dogtagpki

#1229 Handling duplicate certs during import for cloning
Closed: migrated by dmoluguw. Opened by edewata.

Closed: migrated
Reopen Issue

The current code to import subsystem certs/keys for cloning assumes that the certificate nickname/subject DN is unique within an NSS database or a PKCS #12 file. There are cases where that's not the case:
1. A certificate is renewed with the same key.
2. A certificate is renewed with a new key.

In both cases the new certificate may be stored together with the old certificate with the same nickname and subject DN, so the code might match a key to the wrong certificate since it's only relying on the nickname/subject DN.

Ticket #1093 fixes issue #1 but not issue #2. To fix issue #2 the code should use a different mechanism to match the key to the certificate (e.g. using the serial number or SKI).

Proposed milestone: 10.2.3

Per CS/DS meeting of 12/15/2014: Milestone 10.2.3

Per Dogtag 10.2.X meeting of 01/14/2015:

edewata to verify whether or not this ticket has already been addressed.

The issue is still valid. To fix the problem we need a reliable mechanism to match private keys with certs. Per discussion with alee and cfu this ticket is moved into 10.2 backlog.

Per 10.2.3 TRIAGE meeting of 02/26/2015: 10.3

NOTE: Moved from 10.2 Backlog since it was not a documentation/man page issue.

Metadata Update from @edewata:
- Issue assigned to edewata
- Issue set to the milestone: UNTRIAGED

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1791

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Metadata Update from @dmoluguw:
- Issue close_status updated to: migrated
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
defect
Installation/Configuration
Community
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.