freeipa

#6220 cert-show cannot show certificate issued by deleted Sub CA
Closed: Invalid Opened by mkubik.

Closed: Invalid
Reopen Issue

When a Sub CA is deleted from IPA, the certificates issued by the CA are impossible to show via cert_show command. (They are still reachable via cert-find).

At the beginning of cert-show there is a check comparing the issuer DN of an issuing CA to the issuer of the certificate retrieved from dogtag. Since the CA in this scenario doesn't exist, the issuer DN retrieval will fail and the cert-show will return an error stating the CA cannot be found.

This error creates an error in several other commands (not exhausting):

service-del and host-del -- as a part of the entry deleting the certificates issued for these entries are being revoked. Since the revocation (cert-revoke) calls cert-show, the error caused by missing Sub CA trickles down to the command.
As a result, the service and host entries with certificates signed by already deleted Sub CA cannot be deleted.

btw, what happens if you re-add sub-ca with the same name and with the same config and alternatively with different config?

Added sub ca with the same subject the certificate can be retrieved \
With sub ca of the same name but different subject, the certificate is not found.

$ ipa ca-del default-profile-subca
----------------------------------
Deleted CA "default-profile-subca"
----------------------------------
$ ipa ca-add default-profile-subca --subject 'CN=default-profile-subca,O=test'
----------------------------------
Created CA "default-profile-subca"
----------------------------------
  Name: default-profile-subca
  Authority ID: d4b5e128-c68f-4911-8f8a-d778831b3619
  Subject DN: CN=default-profile-subca,O=test
  Issuer DN: CN=Certificate Authority,O=TEST.EXAMPLE.COM
$ ipa cert-show 12 --ca default-profile-subca                                 
  Certificate: MIIEcjCCA1qgAwIBAgIBDDANBgkqhkiG9w0BAQsFADAvMQ0wCwYDVQQKDAR0ZXN0MR4wHAYDVQQDDBVkZWZhdWx0LXByb2ZpbGUtc3ViY2EwHhcNMTYwODE2MTIzNzM5WhcNMTgwODE3MTIzNzM5WjBFMRkwFwYDVQQKDBBURVNULkVYQU1QTEUuQ09NMSgwJgYDVQQDDB9zYW50ZXN0LWhvc3QtMS50ZXN0LmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6y4kpIxZjsLx8vIQ0/MdXF51FW80P8P+VdO5hCQTXbJw7xizGoeWVqc6JRJT0R7Ye7afLbLgBYyU0e6fKKPIOGapl1kRWIcsOOZVaMKBpFmBSt+Kfzdfu/MZIg86liGeR2+pPkiVlEgoieSFa5usR8LIG0f8qNUdemJIrOTHoDMG5xL/1Jfxn1T5VP88+P7NCYB84KVplJ22vxDcLEIzZWmdMEdJ4BHqQpukrGh7s68gkbbamS1D3Oo5tLDsHrOuHL5lsmVbFihOBcrr2SwBOwJqgNWtmT/4Jb+PPYMyLObdhLXG2pIOs7scjdhBQYLhPB52PtdAGpezdco9IaOh5QIDAQABo4IBgTCCAX0wHwYDVR0jBBgwFoAU6WVyVejVY1P2uUOk02n748UMwNgwQgYIKwYBBQUHAQEENjA0MDIGCCsGAQUFBzABhiZodHRwOi8vaXBhLWNhLnRlc3QuZXhhbXBsZS5jb20vY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBPAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMHsGA1UdHwR0MHIwcKA4oDaGNGh0dHA6Ly9pcGEtY2EudGVzdC5leGFtcGxlLmNvbS9pcGEvY3JsL01hc3RlckNSTC5iaW6iNKQyMDAxDjAMBgNVBAoMBWlwYWNhMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHQYDVR0OBBYEFJxjPA82ooos4i/qbMSISszyGBtmMEsGA1UdEQREMEKCH3NhbnRlc3QtaG9zdC0xLnRlc3QuZXhhbXBsZS5jb22CH3NhbnRlc3QtaG9zdC0yLnRlc3QuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADggEBAMqA1FI4mtevfLQ+uhaBlVnPnWshLRm371yxHR6bLKZYEXHahAqwAvhyu/bnOudo8hZKP9kqMODcEUqEzTfIe3rq6BeUsjV/CVEtFXOLbWxeYVea/9H/YHTIDOeynwY02Xwr3w/nUaeqD1HFGfXZBHW3QiCxLNsaGTej1KbVS0JW7XVtRg4l487ornjawrxWwqYhA1ZQH2+tvaGktvWArGkoI2y2+gG0Qyc32JWZxjrvnjHdJWYSC9IZzjrsTRBTOcFTp7C88edmnGzaDFl3n1bTC0tpLddPQdI9/179yWCPqfftF6Ob0YRTuiz9fX3eVHT0akpGqpJXSInTCYsh+kw=
  Subject: CN=santest-host-1.test.example.com,O=TEST.EXAMPLE.COM
  Issuer: CN=default-profile-subca,O=test
  Not Before: Tue Aug 16 12:37:39 2016 UTC
  Not After: Fri Aug 17 12:37:39 2018 UTC
  Fingerprint (MD5): f1:98:15:75:a6:9d:55:25:31:06:b5:2d:5c:52:c9:5b
  Fingerprint (SHA1): f2:c4:e9:66:81:d2:6a:d1:82:62:78:bc:49:53:21:c5:be:72:c0:38
  Serial number: 12
  Serial number (hex): 0xC
  Revoked: False
$ ipa ca-del default-profile-subca                                            
----------------------------------
Deleted CA "default-profile-subca"
----------------------------------
$ ipa ca-add default-profile-subca --subject 'CN=default-profile-subca-bogus,O=test'
----------------------------------
Created CA "default-profile-subca"
----------------------------------
  Name: default-profile-subca
  Authority ID: 3ffc9473-3504-4ab5-8ad1-ccba9a47955c
  Subject DN: CN=default-profile-subca-bogus,O=test
  Issuer DN: CN=Certificate Authority,O=TEST.EXAMPLE.COM
$ ipa cert-show 12 --ca default-profile-subca                                       
ipa: ERROR: Certificate with serial number 12 issued by CA 'default-profile-subca' not found

