When trying to implement a FreeIPA bug workaround (https://bugzilla.redhat.com/show_bug.cgi?id=1318616), setting the ca.cert.signing.certusage flag to AnyCA has no effect - it behaves the same way as if it was set to SSLCA.
Actual results
The CA fails to start with the following messages:
SSL Library Error: -8172 Certificate is signed by an untrusted issuer. Unable to verify certificate 'ca1/server'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.
Expected results:
The CA starts without performing the additional check.
Version:
The described workaround does work with 10.2.6-16, but it no longer works with 10.2.6-19 or 10.3.5-4.
Related bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1325756
It looks like that error message came from httpd/mod_nss. PKI for sure does not generate that message. You might want to check recent changes in httpd/mod_nss/nss.
I was not able to replicate the problem by setting this parameter in CS.cfg:
ca.cert.signing.certusage=AnyCA
The PKI debug log shows that the validation works properly:
[08/Sep/2016:08:58:17][localhost-startStop-2]: CertUtils: verifySystemCerts() cert tag=signing [08/Sep/2016:08:58:17][localhost-startStop-2]: CertUtils: verifySystemCertByTag(signing) [08/Sep/2016:08:58:17][localhost-startStop-2]: CertUtils: verifySystemCertByNickname(caSigningCert cert-pki-tomcat CA, AnyCA) [08/Sep/2016:08:58:17][localhost-startStop-2]: CertUtils: verifySystemCertByNickname(): calling verifyCertificate(caSigningCert cert-pki-tomcat CA, true, AnyCA)
I'm closing the ticket since it's not a PKI issue.
Metadata Update from @tkrizek: - Issue set to the milestone: 10.3.6
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/2571
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Login to comment on this ticket.