Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1560961 - Can't log in to the director UI with Firefox [rhel-7.5.z]
Can't log in to the director UI with Firefox [rhel-7.5.z]
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: certmonger (Show other bugs)
7.4
Unspecified Unspecified
urgent Severity urgent
: rc
: ---
Assigned To: Rob Crittenden
ipa-qe
: Triaged, ZStream
Depends On: 1551635
Blocks: 1559121
  Show dependency treegraph
 
Reported: 2018-03-27 07:17 EDT by Oneata Mircea Teodor
Modified: 2018-05-14 12:10 EDT (History)
18 users (show)

See Also:
Fixed In Version: certmonger-0.78.4-3.el7.1
Doc Type: Bug Fix
Doc Text:
Previously, the automatically generated local certificate authority (CA) used improper DER-encoding for the CA Basic Constraint boolean. As a consequence, the certificate was in some cases rejected as invalid. With this update, the local CA uses proper DER-encoding boolean and the described problem no longer occurs.
Story Points: ---
Clone Of: 1551635
Environment:
Last Closed: 2018-05-14 12:10:02 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:1381 None None None 2018-05-14 12:10 EDT

  None (edit)
Description Oneata Mircea Teodor 2018-03-27 07:17:15 EDT
This bug has been copied from bug #1551635 and has been proposed to be backported to 7.5 z-stream (EUS).
Comment 5 Nikhil Dehadrai 2018-04-11 04:13:11 EDT
Hi Rob, 

Could you suggest the steps in verifying this bug?

Thanks
Comment 6 Rob Crittenden 2018-04-11 08:19:09 EDT
Steps are in the parent bug, https://bugzilla.redhat.com/show_bug.cgi?id=1551635
Comment 9 Nikhil Dehadrai 2018-04-17 00:48:52 EDT
Certmonger version: certmonger-0.78.4-3.el7_5.1.x86_64

Verified the bug on the basis of following observations:
1. Setup RHEL 7.5.update1 system.
2. Check for certmonger package version (in my case certmonger-0.78.4-3.el7_5.1.x86_64)
3. Pull the CA certificate out of the PKCS#12 file with:

# ls -l /var/lib/certmonger/local/creds (checking if file exists)

# openssl pkcs12 -in /var/lib/certmonger/local/creds -out /tmp/ca.pem -nokeys -nodes -passin pass:''

4. Edit the file /tmp/ca.pem created in above step to drop the prefix before -----BEGIN CERTIFICATE----- to avoid an offset error.

# openssl asn1parse -in /tmp/ca.pem -inform pem

5. Noticed the HEX dump as below:
  
  543:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Basic Constraints
  548:d=5  hl=2 l=   1 prim: BOOLEAN           :255
  551:d=5  hl=2 l=   5 prim: OCTET STRING      [HEX DUMP]:30030101FF

6. Confirm that it works with Firefox generate a certificate using certmonger:

# getcert request -c local -f /etc/pki/tls/certs/local.crt -k /etc/pki/tls/private/local.key -U id-kp-clientAuth -U id-kp-serverAuth -u digitalSignature -u nonRepudiation -u keyEncipherment -u dataEncipherment

7. Install httpd and mod_ssl ( yum -y httpd mod_ssl)

Configure mod_ssl to use this certificate:

# vi /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/pki/tls/certs/local.crt
SSLCertificateKeyFile /etc/pki/tls/private/local.key

Add the CA to the global trust:

# cp /tmp/ca.pem /etc/pki/ca-trust/source/anchors/cm-local-ca.pem
# update-ca-trust 

8. Restart httpd, systemctl restart httpd

9. Launch firefox ( in my case Firefox version 57.0) and hit the host on port 443.

URL : https://<IP_addr>

In my case , it Returned with apache page upon accepting certificate.

Thus on the basis of above observations and comment#8, marking the status of bug to "VERIFIED".
Comment 12 errata-xmlrpc 2018-05-14 12:10:02 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1381

Note You need to log in before you can comment on or make changes to this bug.