dogtagpki

#1631 Expired certificates are not moving to specified issuing point
Closed: Invalid Opened by mrniranjan.

Closed: Invalid
Reopen Issue

Expired certificates do not show up on crl

Steps to Reproduce:

1.Generate a certificate request which expires in 2 days
2. Approve the certificate request
3. Move the system date beyond the End date of the certificate
4. Verify the cert shows as expired in cert-show output
[root@csqa1 ca]# pki -d /etc/pki/nssdb -c '' -h `hostname` -p 30044 cert-show
0x25
------------------
Certificate "0x25"
------------------
  Serial Number: 0x25
  Issuer: CN=CA Signing Certificate,O=Example-Sep29-Inst1
  Subject: UID=exp1,E=exp1@example.org,CN=exp1
  Status: EXPIRED
  Not Before: Tue Sep 29 08:31:06 EDT 2015
  Not After: Wed Sep 30 08:31:06 EDT 2015
[root@csqa1 ca]#
5. On the MasterCRL, using pkiconsole edit the crl issuing point to include
Expired certs
6. update the revocation list
7. Select MasterCRL and verify if expired cert is added to crl.

Actual results:

Expired cert doesn't show up on the CRL

Expected results:

Expired cert should be added to CRL

Additional Info:

[attachment 1078322 CA CS.cfg](https://bugzilla.redhat.com/attachment.cgi?id=1078322)
[attachment 1078323 CA Debug Logs](https://bugzilla.redhat.com/attachment.cgi?id=1078323)

Per CS/DS Meeting of 10/12/2015 - 10.3

I cannot reproduce; was the experied certificate also revoked?

The CRL 'includeExpiredCerts' option causes revoked certificates
to remain on the CRL after they have experied (default behaviour is
to remove them, since they should no longer be accepted after expiry,
regardless of appearance on CRL or not).

On further investigation, the status of such a cert would show as:

------------------
Certificate "0x12"
------------------
  Serial Number: 0x12
  Issuer: CN=Certificate Authority,O=IPA.LOCAL 201601121209
  Subject: UID=ftweedal,CN=expiry test 2 (to be revoked)
  Status: REVOKED_EXPIRED
  Not Before: Wed Jan 13 14:22:13 AEDT 2016
  Not After: Wed Jan 13 14:37:13 AEDT 2016

This indicates that the cert in question in the bug report was never
revoked. Therefore I am closing invalid.

Metadata Update from @mrniranjan:
- Issue assigned to ftweedal
- Issue set to the milestone: 10.3.0

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2190

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
None
None
None
None
defect
CA
None
QE
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.