dogtagpki

#930 Unable to revoke a Subordinate CA signing Certificate with pki cert-revoke --ca option
Closed: migrated by dmoluguw. Opened by mrniranjan.

Closed: migrated
Reopen Issue

With pki cert-revoke --ca option can be used to revoke a CA signing certificate, but this option seems can be used only on root CA , It seems it cannot be used to revoke any ca signing certificates generated by that CA.

Example:

  1. Install CA subsystem using pkispawn
  2. Install a subca to CA installed in step-1:

I could not use --ca option to revoke a subordinate CA signing Certificate, 

[root@pkiserver1 nssdb]# pki -d . -n "PKI Administrator for example.org" -p 12080 cert-revoke 0xc --reason "Certificate_Hold" --ca
Placing certificate on-hold:
  Serial Number: 0xc
  Issuer: CN=CA Signing Certificate,O=Example1 Domain
  Subject: CN=CA Subordinate Signing Certificate,O=Example1 Domain
  Status: REVOKED
  Not Before: Wed Mar 19 12:58:08 EDT 2014
  Not After: Tue Mar 08 11:58:08 EST 2016
Are you sure (Y/N)? Y
UnauthorizedException: Certificate 0xc is not a CA signing certificate

0xC is the Subordinate CA signing Certificate.

But if --ca is not used then we could revoke the above certificate, 

[root@pkiserver1 nssdb]# pki -d . -n "PKI Administrator for example.org" -p 12080 cert-revoke 0x1 --reason "Certificate_Hold" --ca
Placing certificate on-hold:
  Serial Number: 0x1
  Issuer: CN=CA Signing Certificate,O=Example1 Domain
  Subject: CN=CA Signing Certificate,O=Example1 Domain
  Status: VALID
  Not Before: Wed Mar 12 08:40:00 EDT 2014
  Not After: Sun Mar 12 08:40:00 EDT 2034
Are you sure (Y/N)? Y
--------------------------------
Placed certificate "0x1" on-hold
--------------------------------
  Serial Number: 0x1
  Issuer: CN=CA Signing Certificate,O=Example1 Domain
  Subject: CN=CA Signing Certificate,O=Example1 Domain
  Status: REVOKED
  Not Before: Wed Mar 12 08:40:00 EDT 2014
  Not After: Sun Mar 12 08:40:00 EDT 2034

Versions:

pki-ca-10.2.0-0.1.20140320T0343zgit24294c0.fc20.noarch
pki-tools-10.2.0-0.1.20140320T0343zgit24294c0.fc20.x86_64

Per CS/DS meeting of 03/31/2014 - Is this just an error message change, or usage? Seems like a corner case with a workaround, 10.3.

Metadata Update from @mrniranjan:
- Issue set to the milestone: UNTRIAGED

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1496

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Metadata Update from @dmoluguw:
- Issue close_status updated to: migrated
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
High
None
None
None
None
None
defect
Command-Line Utilities
QE
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.