Bug 1550739 - Need ECC-specific Enrollment Profiles for standard conformance
Summary: Need ECC-specific Enrollment Profiles for standard conformance
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core
Version: 7.6
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: rc
: ---
Assignee: Christina Fu
QA Contact: Asha Akkiangady
Marc Muehlfeld
URL:
Whiteboard:
Depends On:
Blocks: 1547802 1554726 1560225
TreeView+ depends on / blocked
 
Reported: 2018-03-01 23:15 UTC by Christina Fu
Modified: 2018-10-30 11:06 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
See Doc Text field in BZ#1554726.
Clone Of:
: 1554726 1560225 (view as bug list)
Environment:
Last Closed: 2018-10-30 11:05:27 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3195 None None None 2018-10-30 11:06:49 UTC

Description Christina Fu 2018-03-01 23:15:33 UTC
Description of problem:

Currently many of the enrollment profiles are shared between RSA and ECC certificates. As such the keyUsage extension is not conforming.

This task is to add needed ECC-specific enrollment profiles and make needed adjustments to existing ones for standard conformance.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 4 Christina Fu 2018-03-12 22:09:19 UTC
Testing procedure:

* For installation, courtesy of Matt:
http://pki.fedoraproject.org/wiki/PKI_10.5_Pkispawn_ECC_Profile_Workaround

* For other profiles, just make sure the new or changed profiles are exercised.  For example, for the CMC profiles (new or changed), just put that into the HttpClient config file under servlet.

Comment 6 Matthew Harmsen 2018-04-05 22:02:13 UTC
commit 995682153e10393dc46f16090c26f28ca1b6cfc6
Author: Christina Fu <cfu@redhat.com>
Date:   Thu Mar 29 09:59:02 2018 -0700

    quick fix on wrong keyType in profile
    
    Change-Id: I0fa90ebb559e0fb8af123191f7bc7cdedbc55d87

Comment 9 Amol K 2018-08-17 06:37:14 UTC
I tested this Bugzilla on version 10.5.9-5.el7.

I'm able to install CA without the workaround After the CMC request I tested it with different profiles with httpClient.

It working as expected.

Verifying this Bugzilla.

Comment 11 errata-xmlrpc 2018-10-30 11:05:27 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3195


Note You need to log in before you can comment on or make changes to this bug.