Config wizard: adminpanel fails at nsIDOMCrypto.generateCRMFRequest when CS instance name (hence the DN) is long

[pki-bot]

This issue was migrated from Pagure Issue #639. Originally filed by awnuk (@awnuk) on 2013-05-31 23:48:08:

• Assigned to nobody

---

https://bugzilla.redhat.com/show_bug.cgi?id=807073 - Config wizard: adminpanel fails at nsIDOMCrypto.generateCRMFRequest when CS instance name (hence the DN) is long
[[BR]]
[[BR]]

807073: Description

When installing with a CA instance with a long name such as
"pki-ca-nethsm-nss-ecc-fips1E1SELinux03262012a"
the config wizard fails with the following error in the Firefox Error Console at the adminpanel:

Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIDOMCrypto.generateCRMFRequest]" nsresult: "0x80004005 (NS_ERROR_FAILURE)" location: "JS frame :: https://:9965/ca/admin/console/config/wizard :: performPanel :: line 211" data: no]

Workaround is to have a shorter name.
We should at least release note this.
I don't have time to find out exactly how long is too long.
[[BR]]
[[BR]]

807073: Comment 2

For future reference, I printed out the DN that suspected of causing generateCRMFRequest() to break:

dn=cn=CA Administrator of Instance pki-ca-nethsm-nss-ecc-fips1E1SELinux03262012a1,uid=admin,e=xxx@redhat.com,o=DsdevSjcRedhat Domain 1

[[BR]]
[[BR]]

807073: Comment 7

I found the cause.

RFC 3280 defines an upper bound of 64 bytes for the CN attribute.

http://tools.ietf.org/html/rfc3280#appendix-A.1
-- Upper Bounds
ub-common-name INTEGER ::= 64

http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/certdb/alg1485.c58

Resolving as not-a-bug.
[[BR]]
[[BR]]

807073: Comment 8

Re-opening against Certificate System. We should perform some upper bounds checking before calling generateCRMF().

[pki-bot]

Comment from awnuk (@awnuk) at 2017-02-27 14:00:39

Metadata Update from @awnuk:

• Issue set to the milestone: UNTRIAGED