#2828 CA cert renewal can change Subject DN attribute encoding
Closed: fixed 2 years ago Opened 2 years ago by ftweedal.

When renewing the CA cert via Certmonger, if the CA Subject DN uses PrintableString
attribute encoding, the renewed cert will have UTF8String attribute encoding. This
causes a variety of problems in other programs because it may regard the new certificate as
a different CA.

The problem arises due the the certmonger dogtag-ipa-renew-agent helper uses the following procedure to renew the CA certificate:

  1. Generate CSR. The Subject DN in the CSR is encoding-identical to the tracked CA certificate.
  2. Submit CSR (profileSubmit)
  3. Review request as RA agent (profileReview)
  4. Process request as RA agent (profileProcess)

The stringified subject DN is included in the profileReview response and re-submitted in the profileProcess request data. Then the string is converted back into a X500Name (this time using the default attribute encoding i.e. UTF8String) and set into the request, potentially changing the attribute encoding from the CSR.


Metadata Update from @edewata:
- Custom field component adjusted to None
- Custom field feature adjusted to None
- Custom field origin adjusted to None
- Custom field proposedmilestone adjusted to None
- Custom field proposedpriority adjusted to None
- Custom field reviewer adjusted to None
- Custom field type adjusted to None
- Custom field version adjusted to None

2 years ago

Metadata Update from @mharmsen:
- Issue assigned to mharmsen

2 years ago

Metadata Update from @mharmsen:
- Assignee reset

2 years ago

Metadata Update from @mharmsen:
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

2 years ago

Fix pushed to master (87b4d00cea01c00f6c0422934fc15b9e06afb6f6)

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

2 years ago

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

2 years ago

Metadata Update from @mharmsen:
- Issue set to the milestone: 10.5.0 (was: 0.0 NEEDS_TRIAGE)

2 years ago

Metadata Update from @mharmsen:
- Custom field fixedinversion adjusted to pki-core-10.5.0-1.fc27

2 years ago

Login to comment on this ticket.

Metadata