dogtagpki

#2723 ExternalCA installation fails in absence of AKI extension
Closed: fixed Opened by mharmsen.

Closed: fixed
Reopen Issue

ExternalCA installation fails in absence of AKI extension.This problem can be
easily reproduced using http://pki.fedoraproject.org/wiki/Installing_CA_with_Ex
ternaly-Signed_CA_Certificate#Signing_using_NSS_database.
Use the documented method and try to install externalCA and you will hit issue.

<error>
<debug snip>
31/May/2017:04:52:59][http-bio-29443-exec-3]: ValidityDefault: start time: 0
[31/May/2017:04:52:59][http-bio-29443-exec-3]: ValidityDefault: not
before: Wed May 31 04:52:59 EDT 2017
[31/May/2017:04:52:59][http-bio-29443-exec-3]: ValidityDefault: range: 720
[31/May/2017:04:52:59][http-bio-29443-exec-3]: ValidityDefault: range
unit: day
[31/May/2017:04:52:59][http-bio-29443-exec-3]: ValidityDefault: not
after: Tue May 21 04:52:59 EDT 2019
[31/May/2017:04:52:59][http-bio-29443-exec-3]: ValidityDefault:
populate: adjustValidity is true
[31/May/2017:04:52:59][http-bio-29443-exec-3]: ValidityDefault:
populate: resetting notAfter to caNotAfter
[31/May/2017:04:52:59][http-bio-29443-exec-3]: CertInfoProfile:
Populating certificate with
com.netscape.cms.profile.def.AuthorityKeyIdentifierExtDefault
[31/May/2017:04:52:59][http-bio-29443-exec-3]: CertInfoProfile: Unable
to populate certificate: extension not found
[31/May/2017:04:52:59][http-bio-29443-exec-3]: Unable to create local
certificate: extension not found
[31/May/2017:04:52:59][http-bio-29443-exec-3]: configCert() exception
caught:java.io.IOException: Unable to create local certificate:
extension not found
java.io.IOException: Unable to create local certificate: extension not found
        at
com.netscape.cms.servlet.csadmin.CertUtil.createLocalCert(CertUtil.java:602)
        at
com.netscape.cms.servlet.csadmin.CertUtil.createLocalCert(CertUtil.java:417)
        at
com.netscape.cms.servlet.csadmin.ConfigurationUtils.configCert(ConfigurationUti
ls.java:2711)
        at
org.dogtagpki.server.rest.SystemConfigService.processCert(SystemConfigService.j
ava:475)
        at
org.dogtagpki.server.rest.SystemConfigService.processCerts(SystemConfigService.
java:372)
        at
org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.jav
a:176)
        at
org.dogtagpki.server.rest.SystemConfigService.configure(SystemConfigService.jav
a:110)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.ja
va:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
        at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvo
ker.java:280)
        at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java
:234)
        at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java
:221)
        at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java
:356)
        at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java
:179)
        at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(Se
rvletContainerDispatcher.java:220)
        at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpSer
vletDispatcher.java:56)
        at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpSer
vletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.ja
va:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
        at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
        at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
        at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175)
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFil
terChain.java:297)
        at
org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterCha
in.java:55)
        at
org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.ja
va:191)
        at
org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.ja
va:187)
        at java.security.AccessController.doPrivileged(Native Method)
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain
.java:186)
        at
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.ja
va:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
        at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
        at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
        at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:260)
        at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFil
terChain.java:237)
        at
org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterCha
in.java:55)
        at
org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.ja
va:191)
        at
org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.ja
va:187)
        at java.security.AccessController.doPrivileged(Native Method)
        at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain
.java:186)
        at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:
218)
        at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:
110)
        at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.ja
va:506)
        at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
        at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
        at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)
        at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:11
6)
        at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
        at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processo
r.java:1087)
        at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractPr
otocol.java:637)
        at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316
)
        at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:
61)
        at java.lang.Thread.run(Thread.java:748)
Caused by: extension not found
        at
com.netscape.cms.profile.def.EnrollDefault.addExtension(EnrollDefault.java:370)
        at
com.netscape.cms.profile.def.AuthorityKeyIdentifierExtDefault.populate(Authorit
yKeyIdentifierExtDefault.java:186)
        at
com.netscape.certsrv.profile.CertInfoProfile.populate(CertInfoProfile.java:100)
        at
com.netscape.cms.servlet.csadmin.CertUtil.createLocalCert(CertUtil.java:546)
        ... 68 more
[31/May/2017:04:52:59][http-bio-29443-exec-3]: Error in setting
certificate names and key sizes: java.io.IOException: Unable to create
local certificate: extension not found
[31/May/2017:04:52:59][http-bi
</error>

Steps to Reproduce:

follow the document.

Actual results:

ExternalCA installation fails

Expected results:

ExternalCA installation should work

Metadata Update from @mharmsen:
- Custom field component adjusted to General
- Custom field feature adjusted to ''
- Custom field origin adjusted to Community
- Custom field proposedmilestone adjusted to ''
- Custom field proposedpriority adjusted to ''
- Custom field reviewer adjusted to ''
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1457435
- Custom field type adjusted to defect
- Custom field version adjusted to ''
- Issue priority set to: critical

The wiki page has been updated to add AKID/SKID extensions into the certificates issued by the external NSS database:

http://pki.fedoraproject.org/wiki/Installing_CA_with_Externaly-Signed_CA_Certificate#Signing_using_NSS_database
Edited by edewata

Metadata Update from @edewata:
- Issue close_status updated to: fixed
- Issue set to the milestone: 10.4.8 (was: 10.4)
- Issue status updated to: Closed (was: Open)

Metadata Update from @mharmsen:
- Issue set to the milestone: 1.0 TASKS (was: 10.4.8)

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2843

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
None
Low
defect
''
''
Community
''
''
''
General
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.