dogtagpki

#2489 ExternalCA: pki cli doesn't detect third party issued certs while it works with browser
Closed: migrated by dmoluguw. Opened by gkapoor.

Closed: migrated
Reopen Issue

Imported same ca_admin.p12 file in nssdb and firefox browser.Result varies in
case of externalCA.

  1. dogtag RootCA:

signing request works from both UI and cli.

  1. Dogtag ExternalCA

signing request works from UI only.

For a third party ROOTCA, cli commands failed with error:

ERROR: UNKNOWN_ISSUER encountered on
'CN=pki1.example.com,OU=TestExternal_master,O=EXAMPLE' results in a denied SSL
server cert!

Steps to Reproduce:

1. I have an externalCA setup.
2. Submit a cert request from cli using
<output>
pki -d /tmp/test -c Secret123 -h pki1.example.com -p 25144 -n "caadmin"
cert-request-review 8 --action=approve-----------------------------
Submitted certificate request
-----------------------------
  Request ID: 9
  Type: enrollment
  Request Status: pending
  Operation Result: success
</output>
3. approve request.
pki -d /tmp/test -c Secret123 -h pki1.example.com -p 25144 -n "caadmin"
cert-request-review 9 --action=approve
ERROR: UNKNOWN_ISSUER encountered on
'CN=pki1.example.com,OU=TestExternal_master,O=EXAMPLE' results in a denied SSL
server cert!
IOException: SocketException cannot write on socket

Additional info:

Complete stack::
ExternalCA cert::
[root@pki1 ~]# pki -v -d /tmp/test -c Secret123 -h pki1.example.com -p 25144 -n
"caadmin" cert-request-review 8 --action=approve
PKI options: -v -d /tmp/test -c Secret123
PKI command: pki1.example.com -h pki1.example.com -p 25144 -n caadmin
cert-request-review 8 --action=approve
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java
-Djava.ext.dirs=/usr/share/pki/lib
-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties
com.netscape.cmstools.cli.MainCLI -d /tmp/test -c Secret123 --verbose -h
pki1.example.com -p 25144 -n caadmin cert-request-review 8 --action=approve
Server URI: http://pki1.example.com:25144
Client security database: /tmp/test
Message format: null
Command: cert-request-review 8 --action=approve
Initializing client security database
Logging into security token
Module: cert
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:25144
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
  Server: Apache-Coyote/1.1
  Cache-Control: private
  Expires: Thu, 01 Jan 1970 05:30:00 IST
  Location: https://pki1.example.com:25142/ca/rest/account/login
  Content-Length: 0
  Date: Wed, 28 Sep 2016 14:20:17 GMT
HTTP redirect: https://pki1.example.com:25142/ca/rest/account/login
Client certificate: caadmin
HTTP request: GET /ca/rest/account/login HTTP/1.1
  Accept-Encoding: gzip, deflate
  Accept: application/xml
  Host: pki1.example.com:25142
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Server certificate: CN=pki1.example.com,OU=TestExternal_master,O=EXAMPLE
ERROR: UNKNOWN_ISSUER encountered on
'CN=pki1.example.com,OU=TestExternal_master,O=EXAMPLE' results in a denied SSL
server cert!
Server certificate: CN=pki1.example.com,OU=TestExternal_master,O=EXAMPLE
java.io.IOException: SocketException cannot write on socket
        at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1099)
        at org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:56)
        at org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(Abst
ractSessionOutputBuffer.java:147)
        at org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSe
ssionOutputBuffer.java:154)
        at org.apache.http.impl.AbstractHttpClientConnection.doFlush(AbstractHt
tpClientConnection.java:278)
        at org.apache.http.impl.AbstractHttpClientConnection.flush(AbstractHttp
ClientConnection.java:283)
        at org.apache.http.impl.conn.ManagedClientConnectionImpl.flush(ManagedC
lientConnectionImpl.java:175)
        at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpReque
stExecutor.java:260)
        at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExec
utor.java:125)
        at org.apache.http.impl.client.DefaultRequestDirector.tryExecute(Defaul
tRequestDirector.java:715)
        at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRe
questDirector.java:520)
        at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpC
lient.java:906)
        at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpC
lient.java:805)
        at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invo
ke(ApacheHttpClient4Engine.java:283)
        at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(Cli
entInvocation.java:407)
        at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(
ClientInvoker.java:102)
        at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(Cl
ientProxy.java:62)
        at com.sun.proxy.$Proxy23.login(Unknown Source)
        at
com.netscape.certsrv.account.AccountClient.login(AccountClient.java:45)
        at com.netscape.cmstools.cli.ProxyCLI.execute(ProxyCLI.java:116)
        at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
        at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:562)
        at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:574)
ERROR: Command '[u'/usr/lib/jvm/jre-1.8.0-openjdk/bin/java',
u'-Djava.ext.dirs=/usr/share/pki/lib',
u'-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties',
'com.netscape.cmstools.cli.MainCLI', '-d', '/tmp/test', '-c', 'Secret123',
'--verbose', '-h', 'pki1.example.com', '-p', '25144', '-n', 'caadmin',
'cert-request-review', '8', '--action=approve']' returned non-zero exit status
255

From IRC discussions on 10/05/2016:

Per discussion between edewata with alee we're going to include the certificate chain in the PKCS #12 file so it's no longer necessary to import the certificate chain separately to the client database.

This is not a blocker since the certificate chain can still be imported separately.

Per Offline Triage of 11/30/2016-12/01/2016: FUTURE - minor

Metadata Update from @gkapoor:
- Issue assigned to edewata
- Issue set to the milestone: FUTURE

Metadata Update from @mharmsen:
- Custom field feature adjusted to None
- Custom field proposedmilestone adjusted to None
- Custom field proposedpriority adjusted to None
- Custom field reviewer adjusted to None
- Custom field version adjusted to None
- Issue close_status updated to: None
- Issue priority set to: major (was: minor)
- Issue set to the milestone: 10.5 (was: FUTURE)

[20171025] - Offline Triage ==> 10.6

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.6 (was: 10.5)

Per 10.5.x/10.6 Triage: 10.5.x

edewata: usability improvement

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.5 (was: 10.6)

Duplicated here: https://pagure.io/dogtagpki/issue/3118

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2609

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.

Metadata Update from @dmoluguw:
- Issue close_status updated to: migrated
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
defect
CA
QE
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.