Unable to install subordinate CA with HSM in FIPS mode

[pki-bot]

This issue was migrated from Pagure Issue #2543. Originally filed by edewata (@edewata) on 2016-11-15 02:05:18:

• Closed as Fixed
• Assigned to edewata (@edewata)
• Associated bugzillas
  • https://bugzilla.redhat.com/show_bug.cgi?id=1395817

---

Installing CA with externally-signed CA certificate (i.e. subordinate CA) with HSM in FIPS mode failed due to the following NSS issue:
https://bugzilla.redhat.com/show_bug.cgi?id=1393668

The installer needs to be modified to use the two-step workaround described in the above bug.

[pki-bot]

Comment from edewata (@edewata) at 2016-11-15 23:58:23

attachment
pki-edewata-0866-Fixed-problem-installing-subordinate-CA-with-HSM-in-.patch

[pki-bot]

Comment from edewata (@edewata) at 2016-11-16 06:59:48

Fixed in master:

• 0bef3bb

[pki-bot]

Comment from edewata (@edewata) at 2016-11-16 07:03:03

attachment
pki-edewata-0867-Fixed-hanging-subordinate-CA-with-HSM-installation-i.patch

[pki-bot]

Comment from edewata (@edewata) at 2016-11-16 18:39:17

See also https://bugzilla.redhat.com/show_bug.cgi?id=1395509.

[pki-bot]

Comment from edewata (@edewata) at 2016-11-16 19:18:00

Additional changes in master:

• 65013d2

[pki-bot]

Comment from edewata (@edewata) at 2016-11-16 19:41:16

The proper fix for the CLI will be implemented in ticket 1352.

[pki-bot]

Comment from mharmsen (@mharmsen) at 2016-11-16 20:26:08

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1395817

[pki-bot]

Comment from mharmsen (@mharmsen) at 2016-12-13 02:59:59

Replying to [comment:1 edewata]:

Fixed in master:

• 0bef3bb

Cherry-picked into DOGTAG_10_3_BRANCH:

• b058ded

Additional changes in master:

• 65013d2

Cherry-picked into DOGTAG_10_3_BRANCH:

• c8553a5

[pki-bot]

Comment from edewata (@edewata) at 2017-02-27 14:11:14

Metadata Update from @edewata:

• Issue assigned to edewata
• Issue set to the milestone: 10.3.9