From CA's unsecure EE page url try to renew a certificate with profile 'Self-renew user SSL client certificates', it does not show pop-up dialog to select SSL Client certificate.
Steps to Reproduce:
1. Create a User cert and import it to the browser. 2. Clear browser history 3. Visit CA's unsecure EE page url 4. Select the profile "Renewal: Self-renew user SSL client certificates" 5. Click on Submit button
Actual results:
Sorry, your request is not submitted. The reason is "You have no certificates to be renewed or the certificates are malformed.".
Expected results:
A pop-up dialog should ask user to select a SSL client cert.
Additional info:
Debug log has this: [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: CMSServlet:service() uri = /ca/ee/ca/profileSelect [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: CMSServlet::service() param name='profileId' value='caSSLClientSelfRenewal' [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: CMSServlet: caProfileSelect start to service. [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: ProfileSelectServlet: start serving [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: CMSServlet: in auditSubjectID [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: CMSServlet: auditSubjectID auditContext null [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: CMSServlet: in auditGroupID [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: CMSServlet: auditGroupID auditContext null [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: checkACLS(): ACLEntry expressions= user="anybody" [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: evaluating expressions: user="anybody" [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: evaluated expression: user="anybody" to be true [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: DirAclAuthz: authorization passed [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: SignedAuditEventFactory: create() message=[AuditEvent=AUTHZ_SUCCESS][SubjectID=$Unidentified$][Outcome=S uccess][aclResource=certServer.ee.profile][Op=read] authorization success [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: SignedAuditEventFactory: create() message=[AuditEvent=ROLE_ASSUME][SubjectID=$Unidentified$][Outcome=Suc cess][Role=<null>] assume privileged role [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: ProfileSelectServlet: SubId=profile [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: ProfileSelectServlet: profileId=caSSLClientSelfRenewal [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: ProfileSelectServlet: keyArchivalEnabled is true [13/Oct/2015:14:07:20][http-bio-30044-exec-15]: CMSServlet: curDate=Tue Oct 13 14:07:20 EDT 2015 id=caProfileSelect time=2 [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CMSServlet:service() uri = /ca/eeca/ca/profileSubmitSSLClient [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CMSServlet::service() param name='profileId' value='caSSLClientSelfRenewal' [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CMSServlet::service() param name='renewal' value='true' [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CMSServlet::service() param name='xmlOutput' value='false' [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CMSServlet: caProfileSubmitSSLClient start to service. [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: xmlOutput false [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: ProfileSubmitServlet: isRenewal true [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: according to ccMode, authorization for servlet: caProfileSubmit is LDAP based, not XML {1}, use default authz mgr: {2}. [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: ProfileSubmitServlet: profile: caSSLClientSelfRenewal [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CAProcessor: Input Parameters: [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CAProcessor: - isRenewal: false [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CAProcessor: - remoteHost: 10.8.60.44 [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CAProcessor: - profileId: caSSLClientSelfRenewal [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CAProcessor: - remoteAddr: 10.8.60.44 [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: RenewalSubmitter: isRenewal true [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: processRenewal: renewProfileId caSSLClientSelfRenewal [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: RenewalSubmitter: renewal: serial_num not found, must do ssl client auth [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: RenewalSubmitter: renewal: no ssl client cert chain [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: You have no certificates to be renewed or the certificates are malformed. [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: ProfileSubmitServlet: error in processing request: You have no certificates to be renewed or the certificates are malformed. [13/Oct/2015:14:07:32][http-bio-30044-exec-15]: CMSServlet: curDate=Tue Oct 13 14:07:32 EDT 2015 id=caProfileSubmitSSLClient time=2
It seems that we either shouldn't display links that won't work in the unsecure EE interface, or we should make those links redirect to the secure interface when clicked.
Per CS/DS Meeting of 10/19/2015: 10.4
NOTE: Nice usability issue, but it's always been like this.
Wnen fixed, either: (a) SSL links should be removed from non-SSL page, or (b) SSL links should be redirected from non-SSL page
Metadata Update from @aakkiang: - Issue set to the milestone: UNTRIAGED
As per grooming meeting, we support only SECURE ports.
Metadata Update from @dmoluguw: - Custom field feature adjusted to None - Custom field proposedmilestone adjusted to None - Custom field proposedpriority adjusted to None - Custom field reviewer adjusted to None - Custom field version adjusted to None - Issue close_status updated to: wontfix - Issue status updated to: Closed (was: Open)
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/2211
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Login to comment on this ticket.