RHBA-2015:1022 - Bug Fix Advisory

Topic

Red Hat Certificate System 8.1 Advanced Access is now available.

This update to Red Hat Certificate System fixes bugs and is meant as an errata which is applied on top of Red Hat Certificate System 8.1.5.

Description

Red Hat Certificate System is a complete implementation of an enterprise software system designed to manage enterprise public key infrastructure (PKI) deployments.

Bug fixes:

• In some cases, when a CRL was published to LDAP, the LDAP server failed to return any response. Consequently, the CA subsystem became unresponsive, preventing subsequent CRL publishing until after a restart. This update adds an LDAP timeout for publishing events. If no response is returned within the timeout window, the operation is aborted and no longer blocks the next CRL generation attempt. (BZ#1134405)
• When a doRevoke() call encountered an error, the error message was not cleared. Consequently, the subsequent successful revocation request returned a false error message. In addition, when coupled with the TPS token termination process, the token database got out of sync, causing revocations from TPS token database to fail. This update ensures the message is cleared after a failure, preventing this bug. (BZ#1150142)
• The PKI SELinux policy covers the Thales HSM software, including context labels for files in default locations. In the latest Thales version, the default install locations changed. Consequently, files in new locations were not labeled and therefore not accessible by Thales processes in enforcing mode. This update provides the missing labels. (BZ#1186037)
• Previously, after recovering a certificate that was revoked, expired, or both, the certificate status was always marked as "active" in the token database. This update ensures the certificate status is always properly checked and marked in the token database. In addition, a flag has been added to set if a revoked certificate is allowed to be recovered or not. (BZ#1200107)

Enhancements:

• This update adds customization to the token termination process in TPS, including the ability to choose which certificates to revoke, select a reason code for a revocation, and ignore an expired certificate. (BZ#1163867)
• With external registration on, the tokenType attribute was forced through the user record set in the directory. This bypassed the tokenType mapping as configured in the TPS CS.cfg file based on the card CUID. This update extends the existing GetTokenType filtering system to allow a single tokenType be mapped to multiple hardware tokens. (BZ#1196839)
• This update provides support for a NIST SP-800 compliant Key Derivation Function (KDF). Note that the tkstool utility is not compatible with the new KDF on HSM. For the Token Key Service be able to generate session keys and to properly upgrade the keyset when the new KDF is used, a utility native to the HSM needs to be used to generate a key of type CKK_SHA256_HMAC instead of using tkstool. (BZ#1186896)
• This update allows the administrator to perform off-card key generation for non-encryption token keys. (BZ#1196844)
• Previously, smart card clients had no way to query the number of remaining failed login attempts before having the token locked. This update adds a variable to the coolkey applet to track incorrect PIN entry attempts. Now, when a client of any kind supplies the proper APDU to the token, the applet will return the number of remaining login attempts. (BZ#1040014)

Note that when the 'External Registration' functionality is used, the versions of the pki-kra and pki-tps packages provided by this erratum must be used together, otherwise the KRA token recovery servlet will not recover the requested key.

Due to important crypto interfaces being removed from Firefox, CS configuration can no longer be performed in GUI with the latest version of Firefox. To work around this issue, downgrade your Firefox to version 31. Afterwards, you can use the latest Firefox version to interface with the server, if the internal crypto object is not used to generate and archive keys.

Users of Red Hat Certificate System are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Certificate System with Advanced Access 8 x86_64
• Red Hat Certificate System with Advanced Access 8 i386

Fixes

CVEs

(none)

References

(none)