6LWRQS61di46uMiFXJYSyV7PdpP7zOJsvoKAXwAX07MjZ3LKg4apQeZXGJJybevHyjN1TOz7RPm8E4AkFrmxMUm9SKnEma4R0KsSICTk6lN/kfyHvLtd/DY65WWD7VvDrepdWAUjLzTDZ+UClfFKd+hHi5YTTYbJKYhpquI/AYEItX3A7vLObSopkpLeBIiE7Ye/NPWQ2NsfyjzBzIRbyoa2yIUHi2Ea/mcXbSelWVJ/3GelaFIzSJsoAEeKgf5EiJmQj5HtzWCbmN6Tq4MTOfj7XMDaek0ffPs172veRQlq78OSJGxstBBhY7slP7kRHmVaIZkfpFvK
  Request: MIICjDCCAXQCAQAwRzElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzEeMBwGA1UEAwwVU3Vic3lzdGVtIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtiFeRslkAPO+cqj926Tj3RrhPfmYC1Ng05sH3THd4Dog/9swa06eAh9h87b+wE8dxOfPKWNhqrG6TawHiJgTguHMrmp+6/+CvoZT5gfT1zd7jbtiFe2XJZeCpD6WId6yi/WrwUM3nEeAM9hJpx0QFp+0bMwnIXS2e6TYyAN2Efoi+6H8jxR5VP9vSjHIYSn67lkj4NaziYEwF6Vy3J2Ai0I3/L+T12+6zE3K12Bav8Ppfm4YJEHVvUhl0eCW6jB9yQ64oU+rJdA1ZDt5b9duWVp3xIrvYf+nVdMYflxljEv4sbwuU6DtPGzF66Sv5qARl7PY4ySsAar4S3avm3iu6wIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAHLrUWk/GH0mSShRnhPNclaTM0m0OzJl6X59oaX8XnqrCjiG8RWiXBUHL6QY08QoU+zkWRKUO0boqb67nDWbncJCiZt4pfgqsF4B5PV3g9FKt4dJuQEAQL6mfFFz8hCYW0YKj9KgjYDhQVBUmELUNUUx/WvWmAVG3tiC27SFpPEMS7uQRfFUkl+zxovDAts0nIzpm91M4q8/7REJLnrA4iwmOWQTa6EI7Q9fQthwh5rtRu5DZvKI6Kum/n6gxv767E9SMTKRlN/g8N23z7J3qSAAHrQvivAeSh5+5XD2qL0bcQrQg4NCb9+/KXglodXXzdXY8PsWcCr6UAgClmFJS74=

