pkispawn ocsp misleading error messages

[pki-bot]

This issue was migrated from Pagure Issue #2539. Originally filed by aakkiang (@aakkiang) on 2016-11-10 19:49:49:

• Assigned to nobody

---

Pki ocsp server generates following error messages in debug log when 2 step
installation is followed for FIPS mode.

Steps to Reproduce:

1.Install CA subsystem in FIPS mode using Thales hsm.
2 Install ocsp following the 2 step install process using Thales hsm.
3. pkispwn reports success for both installation steps.
4. # certutil -L -d /var/lib/pki/pki-rootOCSP-aakkiang/alias/

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Directory Server CA certificate                              CT,C,C
auditSigningCert cert-pki-rootOCSP-aakkiang OCSP             ,,P

# certutil -L -d /var/lib/pki/pki-rootOCSP-aakkiang/alias/ -h NHSM6000-OCS |
grep pki-rootOCSP-aakkiang
Enter Password or Pin for "NHSM6000-OCS":
NHSM6000-OCS:ocspSigningCert cert-pki-rootOCSP-aakkiang OCSP u,u,u
NHSM6000-OCS:Server-Cert cert-pki-rootOCSP-aakkiang          u,u,u
NHSM6000-OCS:subsystemCert cert-pki-rootOCSP-aakkiang        u,u,u
NHSM6000-OCS:auditSigningCert cert-pki-rootOCSP-aakkiang OCSP u,u,Pu

Actual results:

pkidaemon status for ocsp process is shown like this (notice <ocsp request
blob>):
Status for pki-rootOCSP-aakkiang: pki-rootOCSP-aakkiang is running ..

    [OCSP Status Definitions]
    Unsecure URL        =
http://csqa1.idm.lab.eng.rdu.redhat.com:32044/ocsp/ee/ocsp/<ocsp request blob>
    Secure Agent URL    =
https://csqa1.idm.lab.eng.rdu.redhat.com:32042/ocsp/agent/ocsp
    Secure EE URL       =
https://csqa1.idm.lab.eng.rdu.redhat.com:32042/ocsp/ee/ocsp/<ocsp request blob>
    Secure Admin URL    =
https://csqa1.idm.lab.eng.rdu.redhat.com:32042/ocsp/services
    PKI Console Command = pkiconsole
https://csqa1.idm.lab.eng.rdu.redhat.com:32042/ocsp
    Tomcat Port         = 32005 (for shutdown)

    [OCSP Configuration Definitions]
    PKI Instance Name:   pki-rootOCSP-aakkiang

    PKI Subsystem Type:  OCSP

    Registered PKI Security Domain Information:
    ==========================================================================
    Name:  Example-Test-aakkiang
    URL:   https://csqa1.idm.lab.eng.rdu.redhat.com:18443
    ==========================================================================


Debug log shows these messages:
CMSEngine: about to look for cert for auto-shutdown support:auditSigningCert
cert-pki-rootOCSP-aakkiang
CMSEngine: cert not found:auditSigningCert cert-pki-rootOCSP-aakkiang

Expected results:

auditSigningCert should be detected.

[pki-bot]

Comment from mharmsen (@mharmsen) at 2016-11-11 02:02:41

Per PKI Bug Council of 11/10/2016: 10.4 - major

[pki-bot]

Comment from aakkiang (@aakkiang) at 2017-02-27 14:01:55

Metadata Update from @aakkiang:

• Issue set to the milestone: UNTRIAGED

[pki-bot]

Comment from mharmsen (@mharmsen) at 2017-03-03 14:28:42

Metadata Update from @mharmsen:

• Custom field feature adjusted to ''
• Custom field proposedmilestone adjusted to ''
• Custom field proposedpriority adjusted to ''
• Custom field reviewer adjusted to ''
• Custom field version adjusted to ''
• Issue close_status updated to: None
• Issue set to the milestone: 10.4 (was: UNTRIAGED)

[pki-bot]

Comment from mharmsen (@mharmsen) at 2017-08-09 12:39:28

Per CS/DS Meeting of August 7, 2017, it was determined to move this issue from 10.4 ==> FUTURE.

[pki-bot]

Comment from mharmsen (@mharmsen) at 2017-08-09 12:39:29

Metadata Update from @mharmsen:

• Issue set to the milestone: FUTURE (was: 10.4)

[pki-bot]

Comment from mharmsen (@mharmsen) at 2017-08-31 01:34:59

Metadata Update from @mharmsen:

• Issue priority set to: minor (was: major)

[pki-bot]

Comment from mharmsen (@mharmsen) at 2018-04-26 20:55:11

Per 10.5.x/10.6 Triage: FUTURE

RHBZ: CLOSED UPSTREAM

alee: debug log cleanup

[pki-bot]

Comment from mharmsen (@mharmsen) at 2018-04-26 20:55:26

Metadata Update from @mharmsen:

• Custom field rhbz reset (from https://bugzilla.redhat.com/show_bug.cgi?id=1392636)