Bug 495676 - pkisilent ConfigureCA failure on AdminCertImportPanel
Summary: pkisilent ConfigureCA failure on AdminCertImportPanel
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Dogtag Certificate System
Classification: Retired
Component: Scripts
Version: 1.1
Hardware: All
OS: Linux
high
medium
Target Milestone: ---
Assignee: Matthew Harmsen
QA Contact: Chandrasekar Kannan
URL:
Whiteboard:
Depends On:
Blocks: 443788
TreeView+ depends on / blocked
 
Reported: 2009-04-14 11:11 UTC by Roman Kisilenko
Modified: 2015-01-04 23:37 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-07-22 23:34:20 UTC
Embargoed:


Attachments (Terms of Use)
Relevant console output snippet (7.97 KB, text/plain)
2009-04-14 11:13 UTC, Roman Kisilenko
no flags Details
pkisilent install logs (700.00 KB, application/x-tar)
2009-06-05 15:21 UTC, Jenny Severance
no flags Details

Description Roman Kisilenko 2009-04-14 11:11:54 UTC
Description of problem:
pkisilent fails when importing admin certificate during CA configuration. 

Version-Release number of selected component (if applicable): 
pki-silent-1.1.0-1.fc10

How reproducible: Always

Steps to Reproduce:
1. Configure CA using pkisilent
  
Actual results:
CA is not configured, failure during AdminCertImportPanel step

Expected results:
CA properly configured

Additional info:
1. See attached file for console output relevant to the issue.
2. Exception is 
java.security.cert.CertificateEncodingException: Security library failed to decode certificate package: (-8183) security library: improperly formatted DER-encoded message.
	at org.mozilla.jss.CryptoManager.importCertPackageNative(Native Method)
	at org.mozilla.jss.CryptoManager.importCertPackage(CryptoManager.java:973)
	at ComCrypto.importCert(ComCrypto.java:256)
	at ConfigureCA.AdminCertImportPanel(ConfigureCA.java:1037)
	at ConfigureCA.ConfigureCAInstance(ConfigureCA.java:1323)
	at ConfigureCA.main(ConfigureCA.java:1566)
3. Looking at the source code it is obvious that pkisilent tool does not take into account that agent and user web interfaces are on different ports now in dogtag 1.1, it attempts to import cert via 9443 port instead of 9444 thus getting 404 error and wrong data.

Workaround:
Edit /var/lib/pki-ca/webapps/ca/WEB-INF/web.xml and alter user web UI port to 9443 instead of 9444 prior to running pkisilent.

Comment 1 Roman Kisilenko 2009-04-14 11:13:45 UTC
Created attachment 339461 [details]
Relevant console output snippet

Comment 2 Matthew Harmsen 2009-05-19 19:16:11 UTC
This issue is being addressed by Bugzilla Bug #500748.

Comment 3 Jenny Severance 2009-06-05 15:21:05 UTC
no exceptions with pkisilent for ca and all subsystems - see attached logs.
Verified

Comment 4 Jenny Severance 2009-06-05 15:21:31 UTC
Created attachment 346670 [details]
pkisilent install logs


Note You need to log in before you can comment on or make changes to this bug.