RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1727835 - cacert.p12 fails to get imported.
Summary: cacert.p12 fails to get imported.
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: pki-core
Version: 8.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.3
Assignee: RHCS Maintainers
QA Contact: PKI QE
URL:
Whiteboard:
Depends On: 1732428
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-08 10:27 UTC by Sudhir Menon
Modified: 2021-01-27 19:30 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-01-27 19:29:56 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
cert-import (26.16 KB, text/plain)
2019-07-08 10:36 UTC, Sudhir Menon 		no flags Details
pk12 file (12.07 KB, application/octet-stream)
2019-07-10 05:39 UTC, Sudhir Menon 		no flags Details
View All

Description Sudhir Menon 2019-07-08 10:27:47 UTC 
Description of problem: cacert.p12 fails to get imported.

Version-Release number of selected component (if applicable):
ipa-server-4.8.0-1.module+el8.1.0+3577+202f0a51.x86_64

How reproducible: Always

Steps to Reproduce:
1. Install IPA server. Ensure cacert.p12 file is present
2. Try to import the file using the pki command.

#pki -v -d  /tmp/test -c Secret123 -p 8080 client-cert-import --pkcs12 /root/cacert.p12 --pkcs12-password Secret123

Actual results:
[root@ipa ~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.1 Beta (Ootpa)

[root@ipa test]# pki -v -d  /tmp/test -c Secret123 -p 8080 client-cert-import --pkcs12 /root/cacert.p12 --pkcs12-password Secret123
PKI options: -v -d /tmp/test -c Secret123
PKI command: 8080 -p 8080 client-cert-import --pkcs12 /root/cacert.p12 --pkcs12-password Secret123
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -Djava.ext.dirs=/usr/share/pki/lib -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d /tmp/test -c Secret123 --verbose -p 8080 client-cert-import --pkcs12 /root/cacert.p12 --pkcs12-password Secret123
Server URL: http://ipa.example.test:8080
NSS database: /tmp/test
Message format: null
Command: client-cert-import --pkcs12 /root/cacert.p12 --pkcs12-password Secret123
Module: client
Module: cert-import
Importing certificates from /root/cacert.p12.
External command: /usr/bin/pk12util -d /tmp/test -k /tmp/pki-client-cert-import-4556096729051108750.nssdb-pwd -i /root/cacert.p12 -w /tmp/pki-client-cert-import-1914323035172484393.pkcs12-pwd
java.lang.Exception: Unable to import PKCS #12 file
        at com.netscape.cmstools.client.ClientCertImportCLI.importPKCS12(ClientCertImportCLI.java:490)
        at com.netscape.cmstools.client.ClientCertImportCLI.execute(ClientCertImportCLI.java:231)
        at org.dogtagpki.cli.CLI.execute(CLI.java:345)
        at org.dogtagpki.cli.CLI.execute(CLI.java:345)
        at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:667)
        at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:703)
Caused by: org.dogtagpki.cli.CLIException: External command failed. RC: 18
        at org.dogtagpki.cli.CLI.runExternal(CLI.java:386)
        at org.dogtagpki.cli.CLI.runExternal(CLI.java:358)
        at com.netscape.cmstools.client.ClientCertImportCLI.importPKCS12(ClientCertImportCLI.java:488)
        ... 5 more
ERROR: Command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -Djava.ext.dirs=/usr/share/pki/lib -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d /tmp/test -c Secret123 --verbose -p 8080 client-cert-import --pkcs12 /root/cacert.p12 --pkcs12-password Secret123

Expected results: The cacert.p12 file should get imported. It works in RHEL7.7

Additional info: Attaching the logs for reference.
Comment 1 Sudhir Menon 2019-07-08 10:36:04 UTC 
Created attachment 1588330 [details]
cert-import
Comment 2 Endi Sukma Dewata 2019-07-08 15:16:45 UTC 
In this scenario the pki client-cert-import simply wraps pk12util command.
As shown in the attached logs, the pk12util itself failed:

$ pk12util -v -d /tmp/test -i cacert.p12 
Enter Password or Pin for "NSS Certificate DB":
Enter password for PKCS12 file: 
pk12util: PKCS12 decode validate bags failed: SEC_ERROR_PKCS12_UNABLE_TO_IMPORT_KEY: Unable to import.  Error attempting to import private key.

Since pk12util is an NSS tool, I'm moving this bug to NSS.
Comment 3 Daiki Ueno 2019-07-09 11:06:07 UTC 
Could you please attach the cacert.p12 file?
Comment 4 Sudhir Menon 2019-07-10 05:39:57 UTC 
Created attachment 1588987 [details]
pk12 file
Comment 15 Matthew Harmsen 2020-04-14 22:36:17 UTC 
Not RPL, not CVE, no external customer case information, not regression (e.g. - fixed in an earlier release of the product); although this bug was generated by IPA, since there is a workaround, moving it to RHEL Backlog.
Comment 19 Alex Scheel 2021-01-27 19:29:56 UTC 
I tried this on a  recent F33 install and it works for me. Closing. Feel free to reopen if this is still a problem.
Note You need to log in before you can comment on or make changes to this bug.