freeipa

#8754 Certificate Serial Number issue
Closed: fixed by frenaud. Opened by pcech.

Closed: fixed
Reopen Issue

Issue

After importing a certificate for a user and checking the certificate details Serial Number (hex) shows up correctly but Serial Number appears to be incorrect.

If certificate serial number has too many numbers it is written in scientific notation like 2.9605176942215216e+38. Insted scientific notation all numbers should be visible ie. 296051769422152172270129973192053595258

Steps to Reproduce

Take attached .pem files and import it to any IPA instalce under any user as user certificate.
Review real serial numbers in this .pem and review serial numbers in IPA also. It is realy easy to see the difference. You can double click on .pem file in Windows and it will open dialog and you can find serial number or use openssl.

Actual behavior

The certificate serial number is not correct.

Expected behavior

The certificate serial number should be displayed correctly.

Version/Release/Distribution

ipa-server-4.8.7-13.module+el8.3.0+8376+0bba7131.x86_64

This issue is related to https://bugzilla.redhat.com/show_bug.cgi?id=1919384

Metadata Update from @pcech:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1919384

@stsymbal did the initial analysis:

----- 8< -----
I did some investigation here and found that the issue is caused by an inconsistent server response:

{
    "error": null,
    "id": null,
    "principal": "admin@TESTRELM.TEST",
    "result": {
        "count": 2,
        "results": [
            {
                "error": null,
                "result": {
                    "attributelevelrights": {
                      // ...
                    },
                    "cn": [
                        "master.testrelm.test"
                    ],
                    "dn": "fqdn=master.testrelm.test,cn=computers,cn=accounts,dc=testrelm,dc=test",
                    "fqdn": [
                        "master.testrelm.test"
                    ],
                    "has_keytab": true,
                    "has_password": false,
                    "ipakrbokasdelegate": false,
                    "ipakrboktoauthasdelegate": false,
                    "ipakrbrequirespreauth": true,
                    "ipasshpubkey": [
                        // ...
                    ],
                    "ipauniqueid": [
                        "d29484a8-6d25-11eb-8f34-fa163e687e3b"
                    ],
                    "issuer": "CN=Fina RDC 2015,O=Financijska agencija,C=HR",
                    "krbcanonicalname": [
                        "host/master.testrelm.test@TESTRELM.TEST"
                    ],
                    "krbextradata": [
                        {
                            "__base64__": "AAIFZyZgcm9vdC9hZG1pbkBURVNUUkVMTS5URVNUAA=="
                        }
                    ],
                    "krblastpwdchange": [
                        {
                            "__datetime__": "20210212113117Z"
                        }
                    ],
                    "krbprincipalname": [
                        "host/master.testrelm.test@TESTRELM.TEST"
                    ],
                    "krbpwdpolicyreference": [
                        "cn=Default Host Password Policy,cn=computers,cn=accounts,dc=testrelm,dc=test"
                    ],
                    "krbticketflags": [
                        "128"
                    ],
                    "managedby_host": [
                        "master.testrelm.test"
                    ],
                    "managing_host": [
                        "master.testrelm.test"
                    ],
                    "memberof_hostgroup": [
                        "ipaservers"
                    ],
                    "objectclass": [
                        // ...
                    ],
                    "serial_number": "264374074076456325397645183544606453821",     // <------------- correct
                    "serial_number_hex": "0xC6E498364966A853000000005665F03D",
                    "serverhostname": [
                        "master"
                    ],
                    "sha1_fingerprint": "fc:3b:be:27:69:18:a0:c4:d1:a5:81:d4:83:ff:b9:fe:5a:50:cc:a4",
                    "sha256_fingerprint": "bd:b2:f2:60:9f:b3:ea:8e:81:ad:c7:16:b8:d3:66:1d:3c:50:8a:c0:ad:02:a6:02:7c:d1:22:81:db:90:6a:06",
                    "sshpubkeyfp": [
                        "SHA256:JZKhbXD8e3SB01AGioHldHQUVMb/2fgLgZo505nVDlM (ecdsa-sha2-nistp256)",
                        "SHA256:5s5pcf6i8sG9vd5N8PrGB+/MVqK+m5hmk3dJkNV/gNs (ssh-ed25519)",
                        "SHA256:cFT11o4qkfvZXq60Q/ql4uDSaqtaWtPtR4lUQ2jUyMs (ssh-rsa)"
                    ],
                    "subject": "serialNumber=HR57289294894.2.21,CN=KRUNOSLAV HRNJAK,givenName=KRUNOSLAV,SN=HRNJAK,L=ZAGREB,2.5.4.97=HR13148821633,O=HOPS D.O.O.,C=HR",
                    "usercertificate": [
                        {
                            // ...
                        }
                    ],
                    "valid_not_after": "Thu Oct 14 12:13:20 2021 UTC",
                    "valid_not_before": "Mon Oct 14 12:13:20 2019 UTC"
                },
                "summary": null,
                "value": "master.testrelm.test"
            },
            {
                "count": 1,
                "error": null,
                "result": [
                    {
                        "certificate": "...",
                        "issuer": "CN=Fina RDC 2015,O=Financijska agencija,C=HR",
                        "owner_host": [
                            "master.testrelm.test"
                        ],
                        "san_rfc822name": [
                            "krunoslav.hrnjak@hops.hr"
                        ],
                        "serial_number": 264374074076456325397645183544606453821,        // <------------- the issue
                        "serial_number_hex": "0xC6E498364966A853000000005665F03D",
                        "sha1_fingerprint": "fc:3b:be:27:69:18:a0:c4:d1:a5:81:d4:83:ff:b9:fe:5a:50:cc:a4",
                        "sha256_fingerprint": "bd:b2:f2:60:9f:b3:ea:8e:81:ad:c7:16:b8:d3:66:1d:3c:50:8a:c0:ad:02:a6:02:7c:d1:22:81:db:90:6a:06",
                        "subject": "serialNumber=HR57289294894.2.21,CN=KRUNOSLAV HRNJAK,givenName=KRUNOSLAV,SN=HRNJAK,L=ZAGREB,2.5.4.97=HR13148821633,O=HOPS D.O.O.,C=HR",
                        "valid_not_after": "Thu Oct 14 12:13:20 2021 UTC",
                        "valid_not_before": "Mon Oct 14 12:13:20 2019 UTC"
                    }
                ],
                "summary": "1 certificate matched",
                "truncated": false
            }
        ]
    },
    "version": "4.9.1"
}

