Bug 1469446 - CC: need CMC enrollment profiles for system certificates
CC: need CMC enrollment profiles for system certificates
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core (Show other bugs)
7.4
All Linux
urgent Severity urgent
: rc
: ---
Assigned To: Christina Fu
Asha Akkiangady
Petr Bokoc
: ZStream
Depends On: 1464591
Blocks:
  Show dependency treegraph
 
Reported: 2017-07-11 05:42 EDT by Jaroslav Reznik
Modified: 2017-09-05 07:25 EDT (History)
7 users (show)

See Also:
Fixed In Version: pki-core-10.4.1-12.el7_4
Doc Type: Enhancement
Doc Text:
This update adds support for CMC-based system certificate requests, and adds the following new CMC-based system enrollment profiles: - caCMCauditSigningCert.cfg - caCMCcaCert.cfg - caCMCkraStorageCert.cfg - caCMCkraTransportCert.cfg - caCMCocspCert.cfg - caCMCserverCert.cfg - caCMCsubsystemCert.cfg
Story Points: ---
Clone Of: 1464591
Environment:
Last Closed: 2017-09-05 07:25:02 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jaroslav Reznik 2017-07-11 05:42:21 EDT
This bug has been copied from bug #1464591 and has been proposed to be backported to 7.4 z-stream (EUS).
Comment 3 Geetika Kapoor 2017-08-11 01:40:08 EDT
Hello,
Please mention the testing steps or any document that i can refer for test case creation.
Comment 4 Christina Fu 2017-08-14 19:02:45 EDT
(In reply to Geetika Kapoor from comment #3)
> Hello,
> Please mention the testing steps or any document that i can refer for test
> case creation.

https://pki.fedoraproject.org/wiki/PKI_10.4_CMC_Feature_Update_(RFC5272)#Examples_.28System_Certificates.29
Comment 5 Geetika Kapoor 2017-08-25 13:45:55 EDT
Test Build:
===========

rpm -qa pki-ca
pki-ca-10.4.1-12.el7_4.noarch

Test Cases:
===========

Refer https://pki.fedoraproject.org/wiki/PKI_10.4_CMC_Feature_Update_%28RFC5272%29#Examples_.28System_Certificates.29

1.1 Getting a Subordinate CA Certificate

This test case works as expected with cmc.popLinkWitnessRequired=false.
This test case works as expected with cmc.popLinkWitnessRequired=true.
when using in true mode, do below changes in cmc file.
enable popwitnesslink and identification.

1.2 Getting an OCSP Signing Certificate
This test case works as expected with cmc.popLinkWitnessRequired=false.
This test case works as expected with cmc.popLinkWitnessRequired=true.
when using in true mode, do below changes in cmc file.
enable popwitnesslink and identification.

1.3 Getting an SSL Server Certificate
This test case works as expected with cmc.popLinkWitnessRequired=false.
This test case works as expected with cmc.popLinkWitnessRequired=true.
when using in true mode, do below changes in cmc file.
enable popwitnesslink and identification.

1.4 Getting a Subsystem Certificate
This test case works as expected with cmc.popLinkWitnessRequired=false.
This test case works as expected with cmc.popLinkWitnessRequired=true.
when using in true mode, do below changes in cmc file.
enable popwitnesslink and identification.

1.5 Getting an Audit Signing Certificate
This test case works as expected with cmc.popLinkWitnessRequired=false.
This test case works as expected with cmc.popLinkWitnessRequired=true.
when using in true mode, do below changes in cmc file.
enable popwitnesslink and identification.

1.6 Getting a KRA Transport Certificate
This test case works as expected with cmc.popLinkWitnessRequired=false.
This test case works as expected with cmc.popLinkWitnessRequired=true.
when using in true mode, do below changes in cmc file.
enable popwitnesslink and identification.

1.7 Getting a KRA Storage Certificate
This test case works as expected with cmc.popLinkWitnessRequired=false.
This test case works as expected with cmc.popLinkWitnessRequired=true.
when using in true mode, do below changes in cmc file.
enable popwitnesslink and identification.

Verified above mentioned test cases.!!
Comment 7 errata-xmlrpc 2017-09-05 07:25:02 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2575

Note You need to log in before you can comment on or make changes to this bug.