dogtagpki

#1396 Dogtag 10.2.4 ECC Dual-Use cert generation fails
Closed: Duplicate Opened by bja.

Closed: Duplicate
Reopen Issue

OS: Fedora 21
Browser: Firefox 38
Dogtag Profile: caECUserCert

When submitting an ECC dual-use cert request in Firefox, the request fails with:

Sorry, your request has been rejected. The reason is "Request Rejected - {0}"

Debug log:
[SignedAuditEventFactory: create() message=[AuditEvent=PROFILE_CERT_REQUEST][SubjectID=$NonRoleUser$][Outcome=Success][ReqID=9][ProfileID=caECUserCert]CertSubject=UID=walrus-ecc,E=walrus@test.com,CN=walrus-ecc certificate request made with certificate profiles

[31/May/2015:11:53:01]http-bio-8443-exec-20: BasicProfile: validate start on setId=userCertSet
[31/May/2015:11:53:01]http-bio-8443-exec-20: SubjectNameConstraint: validate start
[31/May/2015:11:53:01]http-bio-8443-exec-20: SubjectNameConstraint: validate start
[31/May/2015:11:53:01]http-bio-8443-exec-20: SubjectNameConstraint: validate cert subject =UID=walrus-ecc,E=walrus@test.com,CN=walrus-ecc
[31/May/2015:11:53:01]http-bio-8443-exec-20: SubjectNameConstraint: validate() - sn500 dname = UID=walrus-ecc,E=walrus@test.com,CN=walrus-ecc
[31/May/2015:11:53:01]http-bio-8443-exec-20: SubjectNameConstraint: validate end
[31/May/2015:11:53:01]http-bio-8443-exec-20: RenewGracePeriodConstraint: validate start
[31/May/2015:11:53:01]http-bio-8443-exec-20: RenewGracePeriodConstraint: validate end
[31/May/2015:11:53:01]http-bio-8443-exec-20: ValidityConstraint: validate start
[31/May/2015:11:53:01]http-bio-8443-exec-20: ValidityConstraint: not before: Sun May 31 11:53:01 EDT 2015
[31/May/2015:11:53:01]http-bio-8443-exec-20: ValidityConstraint: not after: Fri Nov 27 11:53:01 EST 2015
[31/May/2015:11:53:01]http-bio-8443-exec-20: ValidityConstraint: range: 365
[31/May/2015:11:53:01]http-bio-8443-exec-20: ValidityConstraint: range unit: day
[31/May/2015:11:53:01]http-bio-8443-exec-20: ValidityConstraint: limit: Mon May 30 11:53:01 EDT 2016
[31/May/2015:11:53:01]http-bio-8443-exec-20: ValidityConstraint: validate end
[31/May/2015:11:53:01]http-bio-8443-exec-20: KeyConstraint: validate start
[31/May/2015:11:53:01]http-bio-8443-exec-20: CertRequestSubmitter: submit Key Type EC Not Matched
[SignedAuditEventFactory: create() message=[AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=$NonRoleUser$][Outcome=Failure][ReqID=9][InfoName=rejectReason]InfoValue=Request Rejected - Key Type EC Not Matched certificate request processed

Is this Firefox lacking support for user ECC certs or something on the Dogtag side?

There are already tickets and bugs being filed due to Mozilla's removal of crypto object support from newer Firefox.
This issue affects ALL key generation, so it's not just ECC.

Relevant tickets:
https://fedorahosted.org/pki/ticket/1285
https://fedorahosted.org/pki/ticket/1074

Bugs (more detail there):
https://bugzilla.redhat.com/show_bug.cgi?id=1151032
https://bugzilla.redhat.com/show_bug.cgi?id=1223476

workaround:

until Mozilla changes its mind and add back the support, or provide some replacement mechanism,
For Fedora, use FF v.34
For RHEL, use FF v.31.6.0-2.el5.11

due to the fact that this issue has been covered by a number of existing tickets, I will close this ticket in about a day unless there is a reason that this ticket needs to remain open.

Metadata Update from @bja:
- Issue set to the milestone: 10.2 Backlog

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1957

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
None
Normal
defect
CA
RHCust
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.