Adding profile using pki ca-profile-add reports PKIException

[pki-bot]

This issue was migrated from Pagure Issue #1035. Originally filed by mrniranjan (@mrniranjan) on 2014-06-17 15:12:41:

• Closed as Fixed
• Assigned to ftweedal (@frasertweedale)

---

When adding a new profile using pki ca-profile-add , it report PKIException error. Profile gets added but it reports PKIException error

1. Get xml of caCACert profile

pki -d /opt/rhqa_pki/certs_db/ -n CA_agentV -c redhat123 ca-profile-show caCACert --output /tmp/caCAcert1.out

2. Edit /tmp/caCAcert1.out and changed the below lines:

-<Profile xmlns:ns2="http://www.w3.org/2005/Atom" id="caCACert">
+<Profile xmlns:ns2="http://www.w3.org/2005/Atom" id="caCACertTemp1">
-<link href="https://dhcp207-176.lab.eng.pnq.redhat.com:8443/ca/rest/profiles
/caCACert" rel="self"/>
+<link href="https://dhcp207-176.lab.eng.pnq.redhat.com:8443/ca/rest/profiles/caCACertTemp1" rel="self"/>

3. Add the profile to CA

[root@dhcp207-176 setup]# pki -d /opt/rhqa_pki/certs_db/ -n CA_adminV -c redhat123 ca-profile-add /tmp/caCAcert1.out
PKIException: Error changing profile data

4. Show the profile

[root@dhcp207-176 setup]# pki -d /opt/rhqa_pki/certs_db/ -n CA_adminV -c redhat123 ca-profile-show caCACertTemp1
-----------------------
Profile "caCACertTemp1"
-----------------------
  Profile ID: caCACertTemp1
  Name: Manual Certificate Manager Signing Certificate Enrollment
  Description: This certificate profile is for enrolling Certificate Authority certificates.

  Input ID: i1
  Name: Certificate Request Input
  Class: certReqInputImpl

    Attribute Name: cert_request_type
    Attribute Description: Certificate Request Type
    Attribute Syntax: cert_request_type

    Attribute Name: cert_request
    Attribute Description: Certificate Request
    Attribute Syntax: cert_request

  Input ID: i2
  Name: Requestor Information
  Class: submitterInfoInputImpl

    Attribute Name: requestor_name
    Attribute Description: Requestor Name
    Attribute Syntax: string

    Attribute Name: requestor_email
    Attribute Description: Requestor Email
    Attribute Syntax: string

    Attribute Name: requestor_phone
    Attribute Description: Requestor Phone
    Attribute Syntax: string

  Output ID: o1
  Name: Certificate Output
  Class: certOutputImpl

    Attribute Name: pretty_cert
    Attribute Description: Certificate Pretty Print
    Attribute Syntax: pretty_print

    Attribute Name: b64_cert
    Attribute Description: Certificate Base-64 Encoded
    Attribute Syntax: pretty_print

[pki-bot]

Comment from mharmsen (@mharmsen) at 2014-07-17 23:24:48

Per email discussions, propose Milestone 10.2.1.

[pki-bot]

Comment from mharmsen (@mharmsen) at 2014-09-18 04:34:54

Proposed Milestone: 10.2.1 (per CS Meeting of 09/17/2014)

[pki-bot]

Comment from mharmsen (@mharmsen) at 2014-09-24 20:41:40

Per Dogtag 10.2.3 Triage meeting of 09/24/2014 - proposed Milestone: 10.2.2

NOTE: It is fine to address this issue earlier (in 10.2.1) if enough cycles exist.

[pki-bot]

Comment from ftweedal (@frasertweedale) at 2014-09-25 08:09:47

proposed fix
pki-frasertweedale-0016-Fix-BasicConstraints-min-max-path-length-check.patch

[pki-bot]

Comment from ftweedal (@frasertweedale) at 2014-11-26 05:47:46

attachment
pki-frasertweedale-0016-2-Fix-BasicConstraints-min-max-path-length-check.patch

[pki-bot]

Comment from ftweedal (@frasertweedale) at 2014-12-05 03:44:10

attachment
pki-frasertweedale-0016-3-Fix-BasicConstraints-min-max-path-length-check.patch

[pki-bot]

Comment from ftweedal (@frasertweedale) at 2014-12-05 03:50:07

Pushed:

• master: f955714
• DOGTAG_10_2_0_BRANCH: 299ed15

[pki-bot]

Comment from mrniranjan (@mrniranjan) at 2017-02-27 14:09:02

Metadata Update from @mrniranjan:

• Issue assigned to frasertweedale
• Issue set to the milestone: 10.2.2