Bug 1655951 - CC: tools supporting CMC requests output keyID needs to be captured in file [rhel-7.6.z]
Summary: CC: tools supporting CMC requests output keyID needs to be captured in file [...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: pki-core
Version: 7.7
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Christina Fu
QA Contact: Asha Akkiangady
Marc Muehlfeld
URL:
Whiteboard:
Depends On: 1653863
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-12-04 10:16 UTC by RAD team bot copy to z-stream
Modified: 2019-01-29 17:22 UTC (History)
4 users (show)

Fixed In Version: pki-core-10.5.9-8.el7_6
Doc Type: Bug Fix
Doc Text:
The CMCRequest utility in Certificate System requires the private key IDs the CRMFPopClient and PKCS10Client utilities show in their output. With this update, CRMFPopClient and PKCS10Client additionally write the key IDs into a file in case the administrator wants to run CMCRequest later. As a result, it is no longer necessary to manually track the IDs in this scenario. This update also changes the following profile names: * caECFullCMCSelfSignedCert.cfg to caECFullCMCSharedTokenCert.cfg * caFullCMCSelfSignedCert.cfg to caFullCMCSharedTokenCert.cfg Additionally, this update changes the constraint name CMCSelfSignedSubjectNameConstraint to CMCSharedTokenSubjectNameConstraint.
Clone Of: 1653863
Environment:
Last Closed: 2019-01-29 17:21:57 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:0168 0 None None None 2019-01-29 17:22:00 UTC

Description RAD team bot copy to z-stream 2018-12-04 10:16:37 UTC
This bug has been copied from bug #1653863 and has been proposed to be backported to 7.6 z-stream (EUS).

Comment 2 Christina Fu 2018-12-04 22:34:05 UTC
commit cb99e112b9421f6fe98b4ac5ab5885c28ee958c3 (HEAD -> DOGTAG_10_5_BRANCH, bug1653863-CMC-tools-keyID)
Author: Christina Fu <cfu@redhat.com>
Date:   Fri Nov 9 11:06:57 2018 -0800

    bug 1653863 tools supporting CMC requests output keyID needs to be captured in file
    
    This patch adds code in both CRMFPopClient and PKCS10Client to automatically
    write the private key id into a file named <output>.keyId so that
    they can be featched later for CMCRequest
    <output>is the name of the file specified with the "-o" option.
    
    This patch also changed all references from "CMC self-test" to
    "CMC shared secret" instead.
    
    A test feature is also added to CMCRequest.
    
    fixes https://bugzilla.redhat.com/show_bug.cgi?id=1655951
    
    Change-Id: Iaf2772be54f9937da456655cdec688f13f6e8b71

Comment 3 Christina Fu 2018-12-04 23:00:26 UTC
Testing procedure:

To test changes to CRMFPopClient, run and see if it writes the private key into a file.  e.g.

# CRMFPopClient -d . -p mypass -n "cn=Christina Fu, uid=user1a, ou=yesPOP" -q POP_SUCCESS -b kra.transport -a ec -v -o crmf.pop.req
...
Keypair private key id: 5678a18f83b7f8c4e33339889492fffe736dd3a7
...
Storing CRMF request into crmf.pop.req
Storing CRMF request key id into crmf.pop.req.keyId
# cat crmf.pop.req.keyId
5678a18f83b7f8c4e33339889492fffe736dd3a7

(compare and see if the content of crmf.pop.req.keyId is the same as the output on command line)

===
Same thing with testing PKCS10Client. e.g.
PKCS10Client -d . -p netscape -a ec -c nistp256 -o p10-ec.req -n "CN=cfuEC"
...
Keypair private key id: -50988bef7933b6e76feb65ef15284c94bf50e676
...
PKCS10Client: done. Certificate request written into p10-ec.req
PKCS10Client: PKCS#10 request key id written into p10-ec.req.keyId

# cat p10-ec.req.keyId
-50988bef7933b6e76feb65ef15284c94bf50e676
(compare and see if the content of crmf.pop.req.keyId is the same as the output on command line)

===
Testing for the changes from "self-sign" to "shared secret" (note: there was a typo in the checkin message that calls it "self-test").
The "request.selfSign" directive has been changed to "request.useSharedSecret" for CMCRequest.

* on the command line, PKCS10Client, CRMFPopClient, and CMCRequest, all references of "self-sign" (and varies other spellings) have been changed to "shared secret" (with varies spellings).
* on Man pages, both PKCS10Client and CMCRequest are changed as well.
* two profile names are changed:
caECFullCMCSelfSignedCert.cfg ==> caECFullCMCSharedTokenCert.cfg
caFullCMCSelfSignedCert.cfg ==> caFullCMCSharedTokenCert.cfg
where a constraint name is also changed:
CMCSelfSignedSubjectNameConstraint ==> CMCSharedTokenSubjectNameConstraint

===
The "test feature" that was added to CMCRequest does not need to be tested.  It was developed specifically for Gossamer.

Comment 4 Christina Fu 2018-12-04 23:10:07 UTC
changes needed for Guidance doc is tracked separately by the following Trello card:
https://trello.com/c/5p31gbTr/368-cc-doc-replace-cmc-self-sign-references-with-shared-secret

I'm putting this bug on "POST" (given that the guidance doc changes is tracked and will be complete soon)

Comment 5 Matthew Harmsen 2018-12-05 19:16:04 UTC
DOGTAG_10_5_9_RHEL_BRANCH:

commit 253f16813de60b1951b769a437c92322e36647bf
Author: Christina Fu <cfu@redhat.com>
Date:   Fri Nov 9 11:06:57 2018 -0800

    bug 1653863 tools supporting CMC requests output keyID needs to be captured 
    
    This patch adds code in both CRMFPopClient and PKCS10Client to automatically
    write the private key id into a file named <output>.keyId so that
    they can be featched later for CMCRequest
    <output>is the name of the file specified with the "-o" option.
    
    This patch also changed all references from "CMC self-test" to
    "CMC shared secret" instead.
    
    A test feature is also added to CMCRequest.
    
    fixes https://bugzilla.redhat.com/show_bug.cgi?id=1655951
    
    Change-Id: Iaf2772be54f9937da456655cdec688f13f6e8b71
    (cherry picked from commit cb99e112b9421f6fe98b4ac5ab5885c28ee958c3)

Comment 8 Christina Fu 2019-01-07 16:55:02 UTC
doc text looks fine.

Comment 10 Amol K 2019-01-16 17:52:25 UTC
Verified this BZ using steps which are mentioned in #c3.

1. CRMFPopClient and PKCS10Client stores the password in testuser.req.KeyID
2. Man pages and command help messages are updated for CMCRequest.
3. Mentioned profiles are replaced
   - caECFullCMCSelfSignedCert.cfg -> caECFullCMCSharedTokenCert.cfg
   - caFullCMCSelfSignedCert.cfg -> caFullCMCSharedTokenCert.cfg
4. Profile constraint changed from CMCSelfSignedSubjectNameConstraint to CMCSharedTokenSubjectNameConstraint.


Verifying this Bugzilla.

Version: 10.5.9-10.el7_6

Comment 12 errata-xmlrpc 2019-01-29 17:21:57 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0168


Note You need to log in before you can comment on or make changes to this bug.