If the CA signing cert does not have the Subject Key Identifier extension, issuance of certificates fails. Although such a CA certificate is not compliant with RFC 5280, this does happen in the wild, and we previously handled this case by computing the SHA-1 digest of the signing key as a last resort. This behaviour was accidentally removed in 3c43b1119ca978c296a38a9fe404e1c0cdcdab63.
Metadata Update from @ftweedal: - Issue assigned to ftweedal
Metadata Update from @ftweedal: - Custom field component adjusted to None - Custom field feature adjusted to None - Custom field origin adjusted to None - Custom field proposedmilestone adjusted to None - Custom field proposedpriority adjusted to None - Custom field reviewer adjusted to None - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1499054 - Custom field type adjusted to None - Custom field version adjusted to None
Gerrit review: https://review.gerrithub.io/381619
How to test:
AuthorityKeyIdentifierExtDefault
Metadata Update from @mharmsen: - Issue set to the milestone: 0.0 NEEDS_TRIAGE
Metadata Update from @mharmsen: - Issue priority set to: blocker - Issue set to the milestone: 10.5 (was: 0.0 NEEDS_TRIAGE)
Metadata Update from @ftweedal: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
Fixed in 8ec0cbd1bef372ed50e19f6c5b6332b75209beb0.
Metadata Update from @mharmsen: - Issue set to the milestone: 10.5.0 (was: 10.5)
Metadata Update from @mharmsen: - Custom field fixedinversion adjusted to pki-core-10.5.0-1.fc27
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/2949
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Login to comment on this ticket.