search

SilleBille / pki

Dogtag PKI Issues should be reported to the Dogtag PKI Pagure Issues site
https://pagure.io/dogtagpki/issues
GNU General Public License v2.0
1 stars 1 forks source link

pki pkcs12-cert-mod gives a success message when a non-existing nickname is provided #441

Closed SilleBille closed 4 years ago

SilleBille commented 4 years ago

This issue was migrated from Pagure Issue #2985.Originally filed by mharmsen on 2018-04-10

pki pkcs12-cert-mod gives a success message when a non-existing nickname is provided

Steps to Reproduce:

[rootqe-blade-09 ~]# pki pkcs12-cert-find --pkcs12-file ca.p12 --pkcs12-password-file password.txt 
---------------
6 entries found
---------------
  Certificate ID: e5265d08d36cde2bdff5caf5eeeb783d7a06b9a9
  Serial Number: 0xa
  Nickname: caSigningCert cert-pki-subca
  Subject DN: CN=Certificate Authority 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
  Issuer DN: CN=Certificate Authority,OU=pki-rootca,O=IdmqeLabEngBosRedhat Domain
  Has Key: true

  Certificate ID: 895682d8630ce9995ea6b7ad924b97e0424662d
  Serial Number: 0x1
  Nickname: ocspSigningCert cert-pki-subca
  Subject DN: CN=OCSP Signing Certificate 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
  Issuer DN: CN=Certificate Authority 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
  Has Key: true

  Certificate ID: c0b211501718d3e72118c0df578e1d7595f74136
  Serial Number: 0x3
  Nickname: auditSigningCert cert-pki-subca
  Subject DN: CN=CA Audit Signing Certificate 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
  Issuer DN: CN=Certificate Authority 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
  Has Key: true

  Certificate ID: da8b3c14905f88d435a55c5d9ad3c7e85b11367b
  Serial Number: 0x1
  Nickname: Certificate Authority - pki-rootca - IdmqeLabEngBosRedhat Domain
  Subject DN: CN=Certificate Authority,OU=pki-rootca,O=IdmqeLabEngBosRedhat Domain
  Issuer DN: CN=Certificate Authority,OU=pki-rootca,O=IdmqeLabEngBosRedhat Domain
  Has Key: false

  Certificate ID: f086e60c6f211bd2940b420e2ac6d3c1a8256919
  Serial Number: 0x2
  Nickname: Server-Cert cert-pki-subca
  Subject DN: CN=qe-blade-03.idmqe.lab.eng.bos.redhat.com,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
  Issuer DN: CN=Certificate Authority 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
  Has Key: true

  Certificate ID: 37b1e733caed07e9ef918c07aaba2c23898b1867
  Serial Number: 0xb
  Nickname: subsystemCert cert-pki-subca
  Subject DN: CN=CA Subsystem Certificate 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
  Issuer DN: CN=Certificate Authority,OU=pki-rootca,O=IdmqeLabEngBosRedhat Domain
  Has Key: true
[rootqe-blade-09 ~]# pki pkcs12-key-find --pkcs12-file ca.p12 --pkcs12-password-file password.txt
---------------
5 entries found
---------------
  Key ID: e5265d08d36cde2bdff5caf5eeeb783d7a06b9a9
  Subject DN: CN=Certificate Authority 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain

  Key ID: 895682d8630ce9995ea6b7ad924b97e0424662d
  Subject DN: CN=OCSP Signing Certificate 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain

  Key ID: c0b211501718d3e72118c0df578e1d7595f74136
  Subject DN: CN=CA Audit Signing Certificate 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain

  Key ID: f086e60c6f211bd2940b420e2ac6d3c1a8256919
  Subject DN: CN=qe-blade-03.idmqe.lab.eng.bos.redhat.com,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain

  Key ID: 37b1e733caed07e9ef918c07aaba2c23898b1867
  Subject DN: CN=CA Subsystem Certificate 1,OU=pki-subca,O=IdmqeLabEngBosRedhat Domain
[rootqe-blade-09 ~]# pki pkcs12-cert-mod "caSigningCert cert-pki-rootCA" --pkcs12-file ca.p12 --pkcs12-password-file password.txt --trust-flags "CTu,Cu,Cu"
---------------------------------------------------
Updated certificate "caSigningCert cert-pki-rootCA"
---------------------------------------------------

Expected results:

pki pkcs12-cert-mod should fail with an appropriate error message
SilleBille commented 4 years ago

Posted by mharmsen on 2018-04-10:

Per 10.5.x/10.6 Triage: FUTURE

edewata: negative case