dogtagpki

#3056 Not able to use newly created admin user.
Closed Opened by amolkahat.

Closed
Reopen Issue

As mentioned in the below steps, I added user to admin group, issue the certificate to the user and trying to use this admin user for add new users. But it throws an exception.

[root@pki1 ~]# pki -d /opt/pki/certdb/ -c Secret123 -P https -p 20443 -n "PKI CA Administrator for Example.Org" ca-user-add testuser1 --fullName testuser1
----------------------
Added user "testuser1"
----------------------
   User ID: testuser1
   Full name: testuser1
[root@pki1 ~]# pki -d /opt/pki/certdb/ -c Secret123 -p 20080 -n "PKI CA Administrator for Example.Org" ca-user-membership-add testuser1 Administrators
------------------------------------
Added membership in "Administrators"
------------------------------------
  Group: Administrators
[root@pki1 ~]# pki -d /opt/pki/certdb/ -c Secret123 -p 20080 -n "PKI CA Administrator for Example.Org" ca-user-membership-find testuser1
-----------------
1 entries matched
-----------------
  Group: Administrators
----------------------------
Number of entries returned 1
----------------------------
[root@pki1 ~]# pki -d /opt/pki/certdb/ -c Secret123 -p 20080 client-cert-request "UID=testuser1,CN=testusr1"
-----------------------------
Submitted certificate request
-----------------------------
  Request ID: 47
  Type: enrollment
  Request Status: pending
  Operation Result: success
[root@pki1 ~]# pki -d /opt/pki/certdb/ -c Secret123 -p 20080 -n "PKI CA Administrator for Example.Org" ca-cert-request-review --action approve 47
-------------------------------
Approved certificate request 47
-------------------------------
  Request ID: 47
  Type: enrollment
  Request Status: complete
  Operation Result: success
  Certificate ID: 0x2b
[root@pki1 ~]# pki -d /opt/pki/certdb/ -c Secret123 -p 20080 -n "PKI CA Administrator for Example.Org" ca-user-cert-add testuser1 --serial 0x2b
-----------------------------------------------------------------------------------------------------------------------------
Added certificate "2;43;CN=CA Signing Certificate,OU=topology-02-CA,O=topology-02_Foobarmaster.org;UID=testuser1,CN=testusr1"
-----------------------------------------------------------------------------------------------------------------------------
  Cert ID: 2;43;CN=CA Signing Certificate,OU=topology-02-CA,O=topology-02_Foobarmaster.org;UID=testuser1,CN=testusr1
  Version: 2
  Serial Number: 0x2b
  Issuer: CN=CA Signing Certificate,OU=topology-02-CA,O=topology-02_Foobarmaster.org
  Subject: UID=testuser1,CN=testusr1
[root@pki1 ~]# pki -d /opt/pki/certdb/ -c Secret123 -p 20080 client-cert-import --serial 0x2b testuser1
--------------------------------
Imported certificate "testuser1"
--------------------------------
[root@pki1 ~]# pki -d /opt/pki/certdb/ -c Secret123 -p 20080 -n testuser1 -v ca-user-add testuser101 --fullName testuser101
Server URL: http://pki1.example.com:20080
NSS database: /opt/pki/certdb
Message format: null
Command: ca-user-add testuser101 --fullName testuser101
Initializing NSS
Logging into internal token
Using internal token
Module: ca
Initializing PKIClient
HTTP request: GET /pki/rest/info HTTP/1.1
  Accept: application/xml
  Accept-Encoding: gzip, deflate
  Host: pki1.example.com:20080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_181)
HTTP response: HTTP/1.1 200
  Set-Cookie: JSESSIONID=4DFB36B6F669C7DE2FD6EA2151F118BF; Path=/pki; HttpOnly
  Content-Type: application/xml
  Content-Length: 106
  Date: Thu, 30 Aug 2018 14:53:24 GMT
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept: application/xml
  Accept-Encoding: gzip, deflate
  Host: pki1.example.com:20080
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_181)
HTTP response: HTTP/1.1 302
  Cache-Control: private
  Expires: Thu, 01 Jan 1970 00:00:00 GMT
  Location: https://pki1.example.com:20443/ca/rest/account/login
  Content-Length: 0
  Date: Thu, 30 Aug 2018 14:53:24 GMT
HTTP redirect: https://pki1.example.com:20443/ca/rest/account/login
Client certificate: testuser1
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept: application/xml
  Accept-Encoding: gzip, deflate
  Host: pki1.example.com:20443
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_181)
Server certificate: CN=pki1.example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org
FATAL: SSL alert received: CERTIFICATE_UNKNOWN
javax.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request
        at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:287)
        at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:436)
        at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
        at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:76)
        at com.sun.proxy.$Proxy35.login(Unknown Source)
        at com.netscape.certsrv.account.AccountClient.login(AccountClient.java:45)
        at com.netscape.certsrv.client.SubsystemClient.login(SubsystemClient.java:50)
        at com.netscape.cmstools.cli.SubsystemCLI.login(SubsystemCLI.java:46)
        at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:64)
        at com.netscape.cmstools.cli.CLI.execute(CLI.java:345)
        at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:669)
        at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:705)
Caused by: java.io.IOException: SocketException cannot write on socket
        at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1491)
        at org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:24)
        at org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(AbstractSessionOutputBuffer.java:160)
        at org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSessionOutputBuffer.java:168)
        at org.apache.http.impl.AbstractHttpClientConnection.doFlush(AbstractHttpClientConnection.java:273)
        at org.apache.http.impl.AbstractHttpClientConnection.flush(AbstractHttpClientConnection.java:279)
        at org.apache.http.impl.conn.ManagedClientConnectionImpl.flush(ManagedClientConnectionImpl.java:188)
        at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:241)
        at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:123)
        at org.apache.http.impl.client.DefaultRequestDirector.tryExecute(DefaultRequestDirector.java:684)
        at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:486)
        at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:836)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
        at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:283)
        ... 11 more
[root@pki1 ~]# pki --version
PKI Command-Line Interface 10.6.6-1.20180830031759.5d20a86f.fc28

Currently the pki client-cert-request is creating 1024-bit keys by default:
https://github.com/dogtagpki/pki/blob/58fca3403ee7ad00a3a915b1ee7c1da7774f5f11/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java#L181

It looks like the JSSE connector requires at least a 2048-bit key, so the client cert is rejected by the server.

The PKCS10Client is creating 2048-bit keys by default:
https://github.com/dogtagpki/pki/blob/58fca3403ee7ad00a3a915b1ee7c1da7774f5f11/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java#L104

So the solution is to fix pki client-cert-request to create a 2048-bit key by default. In the meantime, the workaround is to specify --length 2048 parameter for pki client-cert-request, or to use PKCS10Client instead.
Edited by edewata

Metadata Update from @edewata:
- Custom field component adjusted to None
- Custom field feature adjusted to None
- Custom field origin adjusted to None
- Custom field proposedmilestone adjusted to None
- Custom field proposedpriority adjusted to None
- Custom field reviewer adjusted to None
- Custom field type adjusted to None
- Custom field version adjusted to None

Fixed in master:
* https://github.com/dogtagpki/pki/commit/c6f75cfcda63a402d51e97fba5158c6faad4fe88

Metadata Update from @edewata:
- Issue assigned to edewata

Metadata Update from @edewata:
- Issue set to the milestone: 10.6.7
- Issue status updated to: Closed (was: Open)

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/3174

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
None
None
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.