freeipa

#9455 WebUI - incorrect behaviour when adding invalid user certificate
Opened by mpolovka. Modified

Open
Close Issue

Issue

In the WebUI, when adding a user certificate in the user tab and invalid certificate is provided, e.g. without x.509 extension, a message "Certificate added to appears", however, no certificate is added.

Furthermore, if a valid certificate is added, and then invalid one, the valid certificate disappears from the certificates list. It can still be found using ipa cert-find <user>.

Steps to Reproduce

  1. Create a new user in the WebUI and open their details
  2. Add new certificate
  3. Provide this valid certificate
    -----BEGIN CERTIFICATE-----
    MIIHUzCCBTugAwIBAgIRAMbkmDZJZqhTAAAAAFZl8D0wDQYJKoZIhvcNAQELBQAw
    RDELMAkGA1UEBhMCSFIxHTAbBgNVBAoTFEZpbmFuY2lqc2thIGFnZW5jaWphMRYw
    FAYDVQQDEw1GaW5hIFJEQyAyMDE1MB4XDTE5MTAxNDEyMTMyMFoXDTIxMTAxNDEy
    MTMyMFowgakxCzAJBgNVBAYTAkhSMRQwEgYDVQQKEwtIT1BTIEQuTy5PLjEWMBQG
    A1UEYRMNSFIxMzE0ODgyMTYzMzEPMA0GA1UEBxMGWkFHUkVCMQ8wDQYDVQQEEwZI
    Uk5KQUsxEjAQBgNVBCoTCUtSVU5PU0xBVjEZMBcGA1UEAxMQS1JVTk9TTEFWIEhS
    TkpBSzEbMBkGA1UEBRMSSFI1NzI4OTI5NDg5NC4yLjIxMIIBIjANBgkqhkiG9w0B
    AQEFAAOCAQ8AMIIBCgKCAQEAig6HRn4uUvbUgFltOqWWo5OLnoWyuc6pAtBdaj+U
    z3TM06ZVJtpnEsPsYPZ3iRLSUWz4ymkc+uv9YeWSbpOo0ft6UQ4HYN155DchpSgX
    ycwgiJXMCyic61RcX05xNXfdnm4gJOeh8E46P3IEb2wKEj5rYe5Uk/ZJ59cPNu1e
    4rPKMTUH835awkyRCh1jWCXzWDowp8dl7kzroaotwRrJdxeL0taopyc9abUUm6kG
    fTkdUbBw9uvFKq/uDJl+6IjmW2cMu8ZSPSctBDVEbySWk6yHW0ZXs+xvD+NYgBZT
    8Mqzc8LFhHT3ERYjf2JfZuWwQ9ODAfQOZr5nS5Me3hGWRwIDAQABo4IC2DCCAtQw
    DgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjCB
    sAYDVR0gBIGoMIGlMIGYBgkrfIhQBQwMBAIwgYowQwYIKwYBBQUHAgEWN2h0dHA6
    Ly9yZGMuZmluYS5oci9SREMyMDE1L0ZpbmFSREMyMDE1LUNQU05RQzEtMy1oci5w
    ZGYwQwYIKwYBBQUHAgEWN2h0dHA6Ly9yZGMuZmluYS5oci9SREMyMDE1L0ZpbmFS
    REMyMDE1LUNQU05RQzEtMy1lbi5wZGYwCAYGBACPegECMGkGCCsGAQUFBwEBBF0w
    WzAfBggrBgEFBQcwAYYTaHR0cDovL29jc3AuZmluYS5ocjA4BggrBgEFBQcwAoYs
    aHR0cDovL3JkYy5maW5hLmhyL1JEQzIwMTUvRmluYVJEQ0NBMjAxNS5jZXIwIwYD
    VR0RBBwwGoEYa3J1bm9zbGF2Lmhybmpha0Bob3BzLmhyMIIBEwYDVR0fBIIBCjCC
    AQYwgaSggaGggZ6GLGh0dHA6Ly9yZGMuZmluYS5oci9SREMyMDE1L0ZpbmFSREND
    QTIwMTUuY3Jshm5sZGFwOi8vcmRjLWxkYXAyLmZpbmEuaHIvY249RmluYSUyMFJE
    QyUyMDIwMTUsbz1GaW5hbmNpanNrYSUyMGFnZW5jaWphLGM9SFI/Y2VydGlmaWNh
    dGVSZXZvY2F0aW9uTGlzdCUzQmJpbmFyeTBdoFugWaRXMFUxCzAJBgNVBAYTAkhS
    MR0wGwYDVQQKExRGaW5hbmNpanNrYSBhZ2VuY2lqYTEWMBQGA1UEAxMNRmluYSBS
    REMgMjAxNTEPMA0GA1UEAxMGQ1JMNzUxMB8GA1UdIwQYMBaAFBRjEbt7MwNodBwV
    7eYswTxIG5ghMB0GA1UdDgQWBBTsd+TYygvZpCDO4kDpEnMKUkZOfTAJBgNVHRME
    AjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBIhFElngJOz+K+Q1FZLhEVLngMI92k858M
    W6WHJ17SXhiR/m/ESOM5mVkOyiOQoM1po1I/jdUjE2mHHjiT12tJgkavkDxXz6aX
    hKdj9VDVnzSp0wRvzIgQKWJF0JO82umt0I9x265cGXmRnRjxnDbEmgGKdFeSTbkp
    gJfk73rdRbkIEI7FoOIzuaIRcHRIREkfUltu/1zD+bCMSY2pFA/0FQ15dFUDAeiD
    6gqyjZgJJC5Rqd6SuMLfF4aAmz7FBgpk7iVm5jGRPltHCK3aH7OEczsDi1fYVtRA
    PdRvKlzqbajv6Qj0YICMg3byh3ObN5xZp4qQmxGu9w7sJioMRP7DxxMuQKx4byV2
    O0Jo7cdnc6BXfR+EipXz/phExWvRKwSOaelweOZUjz9sffpNYmvfuqmGhL5axNtj
    XQmAJ1wOo8m7j4Czz7m7WFtxdiZ0SYGBxnr0xpCJrHgxLU640a/T/vDPh/SSai5S
    E4unGGIf6vT0+5KY2gU6Jly7pqKpc44FHFrOdhWTEZzbmaiGL2QMh8VE2bAV9dNp
    YT7djK+WY554vVLE3N7M21qiCNxD5awuIEkpZoF1d7A/wMgAe40ZMZ6UbYawzAPf
    Tca3LXBLJOR4Ox2ZEbFt/JlIe7pZqR67s628axLaKCdQhOLP77KsNPMahzjQ7JmR
    znZSOnBy/Q==
    -----END CERTIFICATE-----

