1869893 – Common certificates are missing in CS.cfg on shared PKI instance

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1869893 - Common certificates are missing in CS.cfg on shared PKI instance

Summary: Common certificates are missing in CS.cfg on shared PKI instance

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 8
Classification:	Red Hat
Component:	pki-core
Sub Component:
Version:	8.3
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	8.0
Assignee:	Endi Sukma Dewata
QA Contact:	PKI QE
Docs Contact:
URL:
Whiteboard:
Duplicates (1):	1871188 (view as bug list)
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2020-08-18 23:06 UTC by Dinesh Prasanth
Modified:	2020-11-04 03:16 UTC (History)
CC List:	9 users (show)
Fixed In Version:	pki-core-10.6-8030020200903170610.5ff1562f
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2020-11-04 03:15:52 UTC
Type:	Bug
Target Upstream Version:
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Github	dogtagpki pki issues 3319	0	None	closed	pki-healthcheck generates error on a clean KRA installation	2020-11-02 16:29:38 UTC
Red Hat Product Errata	RHSA-2020:4847	0	None	None	None	2020-11-04 03:16:15 UTC

Description Dinesh Prasanth 2020-08-18 23:06:08 UTC

Description of problem:

In shared PKI instances, the `subsystem` and `sslserver` certificates
are missing in CS.cfg of KRA, OCSP, TKS and TPS subsystems. This seems
to be happening ONLY in the recent deployments (New instances deployed
after ~Apr 2020).

The error was caught by pki-healthcheck tool.

````
Following keys are missing in corresponding CS.cfg:

{kra,ocsp,tks,tps}.subsystem.cert=
{kra,ocsp,tks,tps}.sslserver.cert=
````

Version-Release number of selected component (if applicable):
# rpm -qa | grep pki
pki-base-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-symkey-10.9.1-1.module+el8.3.0+7594+3661a26e.x86_64
pki-tps-10.9.1-1.module+el8pki+7595+528e2489.x86_64
python3-pki-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-servlet-4.0-api-9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch
pki-base-java-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-servlet-engine-9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch
pki-server-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-kra-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-tks-10.9.1-1.module+el8pki+7595+528e2489.noarch
pki-tools-10.9.1-1.module+el8.3.0+7594+3661a26e.x86_64
pki-ca-10.9.1-1.module+el8.3.0+7594+3661a26e.noarch
pki-ocsp-10.9.1-1.module+el8pki+7595+528e2489.noarch


How reproducible:
Always

Steps to Reproduce:
1. Install CA, KRA (,OCSP, TKS, TPS) on a shared instance (eg: pki-tomcat)
2. Run `pki-healthcheck`
3.

