RHBA-2015:0437 - Bug Fix Advisory

Topic

Updated certmonger packages that fix several bugs and add two enhancements are
now available for Red Hat Enterprise Linux 7.

Description

The certmonger service monitors certificates, warns of their impending
expiration, and optionally attempts to renew certificates by enrolling the
system with a certificate authority (CA).

This update fixes the following bugs:

• When SELinux permissions on the directory where private key or certificate are

requested to be stored are insufficiently set, the "ipa-getcert request -k"
command fails. Previously, an incorrect error message stating that the location
was not a valid directory was displayed in the described situation. With this
update, the error message correctly informs the user about the insufficient
permissions. (BZ#996581)

• The certmonger packages incorrectly attempted to use the systemd-sysv-convert

utility during upgrades, even though systemd-sysv-convert was not part of the
system-sysv packages in Red Hat Enterprise Linux. With this update, certmonger
no longer attempts to run systemd-sysv-convert during upgrades. (BZ#1104138)

In addition, this update adds the following enhancements:

• Previously, the certmonger service could be used to obtain and store the

certificate of a service in a specified location, but it did not do the same for
the certificate of the issuer. With this update, certmonger can be instructed to
store both the issued certificate and the issuer's certificate in the designated
location when requesting a certificate. Note that this enhancement only applies
to Red Hat Identity Management servers and does not work for other types of CAs.
(BZ#767700)

• Previously, the root CA was not supposed to issue self-signed certificates

beyond the expiration date of the root CA itself. As a consequence, renewing a
CA certificate using the caCACert profile could not result in extending the
validity period of the certificate because the renewed certificate expiration
date was the same as the expiration date of the old certificate. With this
update, the renewed CA certificate expiration date is allowed to extend past the
expiration date of the CA itself. Note that this update relates to the Red Hat
Identity Management (IdM) feature that introduces support for renewing the
certificate of the Dogtag Certificate System (DCS), which is the IdM CA.
(BZ#1165155)

Users of certmonger are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 767700 - [RFE] add option to have certmonger add IPA CA cert to NSS database
• BZ - 996581 - When getcert cannot create the key or certificate, the error should state permission denied
• BZ - 1104138 - certmonger requires systemd-sysv when it wouldn't need to
• BZ - 1107766 - Rebase certmonger to include the ability to add IPA CA cert to NSS database (and files)
• BZ - 1165155 - Renewing the CA signing certificate does not extend its validity period end
• BZ - 1181022 - pre and post commands do not display in getcert list

CVEs

(none)

References

(none)