dogtagpki

#2126 Different status shown on TPSUI and cli for certificate
Closed: Invalid Opened by gkapoor.

Closed: Invalid
Reopen Issue

Two different status are shown on TPSUI and cli when a token is moved from active --> temporary lost.

Refer to the screenshot to see the status on TPS UI.

Steps to Reproduce:

1. Enroll a token.
2. Check the status from cli .
3. Change the state of token from active -- temporary lost.
4. Check the status from cli and match status of both signing and encryption
cert.

Actual results:

UI :
* Refer to the screenshot attached

Expected results:

state on UI and cli should be same.

Additional info:

Attachment 1129234 UI_Screenshot was created and attached to the associated bug.

UI :
        Certificate ID  Serial Number   Subject         Token ID        User ID
Key Type        Status  Create Time     Modify Time
        f.20160222042417        0xf     UID=testuser1,O=Token Key User
40906145C76224192D2B    testuser1       signing         revoked_on_hold
1456133057000   1456138338000
        10.20160222042417       0x10    UID=testuser1,O=Token Key User
40906145C76224192D2B    testuser1       encryption      active  1456133057000
Cli:
[root@geetika ~]# pki -d /tmp/abc -c redhat -h `hostname` -p 8443 -P https -n
"test1" tps-cert-show 10.20160222042417
-------------------------------
Certificate "10.20160222042417"
-------------------------------
  Cert ID: 10.20160222042417
  Serial Number: 0x10
  Subject: UID=testuser1,O=Token Key User
  Token ID: 40906145C76224192D2B
  Key Type: encryption
  Status: revoked_on_hold
  User ID: testuser1
  Create Time: Mon Feb 22 04:24:17 EST 2016
  Modify Time: Mon Feb 22 05:52:19 EST 2016
[root@geetika ~]# pki -d /tmp/abc -c redhat -h `hostname` -p 8443 -P https -n
"test1" tps-cert-show f.20160222042417
------------------------------
Certificate "f.20160222042417"
------------------------------
  Cert ID: f.20160222042417
  Serial Number: 0xf
  Subject: UID=testuser1,O=Token Key User
  Token ID: 40906145C76224192D2B
  Key Type: signing
  Status: revoked_on_hold
  User ID: testuser1
  Create Time: Mon Feb 22 04:24:17 EST 2016
  Modify Time: Mon Feb 22 05:52:18 EST 2016

There are two issues described in the Bugzilla ticket:
1. When the token status is changed to temporary lost, the status of the certificates shown in CLI and UI are not consistent.
2. When the token status is changed to physically damaged, the status of the signing and encryption do not match.

I'm unable to reproduce the first issue with the latest code on master. When the token status is changed to temporary lost, the status of the signing and encryption certificates become revoked_on_hold. The CLI and UI are consistent.

The second issue is confirmed. When the token status is changed to physically damaged, only the signing certificate becomes revoked, but the encryption certificate remains active. The UI and CLI are consistent. However, I'm not sure whether this actually a bug. Perhaps jmagne or cfu could clarify further.

Per CS/DS Triage Meeting of 03/22/2016: 10.3

I don't think this is a bug.

In response to edewata's summary of the issues reported:
1. I too cannot reproduce it. It seems fine
2. This is per configuration. By default, for example:
op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert=false
If you turn that to "true" then the encryption cert will be revoked when the token is physically damaged.
just for reference, the following is the default for signing cert:
op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert=true

Metadata Update from @gkapoor:
- Issue assigned to cfu
- Issue set to the milestone: 10.3.0.b1

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2333

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
defect
TPS
None
QE
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.