Bug 1869893 - Common certificates are missing in CS.cfg on shared PKI instance
Summary: Common certificates are missing in CS.cfg on shared PKI instance
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: pki-core
Version: 8.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Endi Sukma Dewata
QA Contact: PKI QE
URL:
Whiteboard:
: 1871188 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-08-18 23:06 UTC by Dinesh Prasanth
Modified: 2020-11-04 03:16 UTC (History)
9 users (show)

Fixed In Version: pki-core-10.6-8030020200903170610.5ff1562f
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-11-04 03:15:52 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github dogtagpki pki issues 3319 0 None closed pki-healthcheck generates error on a clean KRA installation 2020-11-02 16:29:38 UTC
Red Hat Product Errata RHSA-2020:4847 0 None None None 2020-11-04 03:16:15 UTC

Description Dinesh Prasanth 2020-08-18 23:06:08 UTC
Description of problem:

In shared PKI instances, the `subsystem` and `sslserver` certificates
are missing in CS.cfg of KRA, OCSP, TKS and TPS subsystems. This seems
to be happening ONLY in the recent deployments (New instances deployed
after ~Apr 2020).

The error was caught by pki-healthcheck tool.

````
Following keys are missing in corresponding CS.cfg:

{kra,ocsp,tks,tps}.subsystem.cert=
{kra,ocsp,tks,tps}.sslserver.cert=
````

Version-Release number of selected component (if applicable):
# rpm -qa | grep pki
pki-base-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-symkey-10.9.1-1.module+el8.3.0+7594+3661a26e.x86_64
pki-tps-10.9.1-1.module+el8pki+7595+528e2489.x86_64
python3-pki-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-servlet-4.0-api-9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch
pki-base-java-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-servlet-engine-9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch
pki-server-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-kra-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-tks-10.9.1-1.module+el8pki+7595+528e2489.noarch
pki-tools-10.9.1-1.module+el8.3.0+7594+3661a26e.x86_64
pki-ca-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-ocsp-10.9.1-1.module+el8pki+7595+528e2489.noarch


How reproducible:
Always

Steps to Reproduce:
1. Install CA, KRA (,OCSP, TKS, TPS) on a shared instance (eg: pki-tomcat)
2. Run `pki-healthcheck`
3.

Actual results:
# pki-healthcheck --failures-only
[
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "KRADogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "f9bca17f-b12c-455c-b23e-f0c04304344d",
    "when": "20200818215836Z",
    "duration": "0.104007",
    "kw": {
      "key": "kra_sslserver",
      "nickname": "Server-Cert cert-pki-tomcat",
      "directive": "kra.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-tomcat' does not match the value of kra.sslserver.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "KRADogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "4d24134c-3d90-40c3-8b24-bdab2583f9fb",
    "when": "20200818215836Z",
    "duration": "0.185620",
    "kw": {
      "key": "kra_subsystem",
      "nickname": "subsystemCert cert-pki-tomcat",
      "directive": "kra.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-tomcat' does not match the value of kra.subsystem.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "OCSPDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "e865254b-28e2-4458-ad30-5203a44446d1",
    "when": "20200818215836Z",
    "duration": "0.104308",
    "kw": {
      "key": "ocsp_sslserver",
      "nickname": "Server-Cert cert-pki-tomcat",
      "directive": "ocsp.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-tomcat' does not match the value of ocsp.sslserver.cert in /var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "OCSPDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "a1321228-7f1f-40a1-a070-f43fd7c6a7cf",
    "when": "20200818215836Z",
    "duration": "0.185781",
    "kw": {
      "key": "ocsp_subsystem",
      "nickname": "subsystemCert cert-pki-tomcat",
      "directive": "ocsp.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-tomcat' does not match the value of ocsp.subsystem.cert in /var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "TKSDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "7bedbe0e-9076-4fd1-a401-50ddbc75c58c",
    "when": "20200818215837Z",
    "duration": "0.103956",
    "kw": {
      "key": "tks_sslserver",
      "nickname": "Server-Cert cert-pki-tomcat",
      "directive": "tks.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/tks/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-tomcat' does not match the value of tks.sslserver.cert in /var/lib/pki/pki-tomcat/tks/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "TKSDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "004513ce-d798-423c-aaf3-f377e3757c2e",
    "when": "20200818215837Z",
    "duration": "0.185525",
    "kw": {
      "key": "tks_subsystem",
      "nickname": "subsystemCert cert-pki-tomcat",
      "directive": "tks.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/tks/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-tomcat' does not match the value of tks.subsystem.cert in /var/lib/pki/pki-tomcat/tks/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "TPSDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "a0d1e203-8b33-4d28-b7cc-031a3dd88cb2",
    "when": "20200818215837Z",
    "duration": "0.104213",
    "kw": {
      "key": "tps_sslserver",
      "nickname": "Server-Cert cert-pki-tomcat",
      "directive": "tps.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/tps/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-tomcat' does not match the value of tps.sslserver.cert in /var/lib/pki/pki-tomcat/tps/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "TPSDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "3fb343e4-e052-4cdc-9af3-ed51864aa5ad",
    "when": "20200818215837Z",
    "duration": "0.185737",
    "kw": {
      "key": "tps_subsystem",
      "nickname": "subsystemCert cert-pki-tomcat",
      "directive": "tps.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/tps/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-tomcat' does not match the value of tps.subsystem.cert in /var/lib/pki/pki-tomcat/tps/conf/CS.cfg"
    }
  }
]


Expected results:
# pki-healthcheck --failures-only
[]

(No ERRORs reported)

Additional info:
1. It was also observed in ipa-healthcheck: https://pagure.io/dogtagpki/issue/3202

2. Based on initial investigation, this part of the code might be causing the issue: https://github.com/dogtagpki/pki/blob/master/base/server/python/pki/server/deployment/__init__.py#L349-L355

3.  Though the subsystems seem to be working without errors so far, we
still would like to have copies of the cert in CS.cfg...
In future, these redundant copies of cert will be
removed from CS.cfg and the code will be altered to retrieve
certs from its NSSDB.

Comment 1 Dinesh Prasanth 2020-08-21 15:33:12 UTC
*** Bug 1871188 has been marked as a duplicate of this bug. ***

Comment 5 Endi Sukma Dewata 2020-08-31 20:30:41 UTC
Fixed in master branch (10.10):
* https://github.com/dogtagpki/pki/commit/e117f897a43b7f2ded0edbb204110357c29da2c0

Comment 16 errata-xmlrpc 2020-11-04 03:15:52 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4847


Note You need to log in before you can comment on or make changes to this bug.