Red Hat CERTIFICATE 8.0 RELEASE NOTES Instruction Manual

1
Red Hat Certificate
System 8
Red Hat Certificate System 8.0
with Updates for Errata RHBA 2001:0169
Ella Deon Lackey
Copyright © 2009 Red Hat, Inc.
Copyright © 2009 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative
Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation
of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In
accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you
must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not
to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora,
the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United
States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other
countries.
All other trademarks are the property of their respective owners.
1801 Varsity Drive
Raleigh, NC 27606-2072 USA
Phone: [phone]
Phone: [phone]
Fax: [phone]
PO Box 13588
Research Triangle Park, NC 27709 USA
July 22, 2009, updated on February 11, 2010
1. New Features for Red Hat Certificate System 8.0 ..................................................................... 2
1.1. Certificate Renewal ...................................................................................................... 3
1.2. Improved Subsystem Cloning ........................................................................................ 3
1.3. Stronger SELinux Policies ............................................................................................ 3

Red Hat Certificate System 8.0
2
1.4. Improved UTF8 Support ............................................................................................... 3
1.5. Enhanced Support for Third-Party ECC Modules ............................................................ 3
1.6. Simplified Signed Audit Logging .................................................................................... 4
1.7. New Windows Smart Card Login Profile for Tokens ........................................................ 4
1.8. Enhanced Security Officer Mode and Enterprise Security Client Configuration .................. 4
1.9. Expanded TPS Roles ................................................................................................... 4
1.10. Added IPv6 Support ................................................................................................... 4
1.11. Using HTTP1.1 for Publishing CRLs ............................................................................ 4
1.12. Enhanced Installation Scripts ...................................................................................... 4
2. Important Configuration Changes ............................................................................................. 5
2.1. Default Port Separation ................................................................................................ 5
2.2. Changes in the Security Domain ................................................................................... 5
2.3. Renamed Directory Paths ............................................................................................. 5
2.4. Replacing Policy Framework with Profile Framework ...................................................... 5
2.5. Removing Mac Support for Enterprise Security Client ..................................................... 6
3. Supported Platforms ............................................................................................................... 6
3.1. Server Support ............................................................................................................. 6
3.2. Client Support .............................................................................................................. 7
3.3. Supported Web Browsers ............................................................................................. 7
3.4. Supported Smart Cards ................................................................................................ 8
3.5. Supported HSM ........................................................................................................... 8
4. Installing Red Hat Certificate System Subsystems .................................................................... 8
4.1. Installation Notes .......................................................................................................... 8
4.2. Install the Required JDK ............................................................................................... 9
4.3. Verifying Red Hat Directory Server ................................................................................ 9
4.4. Verifying Apache .......................................................................................................... 9
4.5. Installing mod_nss ...................................................................................................... 10
4.6. Installing through yum ................................................................................................ 10
4.7. Installing from an ISO ................................................................................................. 11
5. Documentation for Certificate System 8.0 ............................................................................... 11
5.1. Documentation Changes in 8.0 ................................................................................... 11
5.2. Documentation with 8.0 .............................................................................................. 12
6. Bugs Fixed in Certificate System 8.0 ...................................................................................... 13
7. Errata Releases for Certificate System 8.0 ............................................................................. 16
8. Known Issues ....................................................................................................................... 19
8.1. Reconfiguring the Red Hat Certificate System Subsystems to Prevent a Potential TLS-
Related Man-in-the-Middle Attack ....................................................................................... 19
8.2. List of Known Issues in Red Hat Certificate System 8.0 ................................................ 23
9. Copyright and Third-Party Acknowledgments ......................................................................... 29
9.1. Copyrights for Portions of the Server ........................................................................... 30
9.2. Copyrights for Certificate System Clients ..................................................................... 31
These release notes contain important information related to Red Hat Certificate System 8.0 that may
not be currently available in the Product Manuals. New features, system requirements, installation
notes, known problems, resources, and other current issues are addressed here. You should read
these Release Notes in their entirety before deploying Red Hat Certificate System 8.0.
1. New Features for Red Hat Certificate System 8.0
Red Hat Certificate System 8.0 is a major release of Certificate System, and many new, contemporary
features have been added and existing features have been made more robust and flexible.

