Hide Forgot
Created attachment 1603670 [details] ca-external-step1.cfg Description of problem: pkispawn CA with external CA Signing Certificate shows import error. Version-Release number of selected component (if applicable): pki-server-10.6.9-1.fc28.noarch How reproducible: Steps to Reproduce: 1. Tested the procedure at https://github.com/dogtagpki/pki/blob/DOGTAG_10_6_BRANCH/docs/installation/Installing_CA_with_External_CA_Signing_Certificate.md 2. pkispawn of ca-external-step2.cfg shows following issue: 2019-08-14 10:44:53 pki.server : INFO Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg 2019-08-14 10:44:53 configuration : INFO Importing ca_signing CSR from ca_signing.csr 2019-08-14 10:44:53 configuration : INFO Importing ca_signing certificate from /root/.dogtag/ca_signing_pki_tomcat.crt 2019-08-14 10:44:53 pki.server : INFO Getting signing cert info for ca from CS.cfg 2019-08-14 10:44:53 pki.server : INFO Getting signing cert info for ca from NSS database 2019-08-14 10:44:53 pki.nssdb : DEBUG Command: certutil -L -d /var/lib/pki/pki-tomcat/alias -f /tmp/tmp799vsxdl/password.txt -n ca_signing -a 2019-08-14 10:44:53 pki.nssdb : DEBUG Command: pki -d /var/lib/pki/pki-tomcat/alias pkcs7-cert-export --pkcs7-file /tmp/tmpuv5xkyy0/cert_chain.p7b --output-prefix /tmp/tmpa2irwc5s/cert --output-suffix .crt 2019-08-14 10:44:54 pkispawn : ERROR CalledProcessError: Command '['pki', '-d', '/var/lib/pki/pki-tomcat/alias', 'pkcs7-cert-export', '--pkcs7-file', '/tmp/tmpuv5xkyy0/cert_chain.p7b', '--output-prefix', '/tmp/tmpa2irwc5s/cert', '--output-suffix', '.crt']' returned non-zero exit status 255. File "/usr/lib/python3.6/site-packages/pki/server/pkispawn.py", line 549, in main scriptlet.spawn(deployer) File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 617, in spawn self.import_system_certs(deployer, nssdb, subsystem) File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 201, in import_system_certs self.import_system_cert(deployer, nssdb, subsystem, 'signing', 'CT,C,C') File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 146, in import_system_cert trust_attributes=trust_attributes) File "/usr/lib/python3.6/site-packages/pki/nssdb.py", line 1283, in import_cert_chain trust_attributes=trust_attributes) File "/usr/lib/python3.6/site-packages/pki/nssdb.py", line 1315, in import_pkcs7 subprocess.check_call(cmd) File "/usr/lib64/python3.6/subprocess.py", line 311, in check_call raise CalledProcessError(retcode, cmd) Installation failed: Command failed: pki -d /var/lib/pki/pki-tomcat6/alias pkcs7-cert-export --pkcs7-file /tmp/tmpuv5xkyy0/cert_chain.p7b --output-prefix /tmp/tmpa2irwc5s/cert --output-suffix .crt 3. Installation failed. Actual results: Installation failed. Expected results: pkispawn should be successful. Additional info: attachments - ca-external-step1.cfg, ca-external-step2.cfg
Created attachment 1603673 [details] ca-external-step2.cfg
There is description for Fedora 30 (almost the same): Description of problem: pkispawn CA with external CA Signing Certificate shows import error. Version-Release number of selected component (if applicable): pki-server-10.6.9-1.fc28.noarch How reproducible: Steps to Reproduce: 1. Tested the procedure at https://github.com/dogtagpki/pki/blob/DOGTAG_10_6_BRANCH/docs/installation/Installing_CA_with_External_CA_Signing_Certificate.md 2. pkispawn of ca-external-step2.cfg shows following issue: [root@ca ~]# pkispawn -f ca-external-step2.cfg -s CA Log file: /var/log/pki/pki-ca-spawn.20190816095123.log Loading deployment configuration from ca-external-step2.cfg. Installing CA into /var/lib/pki/pki-tomcat. ParsingException: IOException: Sequence tag error 9 pkispawn : ERROR CalledProcessError: Command '['pki', '-d', '/var/lib/pki/pki-tomcat/alias', 'pkcs7-cert-export', '--pkcs7-file', '/tmp/tmpu4zs3ndj/cert_chain.p7b', '--output-prefix', '/tmp/tmp8i9yvzkw/cert', '--output-suffix', '.crt']' returned non-zero exit status 255. File "/usr/lib/python3.7/site-packages/pki/server/pkispawn.py", line 547, in main scriptlet.spawn(deployer) File "/usr/lib/python3.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 615, in spawn self.import_system_certs(deployer, nssdb, subsystem) File "/usr/lib/python3.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 199, in import_system_certs self.import_system_cert(deployer, nssdb, subsystem, 'signing', 'CT,C,C') File "/usr/lib/python3.7/site-packages/pki/server/deployment/scriptlets/configuration.py", line 144, in import_system_cert trust_attributes=trust_attributes) File "/usr/lib/python3.7/site-packages/pki/nssdb.py", line 1295, in import_cert_chain trust_attributes=trust_attributes) File "/usr/lib/python3.7/site-packages/pki/nssdb.py", line 1327, in import_pkcs7 subprocess.check_call(cmd) File "/usr/lib64/python3.7/subprocess.py", line 347, in check_call raise CalledProcessError(retcode, cmd) Installation failed: Command failed: pki -d /var/lib/pki/pki-tomcat/alias pkcs7-cert-export --pkcs7-file /tmp/tmpu4zs3ndj/cert_chain.p7b --output-prefix /tmp/tmp8i9yvzkw/cert --output-suffix .crt Please check pkispawn logs in /var/log/pki/pki-ca-spawn.20190816095123.log 3. Installation failed. Actual results: Installation failed. Expected results: pkispawn should be successful. Additional info: attachments - ca-external-step1.cfg, ca-external-step2.cfg
Version-Release number of selected component (for previous comment): pki-server-10.7.0-1.fc30.noarch
Can we hope to bugfix ? We are interested in integrating this system into our workflow, but unfortunately installation failing.
