Bug 1458429 – client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C"

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1458429 - client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C"

Summary:	client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C"

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	pki-core (Show other bugs)
Sub Component:
Version:	7.4
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Endi Sukma Dewata
QA Contact:	Asha Akkiangady
Docs Contact:	Petr Bokoc

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-06-02 16:24 EDT by Roshni
Modified:	2018-03-15 03:30 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	pki-core-10.4.1-8.el7
Doc Type:	Bug Fix
Doc Text:	CA certificates are now imported with correct trust flags Previously, the "pki client-cert-import" command imported CA certificates with `CT,c,` trust flags, which was insufficient and inconsistent with other PKI tools. With this update, the command has been fixed and now sets the trust flags for CA certificates to `CT,C,C`.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-08-01 18:52:53 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2017:2110	normal	SHIPPED_LIVE	pki-core bug fix and enhancement update	2017-08-01 15:36:59 EDT

Groups: None (edit)

Description Roshni 2017-06-02 16:24:16 EDT

Description of problem:
client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C"

Version-Release number of selected component (if applicable):
pki-ca-10.4.1-7.el7.noarch

How reproducible:
always

Steps to Reproduce:
[root@vm-idm-011 slapd-pki]# pki -d . -C password.txt client-cert-import "CA Certificate" --ca-cert ca.crt 
-------------------------------------
Imported certificate "CA Certificate"
-------------------------------------
[root@vm-idm-011 slapd-pki]# certutil -L -d .

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

CA Certificate                                               CT,c,

Actual results:


Expected results:
The trust bits should be set to "CT,C,C"

Additional info:

Comment 2 Endi Sukma Dewata 2017-06-02 22:06:50 EDT

Fixed in master

* https://github.com/dogtagpki/pki/commit/64b7b7abfed29b6a520be66414139364d713461e

Comment 4 Roshni 2017-06-12 11:39:57 EDT

[root@nocp1 slapd-pki-ca-Jun12-LDAP]# rpm -qi pki-ca
Name        : pki-ca
Version     : 10.4.1
Release     : 8.el7
Architecture: noarch
Install Date: Thu 08 Jun 2017 01:35:57 AM EDT
Group       : System Environment/Daemons
Size        : 2308437
License     : GPLv2
Signature   : (none)
Source RPM  : pki-core-10.4.1-8.el7.src.rpm
Build Date  : Thu 08 Jun 2017 12:46:20 AM EDT
Build Host  : nocp1.idm.lab.eng.rdu2.redhat.com
Relocations : (not relocatable)
URL         : http://pki.fedoraproject.org/
Summary     : Certificate System - Certificate Authority


[root@nocp1 slapd-pki-ca-Jun12-LDAP]# pki -d . -C password.txt client-cert-import "CA Certificate" --ca-cert ca.crt 
-------------------------------------
Imported certificate "CA Certificate"
-------------------------------------
[root@nocp1 slapd-pki-ca-Jun12-LDAP]# certutil -L -d .

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

CA Certificate                                               CT,C,C

Comment 5 errata-xmlrpc 2017-08-01 18:52:53 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2110

Note You need to log in before you can comment on or make changes to this bug.