Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
KRATool does not support serialno field in CA/TPS KRA enrollment requests
Version-Release number of selected component (if applicable):
pki-kra-10.4.1-10.el7.noarch
How reproducible:
always
Steps to Reproduce:
1. 2 CA and KRA were instances configured with CS 9.1 packages
2. certutil -L -d /var/lib/pki/pki-kra1/alias/ -n "storageCert cert-pki-kra1 KRA" -a > /export/drmtooltestdata/pki1/kra1-storage.cert
3. /usr/lib64/dirsrv/slapd-dir1/db2ldif -n "pki-kra1-KRA" -a /export/drmtooltestdata/pki1/kra1-dbconfig.ldif
4. cp /var/lib/pki-kra1-sep6/alias/*.db /export/drmtooltestdata/pki1
5. certutil -L -d /var/lib/pki/pki-kra2/alias/ -n "storageCert cert-pki-kra2 KRA" -a > /export/drmtooltestdata/pki2/kra2-storage.cert
6. cp /export/drmtooltestdata/pki2/kra2-storage.cert /export/drmtooltestdata/pki1
[root@pki1 ~]# KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /tmp/kra1-dbconfig.ldif -target_ldif_file /tmp/kra1-kra2.ldif -log_file /tmp/KRATool.log -source_pki_security_database_path /tmp/drmtool -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-topology-02-KRA KRA' -target_storage_certificate_file /tmp/drmtool/kra2-storage.cert -append_id_offset 100000000000 -source_kra_naming_context 'nightcrawler.idmqe.lab.eng.bos.redhat.com-pki-kra' -target_kra_naming_context 'ibm-x3650m4-02-vm-02.lab.eng.bos.redhat.com-pki-kra' -process_requests_and_key_records_only
BEGIN "KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /tmp/kra1-dbconfig.ldif -target_ldif_file /tmp/kra1-kra2.ldif -log_file /tmp/KRATool.log -source_pki_security_database_path /tmp/drmtool -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-topology-02-KRA KRA' -target_storage_certificate_file /tmp/drmtool/kra2-storage.cert -append_id_offset 100000000000 -source_kra_naming_context 'nightcrawler.idmqe.lab.eng.bos.redhat.com-pki-kra' -target_kra_naming_context 'ibm-x3650m4-02-vm-02.lab.eng.bos.redhat.com-pki-kra' -process_requests_and_key_records_only" . . .
PROCESSING KRATOOL CONFIG FILE: ............................. FINISHED.
SUCCESSFULLY processed kratool config file!
Initializing source PKI security databases in '/tmp/drmtool'.
Retrieving token from CryptoManager.
Retrieving source storage token called 'Internal Key Storage Token'.
Retrieving source storage cert with nickname of 'storageCert cert-topology-02-KRA KRA'.
BEGIN: Obtaining the private key from the source storage token . . .
Enter password for Internal Key Storage Token
FINISHED: Obtaining the private key from the source storage token.
BEGIN: Obtaining the public key from the target storage certificate . . .
FINISHED: Obtaining the public key from the target storage certificate.
PROCESSING: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx...........................................................................................................!.....ERROR: Mismatched record field='serialno:' for record type='enrollment'!
FAILED converting source LDIF file --> target LDIF file!
FINISHED "KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /tmp/kra1-dbconfig.ldif -target_ldif_file /tmp/kra1-kra2.ldif -log_file /tmp/KRATool.log -source_pki_security_database_path /tmp/drmtool -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-topology-02-KRA KRA' -target_storage_certificate_file /tmp/drmtool/kra2-storage.cert -append_id_offset 100000000000 -source_kra_naming_context 'nightcrawler.idmqe.lab.eng.bos.redhat.com-pki-kra' -target_kra_naming_context 'ibm-x3650m4-02-vm-02.lab.eng.bos.redhat.com-pki-kra' -process_requests_and_key_records_only".
[root@pki1 ~]# cat /tmp/KRATool.log
[27/Jun/2017:09:25:18 EDT]: BEGIN "KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /tmp/kra1-dbconfig.ldif -target_ldif_file /tmp/kra1-kra2.ldif -log_file /tmp/KRATool.log -source_pki_security_database_path /tmp/drmtool -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-topology-02-KRA KRA' -target_storage_certificate_file /tmp/drmtool/kra2-storage.cert -append_id_offset 100000000000 -source_kra_naming_context 'nightcrawler.idmqe.lab.eng.bos.redhat.com-pki-kra' -target_kra_naming_context 'ibm-x3650m4-02-vm-02.lab.eng.bos.redhat.com-pki-kra' -process_requests_and_key_records_only" . . .
