Chapter 3. Red Hat Certificate System 10.3 on Red Hat Enterprise Linux 8.5
This section describes significant changes in Red Hat Certificate System 10.3 on RHEL 8.5, such as highlighted updates and new features, important bug fixes, and current known issues users should be aware of.
Downgrading Red Hat Certificate System to a previous minor version is not supported.
3.1. Updates and new features in CS 10.3
This section documents new features and important updates in Red Hat Certificate System 10.3:
Updates and new features in the pki-core package:
Certificate System packages rebased to version 10.12.4
The pki-core, redhat-pki, redhat-pki-theme, and pki-console packages have been upgraded to upstream version 10.12.4, which provides a number of bug fixes and enhancements over the previous version.
3.2. Technology Previews
ACME support in RHCS available as Technology Preview
Server certificate issuance via an Automated Certificate Management Environment (ACME) responder is available for Red Hat Certificate System (RHCS). The ACME responder supports the ACME v2 protocol (RFC 8555).
Previously, users had to use the Certificate Authority (CA)'s proprietary certificate signing request (CSR) submission routines. The routines sometimes required certificate authority (CA) agents to manually review the requests and issue the certificates.
The RHCS ACME responder now provides a standard mechanism for automatic server certificate issuance and life cycle management without involving CA agents. The feature allows the RHCS CA to integrate with existing certificate issuance infrastructure to target public CAs for deployment and internal CAs for development.
Note that this Technology Preview only includes an ACME server support. No ACME client is shipped as part of this release. Additionally, this ACME preview does not retain issuance data or handle user registration.
Be aware that future Red Hat Enterprise Linux updates can potentially break ACME installations.
For more information, see the IETF definition of ACME.
Note that this feature is offered as a technology preview, provides early access to upcoming product functionality, and is not yet fully supported under subscription agreements.
3.3. Bug fixes in CS 10.3
This part describes bugs fixed in Red Hat Certificate System 10.3 that have a significant impact on users.
Bug fixes in the pki-core package:
Completing a secure channel with certain SCP03 and SCP01 tokens no longer fails due to pcsc-lite, pcsc-lite-ccid, and esc
As of the release of Red Hat Certificate System 10.2, an issue with pcsc-lite, pcsc-lite-ccid, and esc packages led to failures to complete a secure channel with certain SCP03 and SCP01 tokens. This has been fixed by a subsequent batch update.
SubCA two-step installation no longer fails while validating the SubCA signing certificate
Previously, installing a SubCA using the two-step method failed in an HSM environment with FIPS enabled: with either of the RSA or ECC options, attempting to validate the SubCA signing certificate returned an error. This fix changes the pki cli command from nss-import-cert to client-import-cert and --cert `to `--ca-cert. As a result, the CA signing cert is imported properly into the nssdb with trust. In addition, if pkispawn fails the pki-server subsystem-cert-validate call, this patch allows to provide more details on the failure while allowing pkispawn to complete. This would allow admins to manually add the CA signing certificate, although the aforementioned fix should now prevent the issue from happening.
3.4. Known issues in CS 10.3
This part describes known problems users should be aware of in Red Hat Certificate System 10.3, and, if applicable, workarounds.
TPS requires adding anonymous bind ACI access
In previous versions, the anonymous bind ACI was allowed by default, but it is now disabled in LDAP. Consequently, this prevents enrolling or formatting TPS smart cards.
To work around this problem until a fix, you need to add the anonymous bind ACI in Directory Server manually:
$ ldapmodify -D "cn=Directory Manager" -W -x -p 3389 -h hostname -x <<EOF
dn: dc=example,dc=org
changetype: modify
add: aci
aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";)
EOFTokens are not visible on the TPS Web UI
When formatting and enrolling a token via the tpsclient tool or adding a token via the Web UI, none of the tokens are visible on the TPS Web UI, although debug logs show the entries getting recorded successfully.
To work around this issue until a fix, you can list the tokens using the tps-token-find command, for example:
# pki -d /opt/pki/certdb/ -c SECret.123 -p 25443 -n 'PKI TPS Administrator for Example.Org' tps-token-findKnown issues in the pki-core package:
Cloning KRA with HSM fails due to missing attribute in auditSigningCert
When cloning a KRA with HSM, the auditSigningCert trust attribute u,u,Pu should get synced implicitly in the alias DB between the master and the clone. However, it now fails to replicate in the clone’s alias DB. As a consequence, cloning a KRA with HSM fails with the error auditSigningCert cert-topology-02-KRA KRA is invalid: Invalid certificate: (-8101) Certificate type not approved for application.
To work around this problem, you must add the u,u,Pu trust attribute for auditSigningCert explicitly in the alias DB of the clone KRA and restart the instance. For example:
Before the workaround:
# certutil -vv -V -d /var/lib/pki/clone-KRA/alias/ -h nfast -n 'token:auditSigningCert cert-topology-02-KRA KRA' -u J Enter Password or Pin for "token": certutil: certificate is invalid: Certificate type not approved for application.After the workaround:
# certutil -M -d /var/lib/pki/clone-KRA/alias/ -n 'token:auditSigningCert cert-topology-02-KRA KRA' -t u,u,Pu # certutil -vv -V -d /var/lib/pki/clone-KRA/alias/ -h nfast -n 'token:auditSigningCert cert-topology-02-KRA KRA' -u J Enter Password or Pin for "token": certutil: certificate is valid
Using the cert-fix utility with the --agent-uid pkidbuser option breaks Certificate System
Using the cert-fix utility with the --agent-uid pkidbuser option corrupts the LDAP configuration of Certificate System. As a consequence, Certificate System might become unstable and manual steps are required to recover the system.
