RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1437591 - cli authentication using expired cert throws an exception
Summary: cli authentication using expired cert throws an exception
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: RHCS Maintainers
QA Contact: Asha Akkiangady
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-03-30 15:34 UTC by Roshni
Modified: 2020-10-04 21:24 UTC (History)
3 users (show)

Fixed In Version: pki-core-10.4.1-2.el7
Doc Type: No Doc Update
Doc Text:
undefined
Clone Of:
Environment:
Last Closed: 2017-08-01 22:50:57 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github dogtagpki pki issues 2745 0 None None None 2020-10-04 21:24:23 UTC
Red Hat Product Errata RHBA-2017:2110 0 normal SHIPPED_LIVE pki-core bug fix and enhancement update 2017-08-01 19:36:59 UTC

Description Roshni 2017-03-30 15:34:40 UTC 
Description of problem:
cli authentication using expired cert throws an exception

Version-Release number of selected component (if applicable):
pki-ca-10.4.1-1.el7.noarch

How reproducible:
always

Steps to Reproduce:
1. Install CA instance
2. Create an Administrator user with a certificate that has validity of 1 day.
3. Push the system date to next 2 days
4. pki -v -d . -c **** -n CA_AdminE -h pki1.example.com -p 20080 ca-group-add test

Actual results:
[root@pki1 certdb]# pki -v -d . -c **** -n CA_AdminE -h pki1.example.com -p 20080 ca-group-add test
PKI options: -v -d . -c Secret123
PKI command: CA_AdminE -n CA_AdminE -h pki1.example.com -p 20080 ca-group-add test
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -Djava.ext.dirs=/usr/share/pki/lib -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d . -c Secret123 --verbose -n CA_AdminE -h pki1.example.com -p 20080 ca-group-add test
Server URI: http://pki1.example.com:20080
Client security database: /root/multihost_tests/certdb/.
Message format: null
Command: ca-group-add test
Initializing client security database
Logging into security token
HTTP request: GET /pki/rest/info HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 200 OK
  Server: Apache-Coyote/1.1
  Set-Cookie: JSESSIONID=8F4C188C076A75E9439CCDCAC0F272BA; Path=/pki/; HttpOnly
  Content-Type: application/xml
  Content-Length: 106
  Date: Sat, 01 Apr 2017 21:00:46 GMT
Module: ca
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
  Server: Apache-Coyote/1.1
  Cache-Control: private
  Expires: Wed, 31 Dec 1969 19:00:00 EST
  Location: https://pki1.example.com:20443/ca/rest/account/login
  Content-Length: 0
  Date: Sat, 01 Apr 2017 21:00:46 GMT
HTTP redirect: https://pki1.example.com:20443/ca/rest/account/login
Client certificate: CA_AdminE
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20443
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Server certificate: CN=pki1.example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org
javax.ws.rs.ProcessingException: Unable to invoke request
	at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:287)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:407)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
	at com.sun.proxy.$Proxy32.login(Unknown Source)
	at com.netscape.certsrv.account.AccountClient.login(AccountClient.java:45)
	at com.netscape.certsrv.client.SubsystemClient.login(SubsystemClient.java:47)
	at com.netscape.cmstools.cli.CACLI.login(CACLI.java:58)
	at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:54)
	at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
	at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:573)
	at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:609)
Caused by: java.io.IOException: SocketException cannot write on socket
	at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1188)
	at org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:24)
	at org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(AbstractSessionOutputBuffer.java:147)
	at org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSessionOutputBuffer.java:154)
	at org.apache.http.impl.AbstractHttpClientConnection.doFlush(AbstractHttpClientConnection.java:278)
	at org.apache.http.impl.AbstractHttpClientConnection.flush(AbstractHttpClientConnection.java:283)
	at org.apache.http.impl.conn.ManagedClientConnectionImpl.flush(ManagedClientConnectionImpl.java:175)
	at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:260)
	at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:125)
	at org.apache.http.impl.client.DefaultRequestDirector.tryExecute(DefaultRequestDirector.java:715)
	at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:520)
	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:805)
	at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:283)
	... 11 more
ERROR: Command '[u'/usr/lib/jvm/jre-1.8.0-openjdk/bin/java', u'-Djava.ext.dirs=/usr/share/pki/lib', u'-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties', 'com.netscape.cmstools.cli.MainCLI', '-d', '.', '-c', 'Secret123', '--verbose', '-n', 'CA_AdminE', '-h', 'pki1.example.com', '-p', '20080', 'ca-group-add', 'test']' returned non-zero exit status 255

Expected results:
The cli should give an appropriate error message

Additional info:
Comment 2 Endi Sukma Dewata 2017-03-30 19:43:04 UTC 
The PKI CLI could be modified to register an SSL socket listener so it can get the SSL alert from NSS and then show the actual error message to the user.
Comment 3 Matthew Harmsen 2017-03-30 21:07:10 UTC 
Upstream ticket:
https://pagure.io/dogtagpki/issue/2625
Comment 4 Matthew Harmsen 2017-04-07 23:13:33 UTC 
On 04/07/2017, edewata wrote:

* Fixed in master: 60f0adb9205d5c7d4d9294ca620530ff3df2000e
Comment 6 Roshni 2017-05-19 15:19:48 UTC 
I see an expired certificate message but I still see the IOSocketException. Please confirm if this is expected.

