Hide Forgot
Description of problem: trust anchor complains about invalid attribute and fails when a new certificate tries to store into trust place Version-Release number of selected component (if applicable): p11-kit-0.23.2-4.fc25.x86_64 How reproducible: always Steps to Reproduce: [root@localhost trust-anchor-complains-about-invalid-attribute-and]# cd /tmp [root@localhost tmp]# /etc/pki/tls/certs/make-dummy-cert mycert-tmp.pem [root@localhost tmp]# openssl x509 -in mycert-tmp.pem -addtrust clientAuth -addtrust serverAuth -addtrust emailProtection -out mycert.pem [root@localhost tmp]# trust anchor --store mycert.pem p11-kit: the CKA_TRUSTED attribute is not valid for the object p11-kit: couldn't create object: Certain fields have invalid values Actual results: p11-kit: the CKA_TRUSTED attribute is not valid for the object p11-kit: couldn't create object: Certain fields have invalid values Expected results: Certificate is created and stored Additional info: This bug was in RHEL 7 and fixed in 7.4. F26's p11-kit-0.23.5-3.fc26 does not have this issue so it appears we just need to update the F25 package. Bug was found during the recent effort to port RHEL tests in Beaker to Fedora upstream testing.
Automated test for this bug is here: https://upstreamfirst.fedorainfracloud.org/p11-kit Note that this is a temporary repo and may be moved in the future.
This is probably bug 1158926, but I was hesitating to update p11-kit in F25 to a newer upstream release, because it also brings in new features as well as bug fixes. If this bug is particularly important, I can backport the fix.
Hi, This is indeed the same as bug 1158926 (RHEL bug references were removed from the name of the test due to upstream porting guidelines). I don't know of any implications aside from the test failing.
Considering that there shouldn't be any backward incompatible change, I am going to update p11-kit to 0.23.8.
p11-kit-0.23.8-1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-bd0324f3e9
p11-kit-0.23.8-1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-bd0324f3e9
p11-kit-0.23.8-1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.