Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Like in ExternalCA, we get certificate request created in step1 and then it's our choice if we get it signed using CMC or without CMC.
Now in SubCA, it is single step so how a subca can generate a csr
first and then signed it using CMC? Basically how to do
subca(http://pki.fedoraproject.org/wiki/Installing_Subordinate_CA) with
CMC in one step1.
Version-Release number of selected component (if applicable):
rpm -qa pki-ca
pki-ca-10.5.1-4.el7.noarch
How reproducible:
always
Steps to Reproduce:
1.
2.
3.
Actual results:
Unable to install SubCA with CMC using procedure mentioned in http://pki.fedoraproject.org/wiki/Installing_Subordinate_CA
Expected results:
CMC should work with SubCA
Additional info:
Few observations if you wanted to include in documentation:*_
For Subca,in same SD as it's CA:
================================
Ex: RootCA --> SubCA
Subsystem Certificate is signed by it's signing CA.(RootCA).
Rest other certs are signed by SubCA itself.
_For Subca,in different SD as it's CA:_
========================================
All certificates are signed by the subca itself.SubCA Agent page:
0x1 valid
CN=CA OCSP Signing Certificate,OU=topology-CA-EX-diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x1>
0x2 valid
CN=pki1.example.com,OU=topology-CA-EX-diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x2>
0x3 valid
CN=Subsystem Certificate,OU=topology-CA-EX-diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x3>
0x4 valid
CN=CA Audit Signing Certificate,OU=topology-CA-EX-diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x4>
0x5 valid
CN=PKI
Administrator,E=caadmin,OU=topology-CA-EX-
diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x5>
Ex: RootCA --> SubCA
Subsystem Certificate is signed by SubCA itself.
And Rest other certs are also signed by SubCA itself.
_For External CA,_
====================
Ex: RootCA --> ExternalCA
Subsystem Certificate and other certs are signed by ExternalCA
I believe the new instruction for all CMC installation is two steps (two-step for root ca, and external-ca for subca and other subsystems).
This makes this bug moot.