[root@auto-hv-02-guest02 certdb]# pki -d . -c Secret123 -n CA_AdminE -h pki1.example.com -p 20080 ca-group-find
FATAL: SSL alert received: CERTIFICATE_EXPIRED
IOException: SocketException cannot write on socket
[root@auto-hv-02-guest02 certdb]# pki -v -d . -c Secret123 -n CA_AdminE -h pki1.example.com -p 20080 ca-group-find
PKI options: -v -d . -c Secret123
PKI command: CA_AdminE -n CA_AdminE -h pki1.example.com -p 20080 ca-group-find
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -Djava.ext.dirs=/usr/share/pki/lib -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d . -c Secret123 --verbose -n CA_AdminE -h pki1.example.com -p 20080 ca-group-find
Server URI: http://pki1.example.com:20080
Client security database: /root/multihost_tests/certdb/.
Message format: null
Command: ca-group-find
Initializing security database
Logging into security token
Module: ca
Initializing PKIClient
HTTP request: GET /pki/rest/info HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 200 OK
  Server: Apache-Coyote/1.1
  Set-Cookie: JSESSIONID=10E86CA5AB43752E75697A644E0FBDB5; Path=/pki; HttpOnly
  Content-Type: application/xml
  Content-Length: 106
  Date: Fri, 19 May 2017 15:16:24 GMT
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
  Server: Apache-Coyote/1.1
  Cache-Control: private
  Expires: Wed, 31 Dec 1969 19:00:00 EST
  Location: https://pki1.example.com:20443/ca/rest/account/login
  Content-Length: 0
  Date: Fri, 19 May 2017 15:16:24 GMT
HTTP redirect: https://pki1.example.com:20443/ca/rest/account/login
Client certificate: CA_AdminE
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:20443
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Server certificate: CN=pki1.example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org
FATAL: SSL alert received: CERTIFICATE_EXPIRED
javax.ws.rs.ProcessingException: Unable to invoke request
	at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:287)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:407)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
	at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
	at com.sun.proxy.$Proxy32.login(Unknown Source)
	at com.netscape.certsrv.account.AccountClient.login(AccountClient.java:45)
	at com.netscape.certsrv.client.SubsystemClient.login(SubsystemClient.java:47)
	at com.netscape.cmstools.cli.SubsystemCLI.login(SubsystemCLI.java:46)
	at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:64)
	at com.netscape.cmstools.cli.CLI.execute(CLI.java:344)
	at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:628)
	at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:664)
Caused by: java.io.IOException: SocketException cannot write on socket
	at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1496)
	at org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:24)
	at org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(AbstractSessionOutputBuffer.java:147)
	at org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSessionOutputBuffer.java:154)
	at org.apache.http.impl.AbstractHttpClientConnection.doFlush(AbstractHttpClientConnection.java:278)
	at org.apache.http.impl.AbstractHttpClientConnection.flush(AbstractHttpClientConnection.java:283)
	at org.apache.http.impl.conn.ManagedClientConnectionImpl.flush(ManagedClientConnectionImpl.java:175)
	at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:260)
	at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:125)
	at org.apache.http.impl.client.DefaultRequestDirector.tryExecute(DefaultRequestDirector.java:715)
	at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:520)
	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
	at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:805)
	at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:283)
	... 11 more
ERROR: Command '['/usr/lib/jvm/jre-1.8.0-openjdk/bin/java', '-Djava.ext.dirs=/usr/share/pki/lib', '-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties', 'com.netscape.cmstools.cli.MainCLI', '-d', '.', '-c', 'Secret123', '--verbose', '-n', 'CA_AdminE', '-h', 'pki1.example.com', '-p', '20080', 'ca-group-find']' returned non-zero exit status 255
Comment 7 Endi Sukma Dewata 2017-05-19 15:36:07 UTC 
Yes, this is the expected behavior.

The "FATAL: SSL alert received: CERTIFICATE_EXPIRED" message is a notification sent by the server through SSL alert mechanism.

The "IOException: SocketException cannot write on socket" message is the actual error encountered by the client when it tries to connect to the server with the expired certificate.
Comment 8 Roshni 2017-05-19 15:41:11 UTC 
[root@auto-hv-02-guest02 certdb]# rpm -qi pki-ca
Name        : pki-ca
Version     : 10.4.1
Release     : 4.el7
Architecture: noarch
Install Date: Mon 15 May 2017 10:26:51 AM EDT
Group       : System Environment/Daemons
Size        : 2299431
License     : GPLv2
Signature   : (none)
Source RPM  : pki-core-10.4.1-4.el7.src.rpm
Build Date  : Tue 09 May 2017 09:23:16 PM EDT
Build Host  : ppc-021.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://pki.fedoraproject.org/
Summary     : Certificate System - Certificate Authority

Vertification steps in comment 6
Comment 9 errata-xmlrpc 2017-08-01 22:50:57 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2110
Note You need to log in before you can comment on or make changes to this bug.