Description of problem: When adding a trusted CA certificate chain (consisting of a single self signed cert) the pkiconsole fails with error message "Certificate Error: Failed to decode" Additionaly, PrettyPrintCert raises an exception: # PrettyPrintCert lifesci-cacert.pem PrettyPrintCert: Error encountered on parsing certificate : java.security.cert.CertificateParsingException: java.io.IOException: java.io.IOException: IssuerAlternativeNameExtensionnetscape.security.x509.GeneralNamesException: No data available in passed DER encoded value. null the tool "pp" displays the certificate correctly, and certutil can import it into the certificate database. Suggests a bug in the java code? Version-Release number of selected component (if applicable): pki-java-tools-1.0.0-1.fc8 pki-console-1.0.0-1.fc8 How reproducible: Always. Steps to Reproduce: 1. Run above PrettyPrintCert with the attached certificate Actual results: Nothing Expected results: Certificate to be imported into the DB. Additional info:
Created attachment 301953 [details] CA cert that fails to import
# java -version java version "1.7.0" IcedTea Runtime Environment (build 1.7.0-b21) IcedTea Client VM (build 1.7.0-b21, mixed mode)
pp reports of the cert that: Name: Certificate Issuer Alt Name Error: Parsing extension: Certificate extension value is invalid. Data: Sequence { } openssl shows: X509v3 Issuer Alternative Name: <EMPTY> I guess this is where the uncaught exception in the java is coming from.
1. Fix provided in 439027 is addressing the issue related to importing trusted CA certificate chain via CA console. 2. Attached certificate does not comply with RFC 5280 therefore is rejected. RFC 5280 (http://www.ietf.org/rfc/rfc5280.txt): 4.2.1.7. Issuer Alternative Name ... IssuerAltName ::= GeneralNames GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName dumpasn1 output: ... 1327 3: OBJECT IDENTIFIER issuerAltName (2 5 29 18) : (X.509 id-ce (2 5 29)) 1332 2: OCTET STRING, encapsulates { 1334 0: SEQUENCE {} : } : } PrettyPrintCert should gracefully handle IssuerAltName containing no GeneralName.
1. Console errors importing attached CA certificate Certificate Error: Failed to decode. 2. PrettyPrintCert still throws exception. [root@qe-blade-11 jgalipea]# PrettyPrintCert cert PrettyPrintCert: Error encountered on parsing certificate : java.security.cert.CertificateParsingException: java.io.IOException: java.io.IOException: IssuerAlternativeNameExtensionnetscape.security.x509.GeneralNamesException: No data available in passed DER encoded value. null
this needs to be in new state for the developer to pick it up