February 2017 - Pki-devel - Dogtag Pki List Archives

[PATCH] 929 Fixed MergePKIWebapps upgrade script.

by Endi Sukma Dewata

The MergePKIWebapps upgrade script has been modified to ensure that the old deployment descriptors exist before deleting them. https://fedorahosted.org/pki/ticket/2582 Pushed to master under trivial rule. -- Endi S. Dewata

7 years, 2 months

1
0
0 / 0

Re: [Pki-devel] [PATCH] 0151..0155 Add profile component that copies CN to SAN

by Fraser Tweedale

Discussion for devs: once this is merged should I updated all the included service-oriented profiles (e.g. caCAcert; not user or CA cert profiles) to add this profile component? IMO we should do it, but we should not automatically update existing installations. Instead, we (I) can produce a KBase article about using the new component. Let me know what you think. Cheers, Fraser On Thu, Feb 02, 2017 at 12:46:30PM -0700, Matthew Harmsen wrote: > On 02/01/2017 12:25 AM, Fraser Tweedale wrote: > > Hi all, > > > > The attached patches implement the long-desired feature to copy CN > > to SubjectAltName (https://fedorahosted.org/pki/ticket/1710). > > > > I've also pushed the branch to my GitHub repo; feel free to review > > the patches there: > > https://github.com/frasertweedale/pki/commits/feature/1710-cn-to-san > > > > Thanks, > > Fraser > > > > > > _______________________________________________ > > Pki-devel mailing list > > Pki-devel(a)redhat.com > > https://www.redhat.com/mailman/listinfo/pki-devel > > Fraser, > > In order to review this patch, I am going to apply it and make a scratch > build of Dogtag 10.2.6 on RHEL 7.2 so that Red Hat IT can test it out for > us. > > If they give us their approval, you can consider yourself granted an ACK on > this patch and check it into master so that I can cherry-pick it into the > 10.3 branches. > > -- Matt > > P. S. - FYI, the following conversation took place on #cs today: > > <mharmsen> dminnich,walrus: ftweedal has released a patch for > https://fedorahosted.org/pki/ticket/1710 - Add profile component > that copies CN to SAN -- if I applied that patch to a 10.3.3 > pki-core for RHEL 7.3, could you guys test it out, or in order to > test it out, do you need a scratch build of Dogtag 10.2.6 on RHEL > 7.2 like last time? > <walrus> mharmsen: having a scratch build of 7.2 would be quickest > <walrus> we are just now planning the 7.3 upgrade, which will take > some time to get into dev > <mharmsen> walrus: okay, I can try to see if I can do that, but > remember that we will not deliver an official RHEL 7.2 build of RHCS 9.1 > <walrus> yeah we should be on 7.3 in a month or so... a lot of > things to test on a lot of servers :) > <walrus> csnell|wfh: ^^^ > <mharmsen> walrus: completely understood! LOL > <dminnich> mharmsen: that will be a very welcome patch > <dminnich> mharmsen: do you happen to know if ACLs work against SANs? > <mharmsen> dminnich: not off the top of my head > <mharmsen> edewata, cfu, jmagne: ^^^? > <dminnich> that is something on our to investigate list as well > <mharmsen> dminnich: I am going to drop an email to ftweedal, and I > will ask that question > <edewata> mharmsen: no idea about SAN > <jmagne> mharmsen, don't know > <cfu> dminnich, mharmsen , what does that mean? > <dminnich> cfu: right now we allow only people in LDAP group X to > issue certs for domains that meet Y regex. but we don't check > SANs. so somebody could CN=blah.devlab.com and get approved but add > a SAN for www.redhat.com and we don't deny it > <edewata> dminnich: where is X & Y defined? > <dminnich> > https://gitolite.corp.redhat.com/cgit/puppet-cfg/modules/rhcs.git/tree/te... > https://gitolite.corp.redhat.com/cgit/puppet-cfg/modules/rhcs.git/tree/te... > <dminnich> edewata: ^ some of that might be added by puppet later. but > thats the gist > <edewata> dminnich: ok, it's in profile, not ACL > <dminnich> authz.acl=group and constraints > <cfu> dminnich, dminnich ah, I see. so it's like a pattern > constraint just like what we have for subject name now in the > profile. Yeah, you can write a constraint plugin for that > <cfu> dminnich, anyway, feel free to file a ticket for it. > <dminnich> cfu: will do >