[27/Jun/2017:09:25:18 EDT]: SUCCESSFULLY processed kratool config file!
[27/Jun/2017:09:25:18 EDT]: Initializing source PKI security databases in '/tmp/drmtool'.
[27/Jun/2017:09:25:18 EDT]: Retrieving token from CryptoManager.
[27/Jun/2017:09:25:18 EDT]: Retrieving source storage token called 'Internal Key Storage Token'.
[27/Jun/2017:09:25:18 EDT]: Retrieving source storage cert with nickname of 'storageCert cert-topology-02-KRA KRA'.
[27/Jun/2017:09:25:18 EDT]: BEGIN: Obtaining the private key from the source storage token . . .
[27/Jun/2017:09:25:22 EDT]: FINISHED: Obtaining the private key from the source storage token.
[27/Jun/2017:09:25:22 EDT]: BEGIN: Obtaining the public key from the target storage certificate . . .
[27/Jun/2017:09:25:23 EDT]: FINISHED: Obtaining the public key from the target storage certificate.
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: INFO: Throwing away an LDIF record which is neither a Request nor a Key Record!
[27/Jun/2017:09:25:23 EDT]: Changed numeric data '1' to '100000000001'.
[27/Jun/2017:09:25:23 EDT]: Changed numeric data '011' to '12100000000001'.
[27/Jun/2017:09:25:23 EDT]: Changed 'dateOfModify: 20170626170230Z' to 'dateOfModify: 20170627092518Z'.
[27/Jun/2017:09:25:23 EDT]: Changed:
'extdata-requestnotes: '
--->
'extdata-requestnotes: [20170627092518Z]: REWRAPPED the 'existing DES3 symmetr
ic session key' with the '2048-bit RSA public key' obtained from the target
storage certificate + APPENDED ID offset '100000000000' + RENAMED source KRA
naming context 'nightcrawler.idmqe.lab.eng.bos.redhat.com-pki-kra' to targe
t KRA naming context 'ibm-x3650m4-02-vm-02.lab.eng.bos.redhat.com-pki-kra' +
PROCESSED requests and key records ONLY!'
[27/Jun/2017:09:25:23 EDT]: Changed numeric data '1' to '100000000001'.
[27/Jun/2017:09:25:23 EDT]: Changed numeric data '2' to '100000000002'.
[27/Jun/2017:09:25:23 EDT]: ERROR: Mismatched record field='serialno:' for record type='enrollment'!
[27/Jun/2017:09:25:23 EDT]: FAILED converting source LDIF file --> target LDIF file!
[27/Jun/2017:09:25:23 EDT]: FINISHED "KRATool -kratool_config_file /usr/share/pki/java-tools/KRATool.cfg -source_ldif_file /tmp/kra1-dbconfig.ldif -target_ldif_file /tmp/kra1-kra2.ldif -log_file /tmp/KRATool.log -source_pki_security_database_path /tmp/drmtool -source_storage_token_name 'Internal Key Storage Token' -source_storage_certificate_nickname 'storageCert cert-topology-02-KRA KRA' -target_storage_certificate_file /tmp/drmtool/kra2-storage.cert -append_id_offset 100000000000 -source_kra_naming_context 'nightcrawler.idmqe.lab.eng.bos.redhat.com-pki-kra' -target_kra_naming_context 'ibm-x3650m4-02-vm-02.lab.eng.bos.redhat.com-pki-kra' -process_requests_and_key_records_only".
Actual results:
Expected results:
Additional info:
So there is a code fix done for AES. Do you wanted to have same code in RHEL 7.x and RHEL 8.x because that was required. I think we can test on those branches as well.
Yes, the current fix is for 10.5 (RHEL7.x). I MIGHT forward porting this fix to 10.7 (might not get shipped on RHEL8.1) and WILL forward port to 10.8 (will be shipped on RHEL8.2)
I tried to reproduce this and I was not able to. I am closing this as WORKSFORME.
I am attaching the logs and all the relevant files used to close this bug. Note that, the source ldif used (beta_removed_netkeyKeyRecover.ldif) was originally generated from a RHCS8 setup and has the `netkeyKeyRecovery` attributes removed because of a different bug: bz1445479