Actual results:
# pki-healthcheck --failures-only
[
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "KRADogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "f9bca17f-b12c-455c-b23e-f0c04304344d",
    "when": "20200818215836Z",
    "duration": "0.104007",
    "kw": {
      "key": "kra_sslserver",
      "nickname": "Server-Cert cert-pki-tomcat",
      "directive": "kra.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-tomcat' does not match the value of kra.sslserver.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "KRADogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "4d24134c-3d90-40c3-8b24-bdab2583f9fb",
    "when": "20200818215836Z",
    "duration": "0.185620",
    "kw": {
      "key": "kra_subsystem",
      "nickname": "subsystemCert cert-pki-tomcat",
      "directive": "kra.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/kra/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-tomcat' does not match the value of kra.subsystem.cert in /var/lib/pki/pki-tomcat/kra/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "OCSPDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "e865254b-28e2-4458-ad30-5203a44446d1",
    "when": "20200818215836Z",
    "duration": "0.104308",
    "kw": {
      "key": "ocsp_sslserver",
      "nickname": "Server-Cert cert-pki-tomcat",
      "directive": "ocsp.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-tomcat' does not match the value of ocsp.sslserver.cert in /var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "OCSPDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "a1321228-7f1f-40a1-a070-f43fd7c6a7cf",
    "when": "20200818215836Z",
    "duration": "0.185781",
    "kw": {
      "key": "ocsp_subsystem",
      "nickname": "subsystemCert cert-pki-tomcat",
      "directive": "ocsp.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-tomcat' does not match the value of ocsp.subsystem.cert in /var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "TKSDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "7bedbe0e-9076-4fd1-a401-50ddbc75c58c",
    "when": "20200818215837Z",
    "duration": "0.103956",
    "kw": {
      "key": "tks_sslserver",
      "nickname": "Server-Cert cert-pki-tomcat",
      "directive": "tks.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/tks/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-tomcat' does not match the value of tks.sslserver.cert in /var/lib/pki/pki-tomcat/tks/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "TKSDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "004513ce-d798-423c-aaf3-f377e3757c2e",
    "when": "20200818215837Z",
    "duration": "0.185525",
    "kw": {
      "key": "tks_subsystem",
      "nickname": "subsystemCert cert-pki-tomcat",
      "directive": "tks.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/tks/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-tomcat' does not match the value of tks.subsystem.cert in /var/lib/pki/pki-tomcat/tks/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "TPSDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "a0d1e203-8b33-4d28-b7cc-031a3dd88cb2",
    "when": "20200818215837Z",
    "duration": "0.104213",
    "kw": {
      "key": "tps_sslserver",
      "nickname": "Server-Cert cert-pki-tomcat",
      "directive": "tps.sslserver.cert",
      "configfile": "/var/lib/pki/pki-tomcat/tps/conf/CS.cfg",
      "msg": "Certificate 'Server-Cert cert-pki-tomcat' does not match the value of tps.sslserver.cert in /var/lib/pki/pki-tomcat/tps/conf/CS.cfg"
    }
  },
  {
    "source": "pki.server.healthcheck.meta.csconfig",
    "check": "TPSDogtagCertsConfigCheck",
    "result": "ERROR",
    "uuid": "3fb343e4-e052-4cdc-9af3-ed51864aa5ad",
    "when": "20200818215837Z",
    "duration": "0.185737",
    "kw": {
      "key": "tps_subsystem",
      "nickname": "subsystemCert cert-pki-tomcat",
      "directive": "tps.subsystem.cert",
      "configfile": "/var/lib/pki/pki-tomcat/tps/conf/CS.cfg",
      "msg": "Certificate 'subsystemCert cert-pki-tomcat' does not match the value of tps.subsystem.cert in /var/lib/pki/pki-tomcat/tps/conf/CS.cfg"
    }
  }
]


Expected results:
# pki-healthcheck --failures-only
[]

(No ERRORs reported)

Additional info:
1. It was also observed in ipa-healthcheck: https://pagure.io/dogtagpki/issue/3202

2. Based on initial investigation, this part of the code might be causing the issue: https://github.com/dogtagpki/pki/blob/master/base/server/python/pki/server/deployment/__init__.py#L349-L355

3.  Though the subsystems seem to be working without errors so far, we
still would like to have copies of the cert in CS.cfg...
In future, these redundant copies of cert will be
removed from CS.cfg and the code will be altered to retrieve
certs from its NSSDB.

Comment 1 Dinesh Prasanth 2020-08-21 15:33:12 UTC

*** Bug 1871188 has been marked as a duplicate of this bug. ***

Comment 4 Endi Sukma Dewata 2020-08-28 00:33:47 UTC

PR: https://github.com/dogtagpki/pki/pull/536

Fixed in master branch (10.10):
* https://github.com/dogtagpki/pki/commit/7abe19e5be79ecab51ea4b4e94fb7a7bb01dca1f

There is one more PR: https://github.com/dogtagpki/pki/pull/539

Comment 5 Endi Sukma Dewata 2020-08-31 20:30:41 UTC

Fixed in master branch (10.10):
* https://github.com/dogtagpki/pki/commit/e117f897a43b7f2ded0edbb204110357c29da2c0

Comment 16 errata-xmlrpc 2020-11-04 03:15:52 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4847

Note You need to log in before you can comment on or make changes to this bug.