dogtagpki

#2741 Unable to find keys in the p12 file after deleting the any of the subsystem certs from it
Closed: fixed Opened by mharmsen.

Closed: fixed
Reopen Issue

Unable to find key for caSigning cert in the p12 file after deleting the other
subsystem certs from it

Steps to Reproduce:

[root@nightcrawler ~]# pki pkcs12-cert-find --pkcs12-file ca.p12
--pkcs12-password-file password.txt
---------------
5 entries found
---------------
  Certificate ID: 84fc8b893166c5b1c019d64971df4364d5013bd9
  Serial Number: 0xb59aeb9
  Nickname: caSigningCert cert-pki-tomcat-ca-rpattath CA
  Subject DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Issuer DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Trust Flags: CTu,Cu,Cu
  Has Key: true
  Certificate ID: d878ba1b5cfb5bac41b4cda35d6d4bf90c4ae03
  Serial Number: 0xae25138
  Nickname: ocspSigningCert cert-pki-tomcat-ca-rpattath CA
  Subject DN: CN=CA OCSP Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Issuer DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Trust Flags: u,u,u
  Has Key: true
  Certificate ID: 2aa4295e5121c7aa81de66e1a410c9b3ea402953
  Serial Number: 0x3a59faa
  Nickname: Server-Cert cert-pki-tomcat-ca-rpattath
  Subject DN: CN=cloud-qe-19.idmqe.lab.eng.bos.redhat.com,OU=pki-tomcat-ca-rpat
tath,O=idmqe.lab.eng.bos.redhat.com Security Domain
  Issuer DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Trust Flags: u,u,u
  Has Key: true
  Certificate ID: f352186fcb9855d639113e82576bc11816f462a8
  Serial Number: 0xa2b677
  Nickname: subsystemCert cert-pki-tomcat-ca-rpattath
  Subject DN: CN=Subsystem
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Issuer DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Trust Flags: u,u,u
  Has Key: true
  Certificate ID: 127254ff86be472a7fcbc0dcd6b5602b10f12dae
  Serial Number: 0x4e1a3bd
  Nickname: auditSigningCert cert-pki-tomcat-ca-rpattath CA
  Subject DN: CN=CA Audit Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Issuer DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Trust Flags: u,u,Pu
  Has Key: true
[root@nightcrawler ~]# pki pkcs12-key-find --pkcs12-file ca.p12
--pkcs12-password-file password.txt
---------------
5 entries found
---------------
  Key ID: 84fc8b893166c5b1c019d64971df4364d5013bd9
  Subject DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Key ID: d878ba1b5cfb5bac41b4cda35d6d4bf90c4ae03
  Subject DN: CN=CA OCSP Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Key ID: 2aa4295e5121c7aa81de66e1a410c9b3ea402953
  Subject DN: CN=cloud-qe-19.idmqe.lab.eng.bos.redhat.com,OU=pki-tomcat-ca-rpat
tath,O=idmqe.lab.eng.bos.redhat.com Security Domain
  Key ID: f352186fcb9855d639113e82576bc11816f462a8
  Subject DN: CN=Subsystem
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Key ID: 127254ff86be472a7fcbc0dcd6b5602b10f12dae
  Subject DN: CN=CA Audit Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
[root@nightcrawler ~]# pki pkcs12-cert-del "ocspSigningCert
cert-pki-tomcat-ca-rpattath CA" --pkcs12-file ca.p12 --pkcs12-password-file
password.txt
--------------------------------------------------------------------
Deleted certificate "ocspSigningCert cert-pki-tomcat-ca-rpattath CA"
--------------------------------------------------------------------
[root@nightcrawler ~]# pki pkcs12-cert-del "auditSigningCert
cert-pki-tomcat-ca-rpattath CA" --pkcs12-file ca.p12 --pkcs12-password-file
password.txt
---------------------------------------------------------------------
Deleted certificate "auditSigningCert cert-pki-tomcat-ca-rpattath CA"
---------------------------------------------------------------------
[root@nightcrawler ~]# pki pkcs12-cert-del "Server-Cert
cert-pki-tomcat-ca-rpattath" --pkcs12-file ca.p12 --pkcs12-password-file
password.txt
-------------------------------------------------------------
Deleted certificate "Server-Cert cert-pki-tomcat-ca-rpattath"
-------------------------------------------------------------
[root@nightcrawler ~]# pki pkcs12-cert-del "subsystemCert
cert-pki-tomcat-ca-rpattath" --pkcs12-file ca.p12 --pkcs12-password-file
password.txt
---------------------------------------------------------------
Deleted certificate "subsystemCert cert-pki-tomcat-ca-rpattath"
---------------------------------------------------------------
[root@nightcrawler ~]# pki pkcs12-cert-find --pkcs12-file ca.p12
--pkcs12-password-file password.txt
---------------
1 entries found
---------------
  Certificate ID: 84fc8b893166c5b1c019d64971df4364d5013bd9
  Serial Number: 0xb59aeb9
  Nickname: caSigningCert cert-pki-tomcat-ca-rpattath CA
  Subject DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Issuer DN: CN=CA Signing
Certificate,OU=pki-tomcat-ca-rpattath,O=idmqe.lab.eng.bos.redhat.com Security
Domain
  Trust Flags: CTu,Cu,Cu
  Has Key: false
[root@nightcrawler ~]# pki pkcs12-key-find --pkcs12-file ca.p12
--pkcs12-password-file password.txt
---------------
0 entries found
---------------

Basically, there appears to be a bug that when one certificate is deleted, ALL keys are deleted.

Metadata Update from @mharmsen:
- Custom field component adjusted to General
- Custom field feature adjusted to ''
- Custom field origin adjusted to Community
- Custom field proposedmilestone adjusted to ''
- Custom field proposedpriority adjusted to ''
- Custom field reviewer adjusted to ''
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1461533
- Custom field type adjusted to defect
- Custom field version adjusted to ''
- Issue assigned to ftweedal
- Issue priority set to: blocker

Gerrit review: https://review.gerrithub.io/365533

commit a411492fe5ad2030bb9f18db9a8ed8d1c45ee7de
Author: Fraser Tweedale ftweedal@redhat.com
Date: Thu Jun 15 12:38:26 2017 +1000

Fix regression in pkcs12 key bag creation
Commit 633c7c6519c925af7e3700adff29961d72435c7f changed the PKCS #12
file handing to never deal with raw private key material.
PKCS12Util.addKeyBag() was changed to export the PrivateKey handle,
or fail.  This change missed this case where a PKCS #12 file is
loaded from file, possibly modified, then written back to a file,
without involving an NSSDB.  One example is pkcs12-cert-del which
deletes a certificate and associated key from a PKCS #12 file.
Fix the PKCS12Util.addKeyBag() method to use the stored
EncryptedPricateKeyInfo if available, otherwise export the
PrivateKey handle.
Fixes: https://pagure.io/dogtagpki/issue/2741
Change-Id: Ib8098126bc5a79b5dae19103e25b270e2f10ab5a

Metadata Update from @mharmsen:
- Issue close_status updated to: fixed
- Issue set to the milestone: 10.4.8 (was: 10.4)
- Issue status updated to: Closed (was: Open)

Metadata Update from @mharmsen:
- Custom field fixedinversion adjusted to pki-core-10.4.8-1.fc27

Metadata Update from @mharmsen:
- Custom field fixedinversion reset (from pki-core-10.4.8-1.fc27)

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2861

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Lowest
defect
General
''
''
Community
''
''
''
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.