  Cert ID: audit_signing
  Nickname: auditSigningCert cert-topology-05-CA CA
  Token: Internal Key Storage Token
  Certificate: MIIDhzCCAm+gAwIBAgIBBTANBgkqhkiG9w0BAQsFADBIMSUwIwYDVQQKDBx0b3BvbG9neS0wNV9Gb29iYXJtYXN0ZXIub3JnMR8wHQYDVQQDDBZDQSBTaWduaW5nIENlcnRpZmljYXRlMB4XDTE2MDYyNzE4MjUwMloXDTE4MDYxNzE4MjUwMlowTjElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzElMCMGA1UEAwwcQ0EgQXVkaXQgU2lnbmluZyBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALlr6IyvzjmFUUXH4ofITlbg1I1CTI30Vby+sN6j2VK9RaWVMSkHlCIrWoApdp2p5e3AKQzl9Wk2/yIwuOb153NdiOe1outZbDUOm25EL6fvSP4Li/uagzp9TrndN/LvBiR2WGtpjDdreisNuGTWRlHW98aIcOwJ5AONj81Hq+TSIBEYQ35syi2C2JhqmYsUKw8+kwSiBqWhWgTevijpJCQCbjN48ymLFp9zreSJPloHa+iCfLikz7qx8mW0a3dsiVi4sZp/ARzeZf2erGwXQaa3P5sMBMeF/6gv/Q6W1JRkEpPgDcl6NvsbWUjGP0dfewx01SlzUfP54DlZGhrtojECAwEAAaN2MHQwHwYDVR0jBBgwFoAUEXn9nFj289xGbQTV1XG5YKXhDF4wDgYDVR0PAQH/BAQDAgbAMEEGCCsGAQUFBwEBBDUwMzAxBggrBgEFBQcwAYYlaHR0cDovL3BraTEuZXhhbXBsZS5jb206MjAwODAvY2Evb2NzcDANBgkqhkiG9w0BAQsFAAOCAQEAeA7/aJzuhpn8qo90RFeb5GgsCI1y20u0Op3rcIqK1xrrkC8dW2zcn3yf/9uMePIS/0ABZFOMWcGiGBBLBebHmxiLWI9dvJ2j33hzdxZw2HAlmKALOSu1wcrKBeZdXFzMnqpBwjOc4ldczsLrxUFkoqO1BNzGni2uvABXtPFbSeF1lq30g/pFfCSNakJVdMzR1ztVGHo5f6hqckEbDHQ0mCge7gfBi3jHqcz4A8pmmTEi23t1wtvZrNQEDTly/M97GPBss12Ol9okKGFfFHTnDw8L+jM/fzGGcVbvkJuuOKUjTo7yedB8L4K4N3Kl6AInGoInHn8lOHTW2JAylW8E/Q==
  Request: MIICkzCCAXsCAQAwTjElMCMGA1UECgwcdG9wb2xvZ3ktMDVfRm9vYmFybWFzdGVyLm9yZzElMCMGA1UEAwwcQ0EgQXVkaXQgU2lnbmluZyBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALlr6IyvzjmFUUXH4ofITlbg1I1CTI30Vby+sN6j2VK9RaWVMSkHlCIrWoApdp2p5e3AKQzl9Wk2/yIwuOb153NdiOe1outZbDUOm25EL6fvSP4Li/uagzp9TrndN/LvBiR2WGtpjDdreisNuGTWRlHW98aIcOwJ5AONj81Hq+TSIBEYQ35syi2C2JhqmYsUKw8+kwSiBqWhWgTevijpJCQCbjN48ymLFp9zreSJPloHa+iCfLikz7qx8mW0a3dsiVi4sZp/ARzeZf2erGwXQaa3P5sMBMeF/6gv/Q6W1JRkEpPgDcl6NvsbWUjGP0dfewx01SlzUfP54DlZGhrtojECAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQB3Ik3s5m+AuPVli+lomH/4cH5yHKdxdVbxiI/8lkW+ugFGcox3kAbqQl8MdECcJfyusnfgJaNgsgjI7dob3JsRzObERkjv9kU/cg3D+PuwsHiv8PvwpbPda2iSjJwhHrL30/Y6Gk6Xl4etyVvMMF3h8TvAMAOB7bHwkLz2RgWKNCgOipE6ofJuW5Erpzd56WU6yjNz9BYbYPX7uHtqcI7vC9p0o6EpuKA4SuhOxdZaMzPk1wFFqYcwSh3/kbooLaw0IGnKClu9czfTP37MXVlvJH3qGZELmC8Tcm1ajcYtuOfOfDj4/LxPOULrISzkdLe8kzjp2SpkrJNCA0htJV7b

2. [root@pki1 ~]# systemctl stop pki-tomcatd

3. Deleted the following params from CA's CS.cfg

* ca.audit_signing.cert=<value>
     * ca.audit_signing.certreq=<value>
     * ca.ocsp_signing.cert=<value>
     * ca.ocsp_signing.certreq=<value>
     * ca.signing.cert=<value>
     * ca.signing.certreq=<value>
     * ca.sslserver.cert=<value>
     * ca.sslserver.certreq=<value>
     * ca.subsystem.cert=<value>
     * ca.subsystem.certreq=<value>

4. systemctl start pki-tomcatd

5. [root@pki1 ~]# pki-server subsystem-cert-find ca -i topology-05-CA --show-all
-----------------
5 entries matched
-----------------
  Cert ID: signing
  Nickname: caSigningCert cert-topology-05-CA CA
  Token: Internal Key Storage Token
  Certificate: None
  Request: None

  Cert ID: ocsp_signing
  Nickname: ocspSigningCert cert-topology-05-CA CA
  Token: Internal Key Storage Token
  Certificate: None
  Request: None