Note: Certificate serial and basic info should now be visible.
4. Add a new certificate again, this time invalid

-----BEGIN CERTIFICATE-----
MIICoDCCAYigAwIBAgIFAMDHr5QwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UEAwwH
VGVzdF9DQTAeFw0yMzA5MjYwNjUwMTRaFw0yMzEyMjYwNjUwMTRaMBExDzANBgNV
BAMTBmZlZG9yYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMRCIyPo
du39rGuYEK/ohNPnEIsKLJL4AC3uLkTtunglKA1X/m6ZoUe95MRjWNhrQF2ltheV
qjjQEfsCUSs2w6sPiZZHhxVMeujbnIaANqQlA4ZgabD4M0P3PVUql9qXGV5pwL01
+oa4B63eK3b1AcO+eOcRkMFTe9j1PwwSiuIQhx/6WrCuTuv0C4C4cuUlsl7LUDPK
Bj0Ho1LN6j8j0GKP/tySefsBa/Crit0KwMwR1Ocyc+aDV9rmgKPrm7FKEDBYisyB
yRvwVQ3B0TCHQckQfZGnUYiim3/rBtE88zA6hKSOGtQMwh4iLeQVLzKn4IAKwKp1
Zeok2XHKFiE+AYUCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAoECPj1hQvinXW2Ki
1QQJyFyiqXOw3HYxEgy7Y7Ufb55HUTk+4m+G6uzGgMU133HTJ0PtO4mPg/B7816R
oXLUqukCE+wSQqVuPe5erx6NY5LwW9eeX9RkWgxjFVA4qsEyhrWS6Hn/L120DPUo
MfEwFRlyrWIhRmCCpC0EecxIw54UrQYy3Mwj24s9Jyely1T56EDWEg9xLBvxdKyB
Xp/47w7HZhbwSzZdoBcV2H75sSMQt3t3rvnHTNeZIQt93Heyn+XJz2iAPCmMUFAV
gn+lWIIuqU/4oK0/lALE/z/Osw5yr/sNX+TZ30RPOlAe+hRlwtM5w7Y2bKeWoQx6
1ruu4w==

No error is printed, but the valid certificate info disappears.

Actual behavior

No error is printed despite the cert being rejected, whole cert module stops working as expected

Expected behavior

Invalid cert should be rejected and the valid one should stay rendered

Version/Release/Distribution

At least 4.10.1

Additional info:

This issue is also reproducible in the demo page https://ipa.demo1.freeipa.org/ipa/ui/#

Note:

Since we are developing newUI, I reckon this issue has low priority.

Additional note:
This is an output of ipa cert-find when invalid cert was provided.

{
     "error": "an internal error has occurred",
     "error_code": 903,
     "error_kw": {},
     "error_name": "InternalError"
}

You can generate the (valid) certificate using freeipa documentation. In case you want to invalidate it, omit x509 parameter

What makes this bad: the certificate is missing extensions.
Metadata
None

webui

None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.