dogtagpki

#2871 Unable to install SubCA using CMC
Closed: invalid Opened by mharmsen.

Closed: invalid
Reopen Issue

gkapoor made the following observation:

Like in ExternalCA, we get certificate request created in step1 and then it's our choice if we get it signed using CMC or without CMC.

Now in SubCA, it is single step so how a subca can generate a csr first and then signed it using CMC?

Basically how to do subca(http://pki.fedoraproject.org/wiki/Installing_Subordinate_CA) with
CMC in one step1?

Actual results:

Unable to install SubCA with CMC using procedure mentioned in http://pki.fedoraproject.org/wiki/Installing_Subordinate_CA

Expected results:

CMC should work with SubCA.

Additional Info:

dditional info:
Few observations if you wanted to include in documentation:*_
For Subca,in same SD as it's CA:
================================
Ex: RootCA --> SubCA
Subsystem Certificate is signed by it's signing CA.(RootCA).
Rest other certs are signed by SubCA itself.
_For Subca,in different SD as it's CA:_
========================================
All certificates are signed by the subca itself.SubCA Agent page:
0x1     valid
CN=CA OCSP Signing Certificate,OU=topology-CA-EX-diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x1>
0x2     valid
CN=pki1.example.com,OU=topology-CA-EX-diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x2>
0x3     valid
CN=Subsystem Certificate,OU=topology-CA-EX-diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x3>
0x4     valid
CN=CA Audit Signing Certificate,OU=topology-CA-EX-diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x4>
0x5     valid
CN=PKI
Administrator,E=caadmin@example.com,OU=topology-CA-EX-
diffsub,O=EXAMPLE
<https://pki1.example.com:32443/ca/agent/ca/displayBySerial?op=disp
layBySerial&serialNumber=0x5>
Ex: RootCA --> SubCA
Subsystem Certificate is signed by SubCA itself.
And Rest other certs are also signed by SubCA itself.
_For External CA,_
====================
Ex: RootCA --> ExternalCA
Subsystem Certificate and other certs are signed by ExternalCA

Metadata Update from @mharmsen:
- Custom field component adjusted to None
- Custom field feature adjusted to None
- Custom field origin adjusted to None
- Custom field proposedmilestone adjusted to None
- Custom field proposedpriority adjusted to None
- Custom field reviewer adjusted to None
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1520253
- Custom field type adjusted to None
- Custom field version adjusted to None

Per 10.5.x/10.6 Triage: CLOSING INVALID

RHBZ: CLOSED WONTFIX

cfu: I believe the new instruction for all CMC installation is two steps (two-step for root ca, and external-ca for subca and other subsystems).

Metadata Update from @mharmsen:
- Issue close_status updated to: invalid
- Issue set to the milestone: 10.6.0 (was: 10.6)
- Issue status updated to: Closed (was: Open)

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2990

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
None
Low
None
None
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.