dogtagpki

#1117 Generating symmetric keys using revoked Agent cert succeeds
Closed: Invalid Opened by mrniranjan.

Closed: Invalid
Reopen Issue

Generating Symmetric keys using Revoked agent cert succeeds:

$pki -d /opt/rhqa_pki/certs_db -c Secret123 -h dhcp207-176.lab.eng.pnq.redhat.com -p 30044 -n "KRA3_agentR" key-generate temp600011
--key-algorithm AES --key-size 128 --usages wrap ---------------------------
Key generation request info

Request ID: 0x2e5
Key ID: 0x2d9
Type: symkeyGenRequest
Status: complete

$ pki -d /opt/rhqa_pki/certs_db -c Secret123 -h dhcp207-176.lab.eng.pnq.redhat.com -p 30044 -n "caadmincert" cert-show 0x49

Certificate "0x49"

Serial Number: 0x49
Issuer: CN=PKI ROOTCA Signing Cert,O=redhat
Subject: UID=KRA3_agentR,E=KRA3_agentR@example.com,CN=KRA3_Agent_RevokedCert,OU=Engineering,O=Example,C=US
Status: REVOKED
Not Before: Tue Aug 19 02:15:46 EDT 2014
Not After: Sun Feb 15 01:15:46 EST 2015

# pki -d /opt/rhqa_pki/certs_db -c Secret123 -h dhcp207-176.lab.eng.pnq.redhat.com -p 30044 -n "KRA3_agentV"  key-generate pkitemp1 
--key-algorithm RC4 --key-size 1024 --usages wrap,unwrap,sign,encrypt,decrypt
---------------------------
Key generation request info
---------------------------
  Request ID: 0x2e4
  Key ID: 0x2d8
  Type: symkeyGenRequest
  Status: complete

# pki -d /opt/rhqa_pki/certs_db -c Secret123 -h dhcp207-176.lab.eng.pnq.redhat.com -p 30044 -n "caadmincert" cert-show 0x49
------------------
Certificate "0x49"
------------------
  Serial Number: 0x49
  Issuer: CN=PKI ROOTCA Signing Cert,O=redhat
  Subject: UID=KRA3_agentR,E=KRA3_agentR@example.com,CN=KRA3_Agent_RevokedCert,OU=Engineering,O=Example,C=US
  Status: REVOKED
  Not Before: Tue Aug 19 02:15:46 EDT 2014
  Not After: Sun Feb 15 01:15:46 EST 2015

There appears to be a mismatch since it appeared that you were using two different certificate nicknames.

Was this a cut/paste/typo error, or is this ticket not valid?
  1. Generate a key request using Agent Cert "KRA3_agentR"
pki -d /opt/rhqa_pki/certs_db -c Secret123 -h dhcp207-176.lab.eng.pnq.redhat.com \
-p 30044 -n "KRA3_agentR"  key-generate foobar-3 --key-algorithm RC4 --key-size 128 \
--usages wrap,unwrap,encrypt,decrypt 
---------------------------
Key generation request info
---------------------------
  Request ID: 0xac
  Key ID: 0xab
  Type: symkeyGenRequest
  Status: complete

Approve the Cert using "KRA_AgentR" Cert , This cert is revoked 

# pki -d /opt/rhqa_pki/certs_db -c Secret123 -h dhcp207-176.lab.eng.pnq.redhat.com \
-p 30044 -n "KRA3_agentR"  key-request-review 0xac --action approve
------
Result
------
  Request ID: 0xac
  Key ID: 0xab
  Type: symkeyGenRequest
  Status: complete

Do a key show using Revoked Agent Cert.

# pki -d /opt/rhqa_pki/certs_db -c Secret123 -h dhcp207-176.lab.eng.pnq.redhat.com \
-p 30044 -n "KRA3_agentR"  key-show 0xab
  Key ID: 0xab
  Client ID: foobar-3
  Status: active
  Algorithm: RC4
  Size: 128
  Owner: KRA3_agentR

KRA3_agentR Cert has serial Number 0x18

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 24 (0x18)
        Signature Algorithm: PKCS #1 SHA-512 With RSA Encryption
        Issuer: "CN=PKI ROOTCA Signing Cert,O=redhat"
        Validity:
            Not Before: Mon Aug 25 10:18:39 2014
            Not After : Sat Feb 21 10:18:39 2015
        Subject: "UID=KRA3_agentR,E=KRA3_agentR@example.com,CN=KRA3_Agent_Rev
            okedCert,OU=Engineering,O=Example,C=US"
        Subject Public Key Info:
            Public Key Algorithm: PKCS #1 RSA Encryption
            RSA Public Key:

As caadmincert (CA admin) Check the status of KRA3_Agent Cert

# pki -d /opt/rhqa_pki/certs_db -c Secret123 -h dhcp207-176.lab.eng.pnq.redhat.com \
-p 30044 -n "caadmincert" cert-show 0x18
------------------
Certificate "0x18"
------------------
  Serial Number: 0x18
  Issuer: CN=PKI ROOTCA Signing Cert,O=redhat
  Subject: UID=KRA3_agentR,E=KRA3_agentR@example.com,CN=KRA3_Agent_RevokedCert,OU=Engineering,O=Example,C=US
  Status: REVOKED
  Not Before: Mon Aug 25 06:18:39 EDT 2014
  Not After: Sat Feb 21 05:18:39 EST 2015

This issue affects all authentication using revoked certificate in general. Per discussion with cfu and alee the certificate revocation checking is currently only enabled in CA. Ideally the checking should be done in all cases, but it's not clear when this issue started to happen (or whether it has always been like this).

The problem can be fixed quickly for new installations by fixing the CS.cfg templates and/or the code, but fixing existing installation will require further considerations (see tickets #1134 and #1135).

master: 223d15539b7bcc0df025025036af2935726e52e3

reverted in master: 8acd59fe3d32e249c5e37138ec1c360fd8ad1de2

This is actually not a bug. Additional configuration is required to enable revocation checking on non-CA subsystems:

https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/revocation-checking.html#enabling-ocsp-checking-for-the-tks-and-drm

Metadata Update from @mrniranjan:
- Issue assigned to edewata
- Issue set to the milestone: 10.2 - 08/14 (August)

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1680

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
High
defect
Auth
None
QE
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.