Bug 1541526
| Summary: | CMC: Revocation works with an unknown revRequest.issuer | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Geetika Kapoor <gkapoor> |
| Component: | pki-core | Assignee: | Christina Fu <cfu> |
| Status: | CLOSED ERRATA | QA Contact: | Asha Akkiangady <aakkiang> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.5 | CC: | lmiksik, mharmsen |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | pki-core-10.5.1-7.el7 | Doc Type: | No Doc Update |
| Doc Text: |
undefined
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 17:04:05 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Test bits:
=========
rpm -qa pki-*
pki-tools-10.5.1-7.el7.x86_64
pki-ca-10.5.1-7.el7.noarch
pki-core-debuginfo-10.5.1-6.1.el7pki.x86_64
pki-javadoc-10.5.1-6.1.el7.noarch
pki-base-10.5.1-7.el7.noarch
pki-symkey-10.5.1-7.el7.x86_64
pki-server-10.5.1-7.el7.noarch
pki-kra-10.5.1-7.el7.noarch
pki-tks-10.5.1-6.1.el7pki.noarch
pki-console-10.5.1-4.el7pki.noarch
pki-base-java-10.5.1-7.el7.noarch
pki-tps-10.5.1-6.1.el7pki.x86_64
pki-ocsp-10.5.1-6.1.el7pki.noarch
Test Case:
=========
If Issuerdn doesn't match
=========================
[12/Feb/2018:13:32:21][http-bio-25443-exec-1]: CMCOutputTemplate: processRevokeRequestControl: Client and server shared secret are the same, can go ahead and revoke certificate.
[12/Feb/2018:13:32:21][http-bio-25443-exec-1]: In LdapBoundConnFactory::getConn()
[12/Feb/2018:13:32:21][http-bio-25443-exec-1]: masterConn is connected: true
[12/Feb/2018:13:32:21][http-bio-25443-exec-1]: getConn: conn is connected true
[12/Feb/2018:13:32:21][http-bio-25443-exec-1]: getConn: mNumConns now 2
[12/Feb/2018:13:32:21][http-bio-25443-exec-1]: returnConn: mNumConns now 3
[12/Feb/2018:13:32:21][http-bio-25443-exec-1]: CMCOutputTemplate: processRevokeRequestControl: shared secret revocation: checking issuer DN
[12/Feb/2018:13:32:21][http-bio-25443-exec-1]: CMCOutputTemplate: processRevokeRequestControl: certificate issuer DN and revocation request issuer DN do not match
Number of controls is 1
Control #0: CMCStatusInfoV2
OID: {1 3 6 1 5 5 7 7 25}
BodyList: 1
Status String: certificate issuer DN and revocation request issuer DN do not match
OtherInfo type: FAIL
failInfo=bad identity
ERROR: CMC status for [1]: failed
Audit logs:
==========
0.http-bio-25443-exec-8 - [12/Feb/2018:13:53:12 EST] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.12.28.208][ServerIP=10.12.28.208][SubjectID=UID=sslauth,OU=People][Outcome=Success] access session establish success
0.http-bio-25443-exec-8 - [12/Feb/2018:13:53:12 EST] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=certServer.ee.profile][Op=submit] authorization success
0.http-bio-25443-exec-8 - [12/Feb/2018:13:53:12 EST] [14] [6] [AuditEvent=CMC_REQUEST_RECEIVED][SubjectID=$Unidentified$][Outcome=Success][CMCRequest=MIG7BgkqhkiG9w0BBwGgga0EgaowgacwgZ4wgZsCAQEGCCsGAQUFBwcRMYGLMIGIMFYxFTATBgNVBAoMDFNFQ3VyZS1Ec09PTzEcMBoGA1UECwwTZ2thcG9vcl9SSENTXzc1X3NzbDEfMB0GA1UEAwwWQ0EgU2lnbmluZyBDZXJ0aWZpY2F0ZQIEAcC9ugoBBgQMd29uZGVyZnVsZGF5DBdnZWV0aWthIHRlc3QgcmV2b2NhdGlvbjAAMAAwAA==] CMC request received
