Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix createUserNotice parameter order #4897

Merged
merged 1 commit into from
Nov 7, 2024

Conversation

jmisset-cb
Copy link
Contributor

PR Description

The usernotice certificate policy qualifier can contain an organizationname, noticenumbers and explicittext field. The explicittext and noticenumbers fields are not handled correctly, causing the error "wrong notice numbers" when submitting a CSR on a certificate profile that contains a value in explicittext.

The createUserNotice() function is defined in:
https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/profile/def/CertificatePoliciesExtDefault.java#L770
with parameters orgName, noticeNums, noticeText
and called in:
https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/profile/def/CertificatePoliciesExtDefault.java#L345
and
https://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/profile/def/CertificatePoliciesExtDefault.java#L705
with parameters orgName, noticeText, noticeNums.

This PR fixes the order of parameters so that noticeText and noticeNums no longer get inverted.

Test procedure

Create a certificate profile containing the following certificate policy:

policyset.userCertSet.<i>.constraint.class_id=noConstraintImpl
policyset.userCertSet.<i>.constraint.name=No Constraint
policyset.userCertSet.<i>.default.class_id=certificatePoliciesExtDefaultImpl
policyset.userCertSet.<i>.default.name=Certificate Policies Extension Default
policyset.userCertSet.<i>.default.params.Critical=false
policyset.userCertSet.<i>.default.params.PoliciesExt.num=1
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.enable=true
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.policyId=2.16.528.1.1003.1.2.44.14.11.5
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.PolicyQualifiers.num=2
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.PolicyQualifiers0.CPSURI.enable=true
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.PolicyQualifiers0.CPSURI.value=https://example.com/cps.pdf
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.PolicyQualifiers1.usernotice.enable=true
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.PolicyQualifiers1.usernotice.explicitText.value=This is the usernotice explicittext field.
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.PolicyQualifiers1.usernotice.noticeReference.noticeNumbers=
policyset.userCertSet.<i>.default.params.PoliciesExt.certPolicy0.PolicyQualifiers1.usernotice.noticeReference.organization=

Submit a certificate request via the EE portal, and accept the certificate request via the agent portal.
The certificate should contain:

                Identifier: Certificate Policies: - 2.5.29.32
                    Critical: no 
                    Certificate Policies: 
                        Policy Identifier: 2.16.528.1.1003.1.2.44.14.11.5
                            Policy Qualifier Identifier: CPS Pointer Qualifier - 1.3.6.1.5.5.7.2.1
                            Policy Qualifier Data: https://example.com/cps.pdf
                            Policy Qualifier Identifier: CPS User Notice Qualifier - 1.3.6.1.5.5.7.2.2
                            Policy Qualifier Data: 
                                Explicit Text: VisibleString: This is the usernotice explicittext field.

The usernotice certificate policy extensions qualifier can contain an
organizationname, noticenumbers and explicittext field. The explicittext
and noticenumbers fields are not handled correctly, causing the error
"wrong notice numbers" when submitting a CSR on a certificate profile
that contains a value in explicittext.
Copy link

sonarcloud bot commented Nov 7, 2024

Copy link
Contributor

@edewata edewata left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks!

@edewata edewata merged commit 62d2052 into dogtagpki:master Nov 7, 2024
159 of 168 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants