Bug 1375463 - doc update: certtool's manpage does not mention it cannot handle PKCS#11 URLs for certain options
Summary: doc update: certtool's manpage does not mention it cannot handle PKCS#11 URLs...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: gnutls
Version: 7.3
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Nikos Mavrogiannopoulos
QA Contact: Hubert Kario
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-13 08:26 UTC by Stanislav Zidek
Modified: 2017-08-01 08:48 UTC (History)
1 user (show)

Fixed In Version: gnutls-3.3.26-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-01 08:48:22 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2292 normal SHIPPED_LIVE Moderate: gnutls security, bug fix, and enhancement update 2017-08-01 12:39:15 UTC

Description Stanislav Zidek 2016-09-13 08:26:10 UTC
Description of problem:
Some options of certtool should accept PKCS#11 URLs according to man page (e.g., --load-ca-certificate).

Version-Release number of selected component (if applicable):
gnutls-3.3.24-1.el7

How reproducible:
always

Steps to Reproduce:
1. export GNUTLS_PIN=1234; export GNUTLS_SO_PIN=1234
2. softhsm2-util --init-token --free --label softhsm --pin $GNUTLS_PIN --so-pin $GNUTLS_SO_PIN
3. p11tool --so-login --batch --label '$CA_LABEL' --mark-trusted --mark-ca --load-certificate <<CA cert>> --write '<<TOKEN>>'
4. certtool --verify --provider /usr/lib64/pkcs11/libsofthsm2.so --load-ca-certificate '<<CA cert PKCS11 URL>>' <cert.pem (signed by CA)

Actual results:
Could not open <<CA cert PKCS11 URL>>

Expected results:
Certificate verified.

Additional info:
Problem is same with system and default trust store when accessed through PKCS11 URLs.

Comment 11 errata-xmlrpc 2017-08-01 08:48:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:2292


Note You need to log in before you can comment on or make changes to this bug.