0.http-bio-25443-exec-8 - [12/Feb/2018:13:53:12 EST] [14] [6] [AuditEvent=CMC_RESPONSE_SENT][SubjectID=$Unidentified$][Outcome=Success][CMCResponse=MIIGhQYJKoZIhvcNAQcCoIIGdjCCBnICAQMxDzANBglghkgBZQMEAgMFADB6BggrBgEFBQcMA6BuBGwwajBkMGICAQEGCCsGAQUFBwcZMVMwUQIBAjADAgEBDEQgY2VydGlmaWNhdGUgaXNzdWVyIEROIGFuZCByZXZvY2F0aW9uIHJlcXVlc3QgaXNzdWVyIEROIGRvIG5vdCBtYXRjaAIBBzAAMACgggPoMIID5DCCAsygAwIBAgIEDN0MIDANBgkqhkiG9w0BAQ0FADBTMRIwEAYDVQQKDAlTRUN1cmUtRHMxHDAaBgNVBAsME2drYXBvb3JfUkhDU183NV9zc2wxHzAdBgNVBAMMFkNBIFNpZ25pbmcgQ2VydGlmaWNhdGUwHhcNMTgwMjExMTkxODI5WhcNMzgwMjExMTkxODI5WjBTMRIwEAYDVQQKDAlTRUN1cmUtRHMxHDAaBgNVBAsME2drYXBvb3JfUkhDU183NV9zc2wxHzAdBgNVBAMMFkNBIFNpZ25pbmcgQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUbstjKcEqIB7YPOGgU6Bc1s2ZpKgnSJTt+tyqoRm/UgyO52HSVn0rjFt7DKXcXj/xPQ6mhIIk8NW9zgU8UqIyx23I8wIk+IkTb9pMGcDIreyZn3plVjBwsKBpvNKq1MFKCHGrvyPOh16xjegY084x0CRzG3nx/iNs6odG14XCwr3x/1YOF9/XkNRaf8bV9hPEr44AWoLxVTHFMPVwj5OBp+4uk02OH4Kqu6qmaq7FTc4gNjS9Owar1/Y6AiN0cycJ8c1T9a/HwQPbDyx65GFMbnvzm0KNrkS/dTmHSN0eByyYpW64GFq4sc4g1z6+lK2xLIhBPq0oOH3/tMgaBk+/AgMBAAGjgb8wgbwwHwYDVR0jBBgwFoAUXsQ1CWyxJDzlBkboOGYcTJWMo0YwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwHQYDVR0OBBYEFF7ENQlssSQ85QZG6DhmHEyVjKNGMFkGCCsGAQUFBwEBBE0wSzBJBggrBgEFBQcwAYY9aHR0cDovL2NzcWE0LWd1ZXN0MDQuaWRtLmxhYi5lbmcucmR1LnJlZGhhdC5jb206MjUwODAvY2Evb2NzcDANBgkqhkiG9w0BAQ0FAAOCAQEAVfiTS/RqZvPMk4lj3SYB6Yl1ULrCiSHIa0QUxQNWWwUxSU3LI7+V63bxBkuF+T3Dusc1sRSyooku0+iwNIOoIVbm8KnB6N7Zo/sR8TYVaKcGvU8b1xDzcH5wRZblMETKA8tVC2+P6IaZZnhlZBHjS308qNMbaQUjI/dosumcGMOXZhNGRcX8eoc1J5Ouap/B9piHZ1h4kY5MEBgna6tqIs3FTNDml+a89JrIKklhTvOV41/yMT1SSTTYsUoEhSIq1S06DKHQql9qblp+MHq5p/CDSN5PDDDzsaRCui+iBRHxlKlxK/2J0YABqz5Y8N/adsFP0gp6fD/AlcyLLIv8dDGCAfIwggHuAgEBMFswUzESMBAGA1UECgwJU0VDdXJlLURzMRwwGgYDVQQLDBNna2Fwb29yX1JIQ1NfNzVfc3NsMR8wHQYDVQQDDBZDQSBTaWduaW5nIENlcnRpZmljYXRlAgQM3QwgMA0GCWCGSAFlAwQCAwUAoGowFwYJKoZIhvcNAQkDMQoGCCsGAQUFBwwDME8GCSqGSIb3DQEJBDFCBEDe5AD14wrjjWfZryulqxF9NV6tzJYqBnmv68EAOx4ueEHBzHLUoMVyT4Ks3MqDAP8Vm7db1ZYqmU1s/vmoVdPvMA0GCSqGSIb3DQEBDQUABIIBAC8tr3wK1SEvx31QF8w6b03Mr6lJ/j/IjOS1Mvv1tvc+7aSYTqTMTB8W9rUtr5HHoBAeTwlPmLgEs7RoBDiLutUJWpEhYVGK3/uZzCMA20l1l+ATc2UhvZ2JgUHRek4yq0Ik1ZT3fT7FSeSN2i2BeiUdV7Z9V3jT3Dqx2jZS81OAJD7RRPprDXmTS0lcj+zIXXkBpgDT7EG0Ygap/cSE4mh2qNBkKl14ccRALmYlZxHd4mMOlkfZcnjoQ5XlDHiO+a/YhsTFipsVLgU/QRhOeadp+HuaGQdF2rlDhJhfCLZpjhmMBCw8FHmKwsY933oabgXH9PIrPGdjgCrfsCGOTLE=] CMC response sent
0.http-bio-25443-exec-8 - [12/Feb/2018:13:53:12 EST] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.12.28.208][ServerIP=10.12.28.208][SubjectID=UID=sslauth,OU=People][Outcome=Success][Info=CLOSE_NOTIFY] access session terminated
This works as expected.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0925 |
Description of problem: Originally certificate is signed by user which has issuer "revRequest.issuer=UID=usercert,CN=usercert". Now i wanted to revoke cert. I did change in revoke config and add "revRequest.issuer=UID=usercert,CN=usercert1" which is incorrect and doesn't match with expected. With this , revocation works. Should it match the issuer with the one who originally issues cert (as mentioned in ldap)?? Version-Release number of selected component (if applicable): 10.5 How reproducible: always Steps to Reproduce: 1. I have a cert "usercert1" which looks like as mentioned below.I used this cert for cmc request nick and http client. [root@csqa4-guest04 75_cfg_working]# certutil -L -d /root/nssdb_75/ -n "usercert1" Certificate: Data: Version: 3 (0x2) Serial Number: 134560631 (0x8053b77) Signature Algorithm: PKCS #1 SHA-512 With RSA Encryption Issuer: "CN=CA Signing Certificate,OU=gkapoor_RHCS_75,O=Example-rhcs9 2-CA" Validity: Not Before: Thu Jan 25 12:19:37 2018 Not After : Tue Jul 24 11:19:37 2018 Subject: "UID=usercert,CN=usercert" 2. I sign a certificate using flow as mentioned in https://bugzilla.redhat.com/attachment.cgi?id=1388326 (Test Case 2.2: Set cmc.popLinkWitnessRequired=false in CS.cfg and) restart. 