7 years, 2 months

1
0
0 / 0

[PATCH] 928 Cleaned up error handling in client and PKCS12 CLIs.

by Endi Sukma Dewata

The client and PKCS12 CLIs have been modified to use Exceptions instead of System.exit() such that errors can be handled consistently. Pushed to master under trivial rule. -- Endi S. Dewata

7 years, 2 months

1
0
0 / 0

[PATCH] 927 Added --serial param to pki ca-cert-request-submit.

by Endi Sukma Dewata

A new parameter has been added to set the serial number field in CertEnrollmentRequest and in profile input if available. Pushed to master under trivial rule. -- Endi S. Dewata

7 years, 2 months

1
0
0 / 0

[PATCH] 926 Added --renewal param to pki ca-cert-request-submit.

by Endi Sukma Dewata

A new parameter has been added to set the renewal field in CertEnrollmentRequest. Pushed to master under trivial rule. -- Endi S. Dewata

7 years, 2 months

1
0
0 / 0

[PATCH] 925 Troubleshooting improvements for CAEnrollProfile.

by Endi Sukma Dewata

To help troubleshooting the CAEnrollProfile class has been modified to chain the original exceptions. Pushed to master under trivial rule. -- Endi S. Dewata

7 years, 2 months

1
0
0 / 0

Karma Requests for pki-core-10.3.5-11

by Matthew Harmsen

*The following updated candidate builds of pki-core 10.3.5 were generated:* * *Fedora 24* o *pki-core-10.3.5-11.fc24 <https://koji.fedoraproject.org/koji/buildinfo?buildID=837471> * * *Fedora 25* o *pki-core-10.3.5-11.fc25 <https://koji.fedoraproject.org/koji/buildinfo?buildID=837473> * * *Fedora 26* o *pki-core-10.3.5-11.fc26 <https://koji.fedoraproject.org/koji/buildinfo?buildID=837475>* *These builds address the following PKI TRAC tickets:* * *PKI TRAC Ticket #1741 - ECDSA Certificates Generated by Certificate System fail NIST validation test with parameter field. <https://fedorahosted.org/pki/ticket/1741>* * *PKI TRAC Ticket #2450 - Unable to search certificate requests using the latest request ID <https://fedorahosted.org/pki/ticket/2450>* * *PKI TRAC Ticket #2534 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status <https://fedorahosted.org/pki/ticket/2534>* * *PKI TRAC Ticket #2564 - pki-tomcat for 10+ minutes before generating cert <https://fedorahosted.org/pki/ticket/2564>* * *PKI TRAC Ticket #2570 - Problem with default AJP hostname in IPv6 environment. <https://fedorahosted.org/pki/ticket/2570>* * *PKI TRAC Ticket #2573 - CA Certificate Issuance Date displayed on CA website incorrect <https://fedorahosted.org/pki/ticket/2573>* * *PKI TRAC Ticket #2579 - NumberFormatException in LDAPProfileSubsystem <https://fedorahosted.org/pki/ticket/2579>* *Please provide Karma for the following builds:* * *Fedora 24* o *https://bodhi.fedoraproject.org/updates/FEDORA-2017-a2898f25b1 pki-core-10.3.5-11.fc24 <https://bodhi.fedoraproject.org/updates/FEDORA-2017-a2898f25b1> * * *Fedora 25* o *https://bodhi.fedoraproject.org/updates/FEDORA-2017-fe062eaff7 pki-core-10.3.5-11.fc25 <https://bodhi.fedoraproject.org/updates/FEDORA-2017-fe062eaff7>*

7 years, 2 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-devel February 2017