This message is a reminder that Fedora 30 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora 30 on 2020-05-26. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '30'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 30 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
@Pavel, I tried the 10.9 (master) version: https://github.com/dogtagpki/pki/blob/master/docs/installation/Installing_CA_with_External_CA_Signing_Certificate.md I was able to install a PKI server with external CA signed certificate. Did you check if the path to `ca_signing.csr` and `ca_signing_pki_tomcat.crt` is correct? These packages were built in my local. They should be the latest one on master branch ```` [root@mkd ~/install-configs] # rpm -qa | grep pki dogtag-pki-console-theme-10.9.0-0.1.20200430173457.05555d29.fc31.noarch bouncycastle-pkix-1.61-2.fc31.noarch pki-symkey-debuginfo-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-ocsp-10.9.0-0.1.20200430173457.05555d29.fc31.noarch krb5-pkinit-1.17-45.fc31.x86_64 pki-tools-debuginfo-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-console-10.9.0-0.1.20200430173457.05555d29.fc31.noarch pki-tks-10.9.0-0.1.20200430173457.05555d29.fc31.noarch pki-debugsource-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-tools-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-debuginfo-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-tps-debuginfo-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-tps-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-tests-10.9.0-0.1.20200430173457.05555d29.fc31.noarch pki-symkey-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-javadoc-10.9.0-0.1.20200430173457.05555d29.fc31.noarch python3-pki-10.9.0-0.1.20200430173457.05555d29.fc31.noarch pki-server-10.9.0-0.1.20200430173457.05555d29.fc31.noarch pki-base-10.9.0-0.1.20200430173457.05555d29.fc31.noarch dogtag-pki-server-theme-10.9.0-0.1.20200430173457.05555d29.fc31.noarch pki-ca-10.9.0-0.1.20200430173457.05555d29.fc31.noarch dogtag-pki-10.9.0-0.1.20200430173457.05555d29.fc31.x86_64 pki-base-java-10.9.0-0.1.20200430173457.05555d29.fc31.noarch pki-kra-10.9.0-0.1.20200430173457.05555d29.fc31.noarch [root@mkd ~/install-configs] # cat ca-step1.cfg [DEFAULT] pki_server_database_password=Secret.123 [CA] pki_admin_email=caadmin@example.com pki_admin_name=caadmin pki_admin_nickname=caadmin pki_admin_password=Secret.123 pki_admin_uid=caadmin pki_client_database_password=Secret.123 pki_client_database_purge=False pki_client_pkcs12_password=Secret.123 pki_ds_base_dn=dc=ca,dc=pki,dc=example,dc=com pki_ds_database=ca pki_ds_password=Secret.123 pki_security_domain_name=EXAMPLE pki_ca_signing_nickname=ca_signing pki_ocsp_signing_nickname=ca_ocsp_signing pki_audit_signing_nickname=ca_audit_signing pki_sslserver_nickname=sslserver pki_subsystem_nickname=subsystem pki_external=True pki_external_step_two=False pki_ca_signing_csr_path=ca_signing.csr [root@mkd ~/install-configs] # cat ca-step2.cfg [DEFAULT] pki_server_database_password=Secret.123 [CA] pki_admin_email=caadmin@example.com pki_admin_name=caadmin pki_admin_nickname=caadmin pki_admin_password=Secret.123 pki_admin_uid=caadmin pki_client_database_password=Secret.123 pki_client_database_purge=False pki_client_pkcs12_password=Secret.123 pki_ds_base_dn=dc=ca,dc=pki,dc=example,dc=com pki_ds_database=ca pki_ds_password=Secret.123 pki_security_domain_name=EXAMPLE pki_ca_signing_nickname=ca_signing pki_ocsp_signing_nickname=ca_ocsp_signing pki_audit_signing_nickname=ca_audit_signing pki_sslserver_nickname=sslserver pki_subsystem_nickname=subsystem pki_external=True pki_external_step_two=True pki_ca_signing_cert_path=ca_signing.crt #pki_ca_signing_csr_path=ca_signing.csr pki_cert_chain_nickname=external pki_cert_chain_path=external.crt [root@mkd ~/install-configs] # ls ca_signing.crt ca_signing.csr ca-step1.cfg ca-step2.cfg external.crt ```` Let me know if you need more info.
Fedora 30 changed to end-of-life (EOL) status on 2020-05-26. Fedora 30 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.