3. I try to do certificate revocation using procedure as mentioned https://bugzilla.redhat.com/attachment.cgi?id=1388326 (Test Case 3.4: Add ldap changes as mentioned in http://pki.fedoraproject.org/wiki/PKI_10.5_CMC_Shared_Token#Example_Enrollment_Procedure) 4. change the issuer value in revoke.cfg file.Below is revocation file. original: revRequest.issuer=UID=usercert,CN=usercert new changed : revRequest.issuer=UID=usercert,CN=usercert1 [root@csqa4-guest04 user-signed]# cat revoke.cfg #numRequests: Total number of PKCS10 requests or CRMF requests. numRequests=1 #output: full path for the CMC request in binary format output=user-signed/cmc.self.req #tokenname: name of token where user signing cert can be found (default is internal) tokenname=internal #nickname: nickname for user signing certificate which will be used #to sign the CMC full request. #nickname=PKI CA Administrator #nickname=usercert1 #dbdir: directory for cert8.db, key3.db and secmod.db dbdir=/root/nssdb_75/ #password: password for cert8.db which stores the user signing #certificate and keys password=SECret.123 #format: request format, either pkcs10 or crmf format=pkcs10 ## revocation parameters revRequest.enable=true revRequest.serial=249744791 revRequest.reason=certificateHold revRequest.sharedSecret=wonderfulday revRequest.comment=geetika test revocation revRequest.issuer=UID=usercert,CN=usercert1 5. Audit logs: 0.http-bio-20443-exec-1 - [30/Jan/2018:06:39:03 EST] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.67.116.21][ServerIP=10.12.28.208][SubjectID=CN=PKI Administrator,E=example,OU=gkapoor_RHCS_75,O=Example-rhcs92-CA][Outcome=Success][Info=CLOSE_NOTIFY] access session terminated 0.http-bio-20443-exec-10 - [30/Jan/2018:06:39:03 EST] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.67.116.21][ServerIP=10.12.28.208][SubjectID=CN=PKI Administrator,E=example,OU=gkapoor_RHCS_75,O=Example-rhcs92-CA][Outcome=Success][Info=CLOSE_NOTIFY] access session terminated 0.http-bio-20443-exec-16 - [30/Jan/2018:06:39:04 EST] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.12.28.208][ServerIP=10.12.28.208][SubjectID=UID=usercert,CN=usercert][Outcome=Success] access session establish success 0.http-bio-20443-exec-16 - [30/Jan/2018:06:39:04 EST] [14] [6] [AuditEvent=AUTHZ][SubjectID=$Unidentified$][Outcome=Success][aclResource=certServer.ee.profile][Op=submit] authorization success 0.http-bio-20443-exec-16 - [30/Jan/2018:06:39:05 EST] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=UID=usercert,CN=usercert][Outcome=Success][ReqID=50][CertSerialNum=249744791][RequestType=revoke][RevokeReasonNum=Certificate_Hold][Approval=complete] certificate status change request processed 0.http-bio-20443-exec-16 - [30/Jan/2018:06:39:05 EST] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.12.28.208][ServerIP=10.12.28.208][SubjectID=UID=usercert,CN=usercert][Outcome=Success][Info=CLOSE_NOTIFY] access session terminated CA Agent PAge: Request 50 Request Status: complete Type: revocation Unauthenticated Request Attributes Authenticate Request Attributes (from authentication, policy and other server modules)revRequest.issuer=UID=usercert,CN=usercert1 cert_info: MCMCBA7izZcXDTE4MDEzMDExMzkwNFowDDAKBgNVHRUEAwoBBg== requesttype: revocation requestversion: 1.0.0 requestortype: Agent updatedby: $Unidentified$ revocationreason: 6 dbstatus: UPDATED requeststatus: complete csrrequestorcomments: geetika test revocation requestid: 50 result: 1 Certificate Serial number: 0x0ee2cd97 Reason: Certificate_Hold Actual results: Expected results: Additional info: