pkispawn shows confusing root certificate nicknames

[SilleBille]

This issue was migrated from Pagure Issue #2925.Originally filed by mharmsen on 2018-02-06

pkispawn KRA subsystem with SSL Directory Server shows confusing root cert nicknames.

Steps to Reproduce:

1. Setup a Directory Server SSL instance with the self signed CA cert. 
2. pkispawn a CA subsystem using SSL DS.
3. Configure DS SSL instance to be trusted by issuing DS server certificate
    by newly created CA.
4. pkispawn KRA instance via two step process using externally issued
   CMC certs.  The nickname for DS SSL certificate
   (pki_ds_secure_connection_ca_nickname) is not provided in the
   pkispawn config file.

The second step of KRA installation shows message:
* "Imported certificate "Directory Server CA certificate"

More details are contained in the associated bug.

Actual results:

KRA installation is successful.

Verbose mode shows message "Imported certificate "Directory Server CA certificate". 

Looks like DS Cert is imported first with the default nickname
"Directory Server CA certificate". When other pkcs7 is imported, since DS cert is the
root CA cert, it kept the nickname of root cert that was initially imported with,
i.e "Directory Server CA certificate". Probably the code did not care about the nickname.

Expected results:

While importing pkcs7 the root certificate nickname should be the one auto generated
from the subject DN.

[SilleBille]

Posted by mharmsen on 2018-04-25:

Per 10.5.x/10.6 Triage: 10.6

edewata: install works, but the log is misleading

[SilleBille]

Posted by edewata on 2018-04-27:

Might be related to IPA issue: https://pagure.io/freeipa/issue/7516