Bug 1741113 - Installing CA with external CA Signing Certificate shows import error
Summary: Installing CA with external CA Signing Certificate shows import error
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: pki-core
Version: 30
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Matthew Harmsen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-08-14 09:50 UTC by Pavel
Modified: 2023-09-14 05:41 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-05-26 14:38:02 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
ca-external-step1.cfg (1.21 KB, text/plain)
2019-08-14 09:50 UTC, Pavel
no flags Details
ca-external-step2.cfg (1.33 KB, text/plain)
2019-08-14 09:57 UTC, Pavel
no flags Details

Description Pavel 2019-08-14 09:50:33 UTC
Created attachment 1603670 [details]
ca-external-step1.cfg

Description of problem:
pkispawn CA with external CA Signing Certificate shows import error.

Version-Release number of selected component (if applicable):
pki-server-10.6.9-1.fc28.noarch

How reproducible:


Steps to Reproduce:
1. Tested the procedure at https://github.com/dogtagpki/pki/blob/DOGTAG_10_6_BRANCH/docs/installation/Installing_CA_with_External_CA_Signing_Certificate.md

2. pkispawn of ca-external-step2.cfg shows following issue:
2019-08-14 10:44:53 pki.server    : INFO     Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg
2019-08-14 10:44:53 configuration : INFO     Importing ca_signing CSR from ca_signing.csr
2019-08-14 10:44:53 configuration : INFO     Importing ca_signing certificate from /root/.dogtag/ca_signing_pki_tomcat.crt
2019-08-14 10:44:53 pki.server    : INFO     Getting signing cert info for ca from CS.cfg
2019-08-14 10:44:53 pki.server    : INFO     Getting signing cert info for ca from NSS database
2019-08-14 10:44:53 pki.nssdb     : DEBUG    Command: certutil -L -d /var/lib/pki/pki-tomcat/alias -f /tmp/tmp799vsxdl/password.txt -n ca_signing -a
2019-08-14 10:44:53 pki.nssdb     : DEBUG    Command: pki -d /var/lib/pki/pki-tomcat/alias pkcs7-cert-export --pkcs7-file /tmp/tmpuv5xkyy0/cert_chain.p7b --output-prefix /tmp/tmpa2irwc5s/cert --output-suffix .crt
2019-08-14 10:44:54 pkispawn      : ERROR    CalledProcessError: Command '['pki', '-d', '/var/lib/pki/pki-tomcat/alias', 'pkcs7-cert-export', '--pkcs7-file', '/tmp/tmpuv5xkyy0/cert_chain.p7b', '--output-prefix', '/tmp/tmpa2irwc5s/cert', '--output-suffix', '.crt']' returned non-zero exit status 255.
  File "/usr/lib/python3.6/site-packages/pki/server/pkispawn.py", line 549, in main
    scriptlet.spawn(deployer)
  File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 617, in spawn
    self.import_system_certs(deployer, nssdb, subsystem)
  File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 201, in import_system_certs
    self.import_system_cert(deployer, nssdb, subsystem, 'signing', 'CT,C,C')
  File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 146, in import_system_cert
    trust_attributes=trust_attributes)
  File "/usr/lib/python3.6/site-packages/pki/nssdb.py", line 1283, in import_cert_chain
    trust_attributes=trust_attributes)
  File "/usr/lib/python3.6/site-packages/pki/nssdb.py", line 1315, in import_pkcs7
    subprocess.check_call(cmd)
  File "/usr/lib64/python3.6/subprocess.py", line 311, in check_call
    raise CalledProcessError(retcode, cmd)

Installation failed: Command failed: pki -d /var/lib/pki/pki-tomcat6/alias pkcs7-cert-export --pkcs7-file /tmp/tmpuv5xkyy0/cert_chain.p7b --output-prefix /tmp/tmpa2irwc5s/cert --output-suffix .crt

3. Installation failed.

Actual results:
Installation failed.

Expected results:
pkispawn should be successful.

Additional info:
attachments - ca-external-step1.cfg, ca-external-step2.cfg

Comment 1 Pavel 2019-08-14 09:57:00 UTC
Created attachment 1603673 [details]
ca-external-step2.cfg

Comment 2 Pavel 2019-08-16 06:58:57 UTC
There is description for Fedora 30 (almost the same):

Description of problem:
pkispawn CA with external CA Signing Certificate shows import error.

Version-Release number of selected component (if applicable):
pki-server-10.6.9-1.fc28.noarch

How reproducible:


Steps to Reproduce:
1. Tested the procedure at https://github.com/dogtagpki/pki/blob/DOGTAG_10_6_BRANCH/docs/installation/Installing_CA_with_External_CA_Signing_Certificate.md

2. pkispawn of ca-external-step2.cfg shows following issue:
[root@ca ~]# pkispawn -f ca-external-step2.cfg -s CA
Log file: /var/log/pki/pki-ca-spawn.20190816095123.log
Loading deployment configuration from ca-external-step2.cfg.
Installing CA into /var/lib/pki/pki-tomcat.
ParsingException: IOException: Sequence tag error 9
pkispawn      : ERROR    CalledProcessError: Command '['pki', '-d', '/var/lib/pki/pki-tomcat/alias', 'pkcs7-cert-export', '--pkcs7-file', '/tmp/tmpu4zs3ndj/cert_chain.p7b', '--output-prefix', '/tmp/tmp8i9yvzkw/cert', '--output-suffix', '.crt']' returned non-zero exit status 255.
  File "/usr/lib/python3.7/site-packages/pki/server/pkispawn.py", line 547, in main
    scriptlet.spawn(deployer)
  File "/usr/lib/python3.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 615, in spawn
    self.import_system_certs(deployer, nssdb, subsystem)
  File "/usr/lib/python3.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 199, in import_system_certs
    self.import_system_cert(deployer, nssdb, subsystem, 'signing', 'CT,C,C')
  File "/usr/lib/python3.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 144, in import_system_cert
    trust_attributes=trust_attributes)
  File "/usr/lib/python3.7/site-packages/pki/nssdb.py", line 1295, in import_cert_chain
    trust_attributes=trust_attributes)
  File "/usr/lib/python3.7/site-packages/pki/nssdb.py", line 1327, in import_pkcs7
    subprocess.check_call(cmd)
  File "/usr/lib64/python3.7/subprocess.py", line 347, in check_call
    raise CalledProcessError(retcode, cmd)


