Bug 1577014 - Missing "-name" option on "openssl pkcs12" command may cause incorrect nickname added to the katello nssdb
Summary: Missing "-name" option on "openssl pkcs12" command may cause incorrect nickna...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite 6
Classification: Red Hat
Component: Certificates
Version: 6.3.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium vote
Target Milestone: Released
Assignee: Chris Roberts
QA Contact: Stephen Wadeley
URL: https://projects.theforeman.org/issue...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-05-11 02:16 UTC by Hao Chang Yu
Modified: 2019-10-07 17:20 UTC (History)
6 users (show)

Fixed In Version: katello-installer-3.9.0-rc2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-05-14 12:37:19 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1222 None None None 2019-05-14 12:37:27 UTC
Github theforeman puppet-certs pull 223 None None None 2018-10-31 16:25:18 UTC
Foreman Issue Tracker 25359 None None None 2018-10-31 16:25:05 UTC

Description Hao Chang Yu 2018-05-11 02:16:30 UTC
Description of problem:
Below is the steps that satellite-installer create the Qpid broker certficate to the katello nssdb

1) Delete the "broker" certificate from nssdb
-------------------------
Executing 'certutil -D -d /etc/pki/katello/nssdb -n 'broker''
-------------------------

2) Import broker certificate to nssdb. It looks like something strange could happen here. Certutil returns 0 exit code but the "broker" certificate was not created. I am also not able to reproduce it but it happened in a case.
-------------------------
Executing 'certutil -A -d '/etc/pki/katello/nssdb' -n 'broker' -t ',,' -a -i '/etc/pki/katello/certs/satellite.example.com-qpid-broker.crt''
-------------------------

3) Convert the broker private key and certificate to pkcs12 format. There is a problem in this command. It should pass a certname option ("-name broker") but it didn't. Therefore, a "pfx" file without nickname was created.
-------------------------
Executing 'openssl pkcs12 -in /etc/pki/katello/certs/satellite.example.com-qpid-broker.crt -inkey /etc/pki/katello/private/satellite.example.com-qpid-broker.key -export -out '/etc/pki/katello/satellite.example.com-qpid-broker.pfx' -password 'file:/etc/pki/katello/nssdb/nss_db_password-file''
-------------------------

4) Import the generated "pfx" file to nssdb using pk12util command. Since no nickname is provided by the "pfx" file, it will generate a nickname in the format of "{Common Name} - {Org}". In this case "satellite.example.com - SomeOrg". 
-------------------------
Executing 'pk12util -i '/etc/pki/katello/satellite.example.com-qpid-broker.pfx' -d '/etc/pki/katello/nssdb' -w '/etc/pki/katello/nssdb/nss_db_password-file' -k '/etc/pki/katello/nssdb/nss_db_password-file''
-------------------------

To prevent the above issue, I suggest to add "-name broker" to the "openssl pkcs12" command in step (3). I also think that the "certutil -A" command in step (2) is not needed. Since we are going to import both broker private key and ssl certificate using "pk12util" command in step (4), why do we still need to run "certutil -A"?


Reproducing from terminal:

$ certutil -L -d .
-------------------------
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

amqp-client                                                  ,,   
ca                                                           CT,C,c
-------------------------

$ openssl pkcs12 -in /etc/pki/katello/certs/mysatellite-example.com-qpid-broker.crt -inkey /etc/pki/katello/private/mysatellite-example.com-qpid-broker.key -export -out '/etc/pki/katello/mysatellite-example.com-qpid-broker.pfx' -password 'file:/etc/pki/katello/nssdb/nss_db_password-file'


pk12util -i '/etc/pki/katello/mysatellite-example.com-qpid-broker.pfx' -d '/etc/pki/katello/nssdb' -w '/etc/pki/katello/nssdb/nss_db_password-file' -k '/etc/pki/katello/nssdb/nss_db_password-file'
-------------------------
pk12util: no nickname for cert in PKCS12 file.    <=============================== ########## Complain about missing nickname ###########
pk12util: using nickname: mysatellite-example.com - Katello <=============================== ########## "{Common Name} - {Org}" nickname is used ###########
pk12util: PKCS12 IMPORT SUCCESSFUL
-------------------------


certutil -L -d .
-------------------------
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

amqp-client                                                  ,,   
ca                                                           CT,C,c
mysatellite-example.com - Katello                            u,u,u   <===============================
-------------------------

Comment 15 errata-xmlrpc 2019-05-14 12:37:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:1222


Note You need to log in before you can comment on or make changes to this bug.