There are two objects. The first one is host object and it has correct string value for "serial_number". But second one is the certificate object itself and the value there is looooooong int.

Such big numbers are transformed to an incorrect presentation on XHR level. It is not some custom processing. So I would not fix it on UI level, because it requires touching internals and could be dangerous.

----- 8< -----

The WebUI is using the output of ipa cert-find / ipa cert-show commands to generate the certificate information. The output contains "serial_number" as an int and "serial_number_hex" as a string.
The first proposal was to use a string instead of an int in ipa cert-show/cert-find but this is an interface change that would break backward compatibility.

I propose instead to build the serial_number in the WebUI by reading serial_number_hex and doing something similar to:

IPA.cert.parse_sn = function(serial_number_hex) {
     var sn = BigInt(serial_number_hex);
     var result = sn.toString();
     return result;
};

@stsymbal what do you think about it?

@frenaud
Thanks for the feedback.
Your solution looks relevant. Let me try it and then, if there are no pitfalls, I will provide a patch.
Edited by stsymbal

master:

  • 1439764c0e8ab9fd046c465e00f065684682f6b0 WebUI: Fix certificate serial number representation

ipa-4-9:

  • 52e60889ff85b0129503d086214419fc2f9700d8 WebUI: Fix certificate serial number representation

ipa-4-8:

  • 1374f899584693d6a1397e6d5f9a1b3bd038c2a6 WebUI: Fix certificate serial number representation

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • b76bb195a5bb39c2aa58bd912daf69028f6c6203 webui: Add label name to 'Certificates' section
  • 746a036c7eab177fd87a37f0515a46419f22c12b ipatests: Test newly added certificate lable
  • f15da104542f67a07cbb4430c6936cf8d35b451e webui: Add name to 'Certificates' table

ipa-4-10:

  • 54470c6b3b3958dbc0eeb2cda17e306123cb9f3a webui: Add label name to 'Certificates' section
  • 580e62a1615483c9ae94fabce8bd8eacc83028f2 ipatests: Test newly added certificate lable
  • 813df68b086113cb093108ebfec3bdad86703841 webui: Add name to 'Certificates' table

ipa-4-9:

  • 98eda97648fb0d9a7ae9aac32938d4f889f8a213 webui: Add label name to 'Certificates' section
  • c0b438bc745666694f2c590859d4926178a0ca04 ipatests: Test newly added certificate lable
  • 76c8b47e4fb249db0b7c6185afcc0d11b78c5824 webui: Add name to 'Certificates' table
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.