Closing WONTFIX. Excerpts of email discussion below.

Opened related tickets:

  • 6256 [tracker] Revoke certificate on lightweight CA deletion

  • 6257 Implement ca-enable/disable commands

For 6220, we could support caller providing issuer DN directly, or
cacn (the current option), to allow referring to certs issued by
deleted CAs. Honza, do you agree with this approach?

No, not really. When a CA is deleted, it no longer exists to IPA, so it's
only logical you can't manage certs issued by it in IPA, same as you can't
manage certs issued by any random external CAs - which is exactly what a
managed CA becomes once it's deleted. If you want managed certs, don't
delete the issuing CA, it's that simple.

There is one important thing to note: the validity period of a cert
is the duration the CA promises to retain revocation information
about the cert. IPA won't be able to present that information for
certs whose issuing CA has been deleted. But Dogtag still knows
about it and CRLs and OCSP will have the right info, so w.r.t
"canonical" ways of finding out about revocation we are still doing
the right thing.

Deleting the CA means that we can no longer (through IPA) revoke
certs that were issued by that CA, so I think we must revoke the
CA's own certificate when we delete it. I'll prioritise this work,
and will close 6220 WONTFIX.

+1

I think if we document well that delete has this behaviour and
expose enable/disable functionality as the preferred means to
prevent issuance (whilst not revoking), then it is fine.

Due the the existence of enable/disable in the Dogtag feature, there
is also consensus on the PKI team that delete should revoke the CA
cert (tickets exist, but it has not been implemented yet).

I agree.
Simo.

Metadata Update from @mkubik:
- Issue assigned to ftweedal
- Issue set to the milestone: 0.0 NEEDS_TRIAGE
Metadata
None
None
None
Normal
defect
Certificate management
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.