dogtagpki

#1145 Tomcat TPS: Polish cert record removal when token is removed
Closed: migrated by dmoluguw. Opened by cfu.

Closed: migrated
Reopen Issue

This ticket is just to keep track of something that could use some improvement. Some thoughts are provided here per my discussion with Jack, but more could come up later when we get to this ticket.

In 10.2, when a token is removed from the tokendb, its certificates are also removed. In that process, the cert record's tokenId is compared with the token record's cuid.
Jack brought up the potential side effect if a token is a token containing recovered certificates. In which case, the certs will be removed, leaving the original token record cert-less.

Further discussion brought up that if a certificate is recovered multiple times, deleting of any cert other than the latest will not be allowed (with the current code).
Another ticket (possibly to be filed by Endi) will provide the feature to allow deletion of certificates form the TPS admin UI. Which might make it easier to clean up the tokendb.

By the way, in the original TPS, certificate records are not removed from tokendb when a token is removed.

just want to add an observation. The same cert actually could appear in the tokendb multiple times. The reason being that the cert ID used for the database is .TimeStamp. So for example, if the original temporarily lost token was put on hold, the new temporary token will recover the encryption cert and generate new signing cert, resulting in the encryption cert appearing twice in the tokendb, each bearing the same serial number but different time stamp.

Proposed Milestone: 10.3 (per CS Meeting of 09/17/2014)

Metadata Update from @cfu:
- Issue set to the milestone: UNTRIAGED

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1708

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Metadata Update from @dmoluguw:
- Issue close_status updated to: migrated
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Normal
enhancement
TPS
jmagne@redhat.com
TPS Rewrite
Community
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.