  Cert ID: sslserver
  Nickname: Server-Cert cert-topology-05-CA
  Token: Internal Key Storage Token
  Certificate: None
  Request: None

  Cert ID: subsystem
  Nickname: subsystemCert cert-topology-05-CA
  Token: Internal Key Storage Token
  Certificate: None
  Request: None

  Cert ID: audit_signing
  Nickname: auditSigningCert cert-topology-05-CA CA
  Token: Internal Key Storage Token
  Certificate: None
  Request: None

6. [root@pki1 ~]# pki-server subsystem-cert-update -i topology-05-CA ca signing
Traceback (most recent call last):
  File "/usr/sbin/pki-server", line 107, in <module>
    cli.execute(sys.argv)
  File "/usr/sbin/pki-server", line 102, in execute
    super(PKIServerCLI, self).execute(args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/server/cli/subsystem.py", line 700, in execute
    results = ca.find_cert_requests(cert=data)
AttributeError: 'PKISubsystem' object has no attribute 'find_cert_requests'
[root@pki1 ~]# pki-server subsystem-cert-update -i topology-05-CA ca sslserver
Traceback (most recent call last):
  File "/usr/sbin/pki-server", line 107, in <module>
    cli.execute(sys.argv)
  File "/usr/sbin/pki-server", line 102, in execute
    super(PKIServerCLI, self).execute(args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/cli/__init__.py", line 203, in execute
    module.execute(module_args)
  File "/usr/lib/python2.7/site-packages/pki/server/cli/subsystem.py", line 700, in execute
    results = ca.find_cert_requests(cert=data)
AttributeError: 'PKISubsystem' object has no attribute 'find_cert_requests'

Comment 6 Endi Sukma Dewata 2016-07-01 14:37:06 UTC

The pki-server subsystem-cert-update error has been fixed in PKI Ticket #2385.

Comment 8 Sumedh Sidhaye 2016-09-16 07:14:31 UTC

Build used to verify this fix:

[root@pki3 ~]# pki --version
PKI Command-Line Interface 10.3.3-10.el7

Tested with steps mentioned in Comment #12 with SSL connection,client certificate authentication and BasicAuth.

Certs were updated successfully.

Initial certs and certs after updation are identical.

Comment 9 Sumedh Sidhaye 2016-09-16 08:52:35 UTC

Build used for IPA verification:

[root@pki3 ~]# ipa --version
VERSION: 4.4.0, API_VERSION: 2.213

[root@pki3 ~]# pki --version
PKI Command-Line Interface 10.3.3-10.el7

Verification steps:

1. ipa-server-install
2. Verify /etc/pki/pki-tomcat/ca/CS.cfg has the following params:

   * ca.audit_signing.cert=<value>
     * ca.audit_signing.certreq=<value>
     * ca.ocsp_signing.cert=<value>
     * ca.ocsp_signing.certreq=<value>
     * ca.signing.cert=<value>
     * ca.signing.certreq=<value>
     * ca.sslserver.cert=<value>
     * ca.sslserver.certreq=<value>
     * ca.subsystem.cert=<value>
     * ca.subsystem.certreq=<value>

3. successfully executed the steps explained in comment #12
4. ipa-kra-install was successful

[root@pki3 ~]# vimdiff /etc/pki/pki-tomcat/ca/CS.cfg test_1349710/ipa_verif/CS.cfg.orig 
2 files to edit
[root@pki3 ~]# ipa-kra-install
Directory Manager password: 


===================================================================
This program will setup Dogtag KRA for the IPA Server.


Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes 6 seconds
  [1/8]: configuring KRA instance
  [2/8]: create KRA agent
  [3/8]: restarting KRA
  [4/8]: configure certmonger for renewals
  [5/8]: configure certificate renewals
  [6/8]: configure HTTP to proxy connections
  [7/8]: add vault container
  [8/8]: apply LDAP updates
Done configuring KRA server (pki-tomcatd).
Restarting the directory server
The ipa-kra-install command was successful


Since both PKI and IPA side results show what is expected marking this bug as verified.

Comment 11 errata-xmlrpc 2016-11-04 05:25:23 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2396.html

Note You need to log in before you can comment on or make changes to this bug.