freeipa

#7761 External CA renewal accepts issuer key < 2048-bit
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

Issue

External CA renewal, when changing from self-signed to externally-signed, accepts
a certificate chain where the issuer certificate has a < 2048-bit key. The certificate
is accepted and imported, but this leads to failure to initialise Dogtag because NSS
refuses to validate the CA certificate.

Steps to Reproduce

  1. Use ipa-cacert-manage to switch from self-signed to external CA.
  2. Sign with a 1024-bit CA. Complete the renewal.
  3. Observe: renewal completes, but Dogtag subsequently fails to start.

Expected behavior

Cert chain with 1024-bit CAs should be rejected.

Additional info:

This check should also be carried out in initial CA installation, if it is not already.

Related to that, do we need a check for SHA-1 signatures, too?

I'll check... the certutil -V check should catch issues like this, but it is not catching the
1024-bit keys so there might be more checks needed.

PR: https://github.com/freeipa/freeipa/pull/2554

master:

  • a2a293ed2f40e3688634fc53dccb8d682fd2ab22 Print correct subject on CA cert verification failure
  • 61e1d7a83bc357751c5eb081f537194565bc7e65 certdb: validate certificate signatures

ipa-4-7:

  • b8a1ca0eeabbb236167a3121f7e2db9783364a87 Print correct subject on CA cert verification failure
  • 1c7e179c3e64a4f761b239490b16ddbafe4e7f2b certdb: validate certificate signatures

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-7:

  • c2ae6380b3f6b3804ebd2a7dd2b159b779eb756c certdb: validate server cert signature

master:

  • 13917ddc55ee0d40130cfb37173dd368642d46a9 certdb: validate server cert signature

master:

  • f9b22283dd2160ec073e93df9b52ef6b47d6c335 add test for external CA key size sanity check

ipa-4-7:

  • c34819c277c28d622c6a3427701eca74f048686e add test for external CA key size sanity check
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.