dogtagpki

#1339 doRevoke error string doesn't clear after failure.
Closed: Fixed Opened by mharmsen.

Closed: Fixed
Reopen Issue

When doRevoke encounters an error in processing certs to revoke, result code
does not seem to be cleared and causes subsequent 'successful' revocations to
fail causing revocations from TPS token database to fail.

How reproducible:

Always

Steps to Reproduce:

1. Send good revocation request:
#curl --cert cert.pem:password --key key.pem -k --data "op=doRevoke&revocationR
eason=1&revokeAll=(certRecordId=0x<serial_number>)&op=bevoke"
https://<host>:8306/ca/ee/subsystem/ca/doRevoke
2. Send bad revocation request:
#curl --cert cert.pem:password --key key.pem -k --data "op=doRevoke&revocationR
eason=1&revokeAll=(certRecordId=<serial_number>)&op=bevoke"
https://<host>:8306/ca/ee/subsystem/ca/doRevoke
Note the missing 0x in front of the serial number
3. Send good revocation request again:
#curl --cert cert.pem:password --key key.pem -k --data "op=doRevoke&revocationR
eason=1&revokeAll=(certRecordId=0x<serial_number>)&op=bevoke"
https://<host>:8306/ca/ee/subsystem/ca/doRevoke

Actual results:

Last successful revocation request returns "Error encountered while marking
certificate revoked." even though the cert is successfully revoked from CA
database.

Expected results:

No error message. Successful termination of certificate

Additional info:

While the CA still revokes the certs as expected, when coupled with the TPS
token termination process, it causes the TPS tokendb to become out of sync with
the CA cert database because the TPS recieves an error code from the CA and
does not process revocation.
It looks like this will also occur when the TPS sends a revocation request for
a certificate that doesn't exist.

commit bc6449b6145a2b51d5332551332b3db0b0a9f345
Author: Christina Fu cfu@redhat.com
Date: Thu Apr 16 12:02:54 2015 -0700

Ticket 1339 doRevoke error string doesn't clear after failure.
 porting from Bugzilla 1150142

Metadata Update from @mharmsen:
- Issue assigned to cfu
- Issue set to the milestone: 10.2.3

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1901

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Low
None
None
None
None
None
defect
CA
RHCust
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.