Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1532933

Summary: Installing subsystems with external CMC certificates in HSM environment shows import error
Product: Red Hat Enterprise Linux 7 Reporter: Asha Akkiangady <aakkiang>
Component: pki-coreAssignee: Endi Sukma Dewata <edewata>
Status: CLOSED ERRATA QA Contact: Asha Akkiangady <aakkiang>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.5CC: jreznik, lmiksik, mharmsen
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: pki-core-10.5.1-7.el7 Doc Type: No Doc Update
Doc Text:
undefined
 Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-10 17:04:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
ocsp-external-step1.cfg
none
ocsp-external-step2.cfg none

Description Asha Akkiangady 2018-01-10 02:26:25 UTC 
Created attachment 1379328 [details]
ocsp-external-step1.cfg

Description of problem:
pkispawn OCSP with external CMC certs in HSM environment shows import error.

Version-Release number of selected component (if applicable):
pki-server-10.5.1-5.el7.noarch

How reproducible:


Steps to Reproduce:
1. Tested the procedure in http://pki.fedoraproject.org/wiki/Installing_OCSP_with_External_Certificates with HSM token and cmc issued certificates.

2. pkispawn of ocsp-external-step2.cfg shows following issue:

pkispawn    : INFO     ....... modifying '/opt/pki-rootOCSP/ocsp/pkcs12_password.conf'
pkispawn    : DEBUG    ........... chmod 660 /opt/pki-rootOCSP/ocsp/pkcs12_password.conf
pkispawn    : DEBUG    ........... chown 17:17 /opt/pki-rootOCSP/ocsp/pkcs12_password.conf
pkispawn    : INFO     ....... Security databases '/opt/pki-rootOCSP/ocsp/alias/cert8.db', '/opt/pki-rootOCSP/ocsp/alias/key3.db', and/or '/opt/pki-rootOCSP/ocsp/alias/secmod.db' already exist!
pkispawn    : INFO     ....... importing ca_signing certificate from ca_signing.crt
certutil: could not change trust on certificate: SEC_ERROR_TOKEN_NOT_LOGGED_IN: The operation failed because the PKCS#11 token is not logged in.
pkispawn    : INFO     ....... importing ocsp_signing certificate from ocsp_signing.crt
Error: Incorrect client security database password.
pkispawn    : DEBUG    ....... Error Type: CalledProcessError
pkispawn    : DEBUG    ....... Error Message: Command '['pki', '-d', '/var/lib/pki/rhcs93-OCSP-aakkiang/alias', '-C', '/tmp/tmpi8IsdP/password.txt', 'client-cert-import', '--pkcs7', 'ocsp_signing.crt', '--trust', ',,', 'ocsp_signing']' returned non-zero exit status 255
pkispawn    : DEBUG    .......   File "/usr/sbin/pkispawn", line 533, in main
    scriptlet.spawn(deployer)
  File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 1031, in spawn
    self.import_system_certs(deployer, nssdb, subsystem)
  File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 603, in import_system_certs
    self.import_ocsp_signing_cert(deployer, nssdb)
  File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 557, in import_ocsp_signing_cert
    trust_attributes=',,')
  File "/usr/lib/python2.7/site-packages/pki/nssdb.py", line 715, in import_cert_chain
    output_format='base64')
  File "/usr/lib/python2.7/site-packages/pki/nssdb.py", line 754, in import_pkcs7
    nickname
  File "/usr/lib64/python2.7/subprocess.py", line 542, in check_call
    raise CalledProcessError(retcode, cmd)


Installation failed: Command '['pki', '-d', '/var/lib/pki/rhcs93-OCSP-aakkiang/alias', '-C', '/tmp/tmpi8IsdP/password.txt', 'client-cert-import', '--pkcs7', 'ocsp_signing.crt', '--trust', ',,', 'ocsp_signing']' returned non-zero exit status 255

Actual results:


Expected results:
pkispawn should be successful.

