rhcs81 caManualRenewal with original profile modified for empty params.name creates root CA subject DN

[pki-bot]

This issue was migrated from Pagure Issue #822. Originally filed by nkinder (@nkinder) on 2014-01-13 19:48:13:

• Closed as Fixed
• Assigned to cfu (@cfu)
• Associated bugzillas
  • https://bugzilla.redhat.com/show_bug.cgi?id=1029757

---

rhcs81 caManualRenewal with original profile modified for empty params.name
creates root CA subject DN

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 5.9 (Tikanga)
redhat-ds-base-8.2.11-5.el5dsrv
pki-ca-8.1.5-1.el5pki

How reproducible:
always

Steps to Reproduce:
1.have user directory
2.have CA
3.duplicate profile caDirUserCert
4. modify subjectNameConstraintImpl to add a params:

policyset.set1.1.constraint.class_id=subjectNameConstraintImpl
policyset.set1.1.constraint.name=Subject Name Constraint
policyset.set1.1.constraint.params.pattern=.*
policyset.set1.1.default.class_id=subjectNameDefaultImpl
policyset.set1.1.default.name=Subject Name Default
policyset.set1.1.default.params.name=$request.auth_token.tokenCertSubject$

5. enroll
6. stop CA and modify the custom profile to remove the variable
   policyset.set1.1.default.params.name=
   start CA
7. try to renew
   http://ca1.example.com:9180/ca/ee/ca/profileSelect?profileId=caManualRenewal

Actual results:
a certificate is issued
but the subject DN is unexpected, it is the root CA (!)

[pki-bot]

Comment from mharmsen (@mharmsen) at 2014-09-18 03:03:54

Proposed Milestone: 10.2.3 (per CS Meeting of 09/17/2014)

[pki-bot]

Comment from mharmsen (@mharmsen) at 2015-01-15 01:07:59

Per Dogtag 10.2.X meeting of 01/14/2015: Milestone 10.2.2

[pki-bot]

Comment from cfu (@cfu) at 2015-02-12 22:19:10

pushed to master
commit 98b2407

[pki-bot]

Comment from nkinder (@nkinder) at 2017-02-27 14:09:04

Metadata Update from @nkinder:

• Issue assigned to cfu
• Issue set to the milestone: 10.2.2