Installation failed: Command failed: pki -d /var/lib/pki/pki-tomcat/alias pkcs7-cert-export --pkcs7-file /tmp/tmpu4zs3ndj/cert_chain.p7b --output-prefix /tmp/tmp8i9yvzkw/cert --output-suffix .crt

Please check pkispawn logs in /var/log/pki/pki-ca-spawn.20190816095123.log

3. Installation failed.

Actual results:
Installation failed.

Expected results:
pkispawn should be successful.

Additional info:
attachments - ca-external-step1.cfg, ca-external-step2.cfg

Comment 3 Pavel 2019-08-16 07:01:57 UTC
Version-Release number of selected component (for previous comment):
pki-server-10.7.0-1.fc30.noarch

Comment 4 Pavel 2019-08-19 12:43:58 UTC
Can we hope to bugfix ? We are interested in integrating this system into our workflow, but unfortunately installation failing.

Comment 5 Ben Cotton 2020-04-30 21:19:51 UTC
This message is a reminder that Fedora 30 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora 30 on 2020-05-26.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
Fedora 'version' of '30'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 30 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 6 Dinesh Prasanth 2020-05-01 16:26:10 UTC
@Pavel,

I tried the 10.9 (master) version: https://github.com/dogtagpki/pki/blob/master/docs/installation/Installing_CA_with_External_CA_Signing_Certificate.md

I was able to install a PKI server with external CA signed certificate. Did you check if the path to `ca_signing.csr` and `ca_signing_pki_tomcat.crt` is correct?


These packages were built in my local. They should be the latest one on master branch
````
[root@mkd ~/install-configs] # rpm -qa | grep pki
dogtag-pki-console-theme-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
bouncycastle-pkix-1.61-2.fc31.noarch
pki-symkey-debuginfo-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-ocsp-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
krb5-pkinit-1.17-45.fc31.x86_64
pki-tools-debuginfo-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-console-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
pki-tks-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
pki-debugsource-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-tools-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-debuginfo-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-tps-debuginfo-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-tps-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-tests-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
pki-symkey-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-javadoc-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
python3-pki-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
pki-server-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
pki-base-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
dogtag-pki-server-theme-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
pki-ca-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
dogtag-pki-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64
pki-base-java-10.9.0-0.1.20200430173457.05555d29.fc31.noarch
pki-kra-10.9.0-0.1.20200430173457.05555d29.fc31.noarch




[root@mkd ~/install-configs] # cat ca-step1.cfg 
[DEFAULT]
pki_server_database_password=Secret.123

[CA]
pki_admin_email=caadmin
pki_admin_name=caadmin
pki_admin_nickname=caadmin
pki_admin_password=Secret.123
pki_admin_uid=caadmin

pki_client_database_password=Secret.123
pki_client_database_purge=False
pki_client_pkcs12_password=Secret.123

pki_ds_base_dn=dc=ca,dc=pki,dc=example,dc=com
pki_ds_database=ca
pki_ds_password=Secret.123

pki_security_domain_name=EXAMPLE

pki_ca_signing_nickname=ca_signing
pki_ocsp_signing_nickname=ca_ocsp_signing
pki_audit_signing_nickname=ca_audit_signing
pki_sslserver_nickname=sslserver
pki_subsystem_nickname=subsystem

pki_external=True
pki_external_step_two=False

pki_ca_signing_csr_path=ca_signing.csr





[root@mkd ~/install-configs] # cat ca-step2.cfg 
[DEFAULT]
pki_server_database_password=Secret.123

[CA]
pki_admin_email=caadmin
pki_admin_name=caadmin
pki_admin_nickname=caadmin
pki_admin_password=Secret.123
pki_admin_uid=caadmin

pki_client_database_password=Secret.123
pki_client_database_purge=False
pki_client_pkcs12_password=Secret.123

pki_ds_base_dn=dc=ca,dc=pki,dc=example,dc=com
pki_ds_database=ca
pki_ds_password=Secret.123

pki_security_domain_name=EXAMPLE

pki_ca_signing_nickname=ca_signing
pki_ocsp_signing_nickname=ca_ocsp_signing
pki_audit_signing_nickname=ca_audit_signing
pki_sslserver_nickname=sslserver
pki_subsystem_nickname=subsystem

pki_external=True
pki_external_step_two=True

pki_ca_signing_cert_path=ca_signing.crt

#pki_ca_signing_csr_path=ca_signing.csr

pki_cert_chain_nickname=external
pki_cert_chain_path=external.crt



[root@mkd ~/install-configs]  # ls
ca_signing.crt  ca_signing.csr  ca-step1.cfg  ca-step2.cfg  external.crt

````


Let me know if you need more info.

Comment 7 Ben Cotton 2020-05-26 14:38:02 UTC
Fedora 30 changed to end-of-life (EOL) status on 2020-05-26. Fedora 30 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 8 Red Hat Bugzilla 2023-09-14 05:41:39 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days


Note You need to log in before you can comment on or make changes to this bug.