Skip to content

Commit

Permalink
Resolve: pkispawn does not change default ecc key size from nistp256 …
Browse files Browse the repository at this point in the history
…when nistp384 is specified in spawn config

Ticket #2552.

This fix turned out simple. The client was correctly setting the required data, but it was putting the curveName in the
"keySize" field of the SystemCertData object sent to the back end. The configuration routine was trying to find the name in the "curveName" field when its really in the "keySize" field. This issue is restricted to the ECC case. It is fine to simply fix this in the server, since the "keySize" is a string anyway and it makes decent sense.
  • Loading branch information
Jack Magne committed Dec 9, 2016
1 parent e84e4a3 commit ae350a3
Showing 1 changed file with 4 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@
import javax.ws.rs.core.Request;
import javax.ws.rs.core.UriInfo;

import netscape.security.x509.X509CertImpl;

import org.apache.commons.lang.StringUtils;
import org.apache.commons.lang.mutable.MutableBoolean;
import org.mozilla.jss.CryptoManager;
Expand Down Expand Up @@ -66,8 +68,6 @@
import com.netscape.cmsutil.crypto.CryptoUtil;
import com.netscape.cmsutil.util.Utils;

import netscape.security.x509.X509CertImpl;

/**
* @author alee
*
Expand Down Expand Up @@ -453,8 +453,8 @@ public void processCert(

} else if (!request.getStepTwo()) {
if (keytype.equals("ecc")) {
String curvename = certData.getKeyCurveName() != null ?
certData.getKeyCurveName() : cs.getString("keys.ecc.curve.default");
String curvename = certData.getKeySize() != null ?
certData.getKeySize() : cs.getString("keys.ecc.curve.default");
cs.putString("preop.cert." + tag + ".curvename.name", curvename);
ConfigurationUtils.createECCKeyPair(token, curvename, cs, tag);

Expand Down

0 comments on commit ae350a3

Please sign in to comment.