Bug 599689 - myproxy-store does not like pkcs8-encoded private keys
Summary: myproxy-store does not like pkcs8-encoded private keys
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: myproxy
Version: 14
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Steve Traylen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-06-03 18:42 UTC by Lev Shamardin
Modified: 2010-09-11 09:04 UTC (History)
2 users (show)

Fixed In Version: myproxy-5.2-1.fc13
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-08-27 21:12:28 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Lev Shamardin 2010-06-03 18:42:49 UTC
Description of problem:
myproxy-store does not work pkcs8-encoded private keys, while openssl and related libraries work with them just fine.

Version-Release number of selected component (if applicable):
myproxy-client-5.1-1.fc12.i686
myproxy-5.1-1.fc12.i686

How reproducible:
Always

Steps to Reproduce:
1. Export your certificate and key to pkcs12 format. (Or generate them in a browser or other application which does only pkcs12 export). You can use openssl:

openssl pkcs12 -export -in yourcert.pem -inkey yourkey.pem -out yourpair.p12

2. Extract the keys back to PEM from the p12 container:

openssl pkcs12 -in yourpair.p12 -out extracted.pem

3. Split the extracted.pem to $HOME/.globus/usercert.pem and $HOME/.globus/userkey.pem. You will have a private key with this start line:
-----BEGIN ENCRYPTED PRIVATE KEY-----

4. Check that grid-proxy-init (from globus-proxy-utils-3.7-1.fc12.i686) and voms-proxy-init (from voms-clients-1.9.16.1-2.fc12.i686) work perfectly.

5. Check that even myproxy-init works correctly.

6. Now run myproxy-store. Observe this error message:

/home/shamardin/.globus/userkey.pem doesn't contain '-----BEGIN RSA PRIVATE KEY-----' nor '-----BEGIN PRIVATE KEY-----'.
makecertfile failed

  
Actual results:
myproxy-store does not work

Expected results:
working myproxy-store.

Additional info:
You could just run 

openssl pkcs8 -in userkey.pem -topk8 -out newuserkey.pem

instead of steps 1-3, but I provided them to illustrate how I have encountered this bug.

Comment 1 Jim Basney 2010-06-03 23:50:28 UTC
Upstream bug opened:
http://bugzilla.globus.org/bugzilla/show_bug.cgi?id=7033

Comment 2 Fedora Update System 2010-07-23 07:33:32 UTC
myproxy-5.2-1.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/myproxy-5.2-1.el5

Comment 3 Fedora Update System 2010-07-30 01:06:35 UTC
myproxy-5.2-1.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update myproxy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/myproxy-5.2-1.el5

Comment 4 Bug Zapper 2010-07-30 11:48:29 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 14 development cycle.
Changing version to '14'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 5 Fedora Update System 2010-08-10 17:34:13 UTC
myproxy-5.2-1.el4 has been submitted as an update for Fedora EPEL 4.
http://admin.fedoraproject.org/updates/myproxy-5.2-1.el4

Comment 6 Fedora Update System 2010-08-12 17:54:23 UTC
myproxy-5.2-1.el4 has been pushed to the Fedora EPEL 4 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update myproxy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/myproxy-5.2-1.el4

Comment 7 Fedora Update System 2010-08-17 18:55:06 UTC
myproxy-5.2-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Lev Shamardin 2010-08-23 07:43:03 UTC
Could you please update the F12 package as well? I could co-maintain MyProxy packages if you wish.

Comment 9 Fedora Update System 2010-08-23 11:05:24 UTC
myproxy-5.2-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/myproxy-5.2-1.fc12

Comment 10 Fedora Update System 2010-08-23 22:03:19 UTC
myproxy-5.2-1.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update myproxy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/myproxy-5.2-1.fc12

Comment 11 Fedora Update System 2010-08-27 21:12:19 UTC
myproxy-5.2-1.el4 has been pushed to the Fedora EPEL 4 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2010-09-01 03:28:59 UTC
myproxy-5.2-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2010-09-01 19:13:43 UTC
myproxy-5.2-1.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/myproxy-5.2-1.fc13

Comment 14 Fedora Update System 2010-09-11 09:04:48 UTC
myproxy-5.2-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.