Additional info:
Comment 2 Asha Akkiangady 2018-01-10 02:28:03 UTC 
Created attachment 1379329 [details]
ocsp-external-step2.cfg
Comment 4 Asha Akkiangady 2018-01-10 14:22:09 UTC 
KRA install also shows same problem:

pkispawn    : DEBUG    ........... chown 17:17 /opt/pki-rootKRA/kra/pkcs12_password.conf
pkispawn    : INFO     ....... Security databases '/opt/pki-rootKRA/kra/alias/cert8.db', '/opt/pki-rootKRA/kra/alias/key3.db', and/or '/opt/pki-rootKRA/kra/alias/secmod.db' already exist!
pkispawn    : INFO     ....... importing ca_signing certificate from ca_signing.crt
certutil: could not change trust on certificate: SEC_ERROR_TOKEN_NOT_LOGGED_IN: The operation failed because the PKCS#11 token is not logged in.
pkispawn    : INFO     ....... importing kra_storage certificate from kra_storage.crt
Error: Incorrect client security database password.
pkispawn    : DEBUG    ....... Error Type: CalledProcessError
pkispawn    : DEBUG    ....... Error Message: Command '['pki', '-d', '/var/lib/pki/rhcs93-KRA-aakkiang/alias', '-C', '/tmp/tmpl44m3R/password.txt', 'client-cert-import', '--pkcs7', 'kra_storage.crt', '--trust', ',,', 'kra_storage']' returned non-zero exit status 255
pkispawn    : DEBUG    .......   File "/usr/sbin/pkispawn", line 533, in main
    scriptlet.spawn(deployer)
  File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 1031, in spawn
    self.import_system_certs(deployer, nssdb, subsystem)
  File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 597, in import_system_certs
    self.import_kra_storage_cert(deployer, nssdb)
  File "/usr/lib/python2.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 523, in import_kra_storage_cert
    trust_attributes=',,')
  File "/usr/lib/python2.7/site-packages/pki/nssdb.py", line 715, in import_cert_chain
    output_format='base64')
  File "/usr/lib/python2.7/site-packages/pki/nssdb.py", line 754, in import_pkcs7
    nickname
  File "/usr/lib64/python2.7/subprocess.py", line 542, in check_call
    raise CalledProcessError(retcode, cmd)


Installation failed: Command '['pki', '-d', '/var/lib/pki/rhcs93-KRA-aakkiang/alias', '-C', '/tmp/tmpl44m3R/password.txt', 'client-cert-import', '--pkcs7', 'kra_storage.crt', '--trust', ',,', 'kra_storage']' returned non-zero exit status 255
Comment 6 Endi Sukma Dewata 2018-01-23 21:21:12 UTC 
Fixed in upstream 10.5 branch:

* https://github.com/dogtagpki/pki/commit/ebf46355270cb1f5a64a70336f991cda310067eb
* https://github.com/dogtagpki/pki/commit/f59768f3cdc920a27f1ca90184083142fec98f63
* https://github.com/dogtagpki/pki/commit/3e10aa429cde0ad22f43b1217609230fca3a2517
* https://github.com/dogtagpki/pki/commit/67c8376024f2ae141a26efb4f82ca1c873cd4264
* https://github.com/dogtagpki/pki/commit/e71e5957c79e03536f6adeef6e79adc8c728db5b
* https://github.com/dogtagpki/pki/commit/57a0f4294d9d1858e7e59c6e605c85ee31bff2a3
* https://github.com/dogtagpki/pki/commit/ee0918be9bb45611c14b2684954d14459bcb0627
* https://github.com/dogtagpki/pki/commit/949d4731575fedc96706eb62e2359846a8668718
* https://github.com/dogtagpki/pki/commit/a032321c8324b4fcd1135bb1c623615fbd0c4fdf
* https://github.com/dogtagpki/pki/commit/a338f3fab9b4a9986657a7517dc6c1e3bacaad0b
* https://github.com/dogtagpki/pki/commit/5ad7efb44f434f8695c404ba40b4baea27d6bfec
* https://github.com/dogtagpki/pki/commit/30b499d21d731a1c3903bbfe7b23111963971038
* https://github.com/dogtagpki/pki/commit/b3664cd26b90d804e311f56cf16e4e31223d5960
* https://github.com/dogtagpki/pki/commit/4196d2ab35c4b683228e3ff03cda98c120726702
Comment 8 Asha Akkiangady 2018-02-24 07:45:38 UTC 
Tested in version:
pki-server-10.5.1-9.el7.noarch

Installation of SubCA, OCSP and KRA instances with externally issued CMC certs is successful.

Marking the bug verified.
Comment 10 errata-xmlrpc 2018-04-10 17:04:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0925