Setup :
RootCA --> ExternalCA --> ExternalCA1
Failure observed in externalCA1 when ExternalCA signed certificate for it using CMC.
Installation failed with "CertInfoProfile: Unable to populate certificate: Unable to get ca certificate: Unable to initialize, java.io.IOException: extra DER value data (constructor)".
Steps to Reproduce:
1. Generate a step1 configuration file for generating csr for ExternalCA1. 2. Use this csr and proceed with "Issuing CA Signing Certificate with CMC ". Here in while sending HttpClient request i point to ExternalCA credentials. if i get my certificate signed using procedure as mentioned in Document(http://pki.fedoraproject.org/wiki/Issuing_CA_Signing_Certificate_with_CMC), I get pkcs7 certificate at the end which i have put in "pki_cert_chain_path" -- pki_ca_signing_cert_path=Ca.crt (I got this certificate from CA Agent page) This is get signed using the ExternalCA using CMC mechanism. -- pki_cert_chain_path=ca_signing.crt This is my certificate chain in pkcs7 format which has RootCA , ExternalCA, ExternalCA1 certs in it. 3. Proceed with step2 of installation. So while doing 2nd step for ExternalCA1 it fails with "Caused by: java.security.cert.CertificateException: Unable to initialize, java.io.IOException: extra DER value data (constructor)"
Actual results:
Installation failed <system> 0.http-bio-31443-exec-3 - [25/Nov/2017:00:41:24 IST] [3] [3] Cannot build CA chain. Error java.security.cert.CertificateException: Unable to initialize, java.io.IOException: extra DER value data (constructor) </system>
Expected results:
Installation should work and ExternalCA1 should be up.
Additional info:
<system> 0.http-bio-31443-exec-3 - [25/Nov/2017:00:41:24 IST] [3] [3] Cannot build CA chain. Error java.security.cert.CertificateException: Unable to initialize, java.io.IOException: extra DER value data (constructor) </system>
Metadata Update from @mharmsen: - Custom field component adjusted to None - Custom field feature adjusted to None - Custom field origin adjusted to None - Custom field proposedmilestone adjusted to None - Custom field proposedpriority adjusted to None - Custom field reviewer adjusted to None - Custom field type adjusted to None - Custom field version adjusted to None - Issue assigned to cfu - Issue priority set to: critical - Issue set to the milestone: 10.5
Metadata Update from @mharmsen: - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1518096
commit a6a9576d506fbe6944b3dca32258c8661c2a800a (HEAD -> master, origin/master, origin/HEAD, caValidity) Author: Christina Fu cfu@redhat.com Date: Thu Nov 30 15:28:38 2017 -0800
Ticket #2861 ExternalCA: Failures in ExternalCA when tried to setup with CMC signed certificates The issue was found when the ValidityConstraint does not restrict the cert signed to not exceed the CA signing cert's expiry date. Upon close examination, it appears that the CAValidityConstraint was not registered by default. By registering this constraint and replacing the ValidityConstraint in the caCMCcaCert profile, it effectively sets the restriction. Change-Id: I557894cfffacc656e3b3a453fe7e7c98f0b61d87
Metadata Update from @cfu: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
Metadata Update from @mharmsen: - Issue set to the milestone: 10.5.3 (was: 10.5)
Metadata Update from @mharmsen: - Custom field fixedinversion adjusted to pki-core-10.5.3-1.fc27
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/2981
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Login to comment on this ticket.