Certificate Renewal
3
1.1. Certificate Renewal
Certificate renewal for all Certificate System-issued certificates has been reintroduced using the new
profile framework. There are a number of new profiles to use for renewal, including encryption and
signing certificates for both standard use and on tokens, and server certificate renewal. New inputs
have been added to manage certificate renewal, so corresponding renewal profiles can be created for
custom enrollment profiles.
1.2. Improved Subsystem Cloning
Cloning has been enhanced with distributed numeric assignments logic so that cloned CAs can
efficiently divide and use serial numbers for certificates without becoming blocked because of
inadequate serial number ranges.
1.3. Stronger SELinux Policies
SELinux policies are now required for every subsystem and run in enforcing mode by default,
providing much more protection for Certificate System processes.
1.4. Improved UTF8 Support
The CA, OCSP, and DRM subsystems fully accept and interpret certificate requests generated using
UTF-8 characters, both in the console and in the agent services pages. This support is for specific
fields.
End users can submit certificate requests with UTF-8 characters in those fields and end users and
agents can search for and retrieve certificates and CRLs in the CA and retrieve keys in the DRM when
using those field values as the search parameters.
Four fields fully-support UTF-8 characters:
• Common name (used in the subject name of the certificate)
• Organizational unit (used in the subject name of the certificate)
• Requester name
• Additional notes (comments appended by the agent to the certificate)
NOTE
This support does not include supporting internationalized domain names, like in email
addresses.
1.5. Enhanced Support for Third-Party ECC Modules
Certificate System 8.0, although it does not ship with an ECC module, does support loading and using
third-party ECC PKCS#11 modules with the CA. The console can handle ECC-based SSL sessions,
and the server generates and supports ECC certificates.

Red Hat Certificate System 8.0
4
1.6. Simplified Signed Audit Logging
Audit log signing certificates are now created with all of the other default subsystem certificates as
soon as a CA, DRM, OCSP, TKS, or TPS subsystem is configured. The log is also already configured
and can be very easily enabled. Signed audit logs can be verified by auditors using the included
AuditVerify script.
1.7. New Windows Smart Card Login Profile for Tokens
A new example profile is included with the regular CA profiles list which enabled the CA and TPS to
issue certificates and enroll tokens that can be used to log into Windows systems.
1.8. Enhanced Security Officer Mode and Enterprise Security Client
Configuration
Setting up and using security officer workstation has been improved and additional parameters have
been added to the esc-pref.js configuration file to make configuring the Enterprise Security Client
security officer settings easier and more flexible.
1.9. Expanded TPS Roles
A new role, the operator role has been added to the TPS subsystem. This role can view and search
all tokens, certificates, and activities within the Token Processing System (TPS) but cannot edit any
entries.
Additionally, the administrator role interface has been enhanced to allow administrators to create and
edit users, assign profiles, and delete users directly.
1.10. Added IPv6 Support
The Certificate System 8.0 services can accept requests from all supported browsers, from other
Certificate System subsystems, and from the administrative console over IPv6. The server also
supports using IPv6 addresses in the Subject Alt Names of certificates, with certificate extensions, and
with Certificate System scripts and tools.
1.11. Using HTTP1.1 for Publishing CRLs
HTTP 1.1 has been added as a supported protocol to use to publish CRLs, in addition to publishing
to file and to LDAP. This makes publishing CRLs safer and more efficient, since "chunks" of CRLs
can be published rather the entire CRL. If CRL publishing is ever interrupted, the process can resume
smoothly.
1.12. Enhanced Installation Scripts
Certificate System creates and configures additional instances using the pkicreate script. An
additional script, pkisilent, can be used to create and configure multiple subsystem instances
quickly and without unnecessary user interaction. Both of these scripts have been enhanced and
strengthened for changes to port separation, security domain configuration, and other updates to the
structure of Certificate System subsystems.

Important Configuration Changes
5
2. Important Configuration Changes
There have been some significant changes to the structure and configuration of the Certificate System
8.0 installation, which are not directly related to new features in Certificate System 8.0.
2.1. Default Port Separation
Starting in Certificate System 8.0, there are three SSL ports, one each for each of the user interfaces
(agents, administrators, and end entities). The web application folders are also separated, so each
web service is independent and secure. The pkicreate script has been updated to permit both
separated and non-separated port configurations.
The original RA and TPS standard and SSL ports remain the same, but new SSL ports have been
added for end entities.
NOTE
Port separation was originally introduced in an update to Certificate System 7.3, but the
default for this errata was still to use a single SSL port at installation. In Certificate System
8.0, the default configuration is to have separate ports.
Subsystem Standard End-Entity
SSL
Agent SSL Admin SSL Tomcat
CA 9180 9444 9443 9445 9701
RA 12888 12890 12889 12889
OCSP 11180 11443 11445 11701
DRM 10180 10443 10445 10701
TKS 13180 13443 13445 13701
TPS 7888 7890 7889 7889
Table 1. New Port Assignments for Certificate System 8.0
2.2. Changes in the Security Domain
In previous releases of Certificate System, the security domain was maintained in an XML file for the
CA, domain.xml. In Certificate System 8.0, the security domain configuration has been moved to
LDAP entries within the CA's LDAP entry.
2.3. Renamed Directory Paths
In previous releases of Red Hat Certificate System, the subsystem directories had the term rhpki
in the name, such as /etc/rhpki-tps/CS.cfg and /usr/lib/rhpki/native-tools. All
directories have been renamed pki, such as /etc/pki-tps/CS.cfg.
2.4. Replacing Policy Framework with Profile Framework
The old policy framework for managing certificates was deprecated in Certificate System 7.1 and
was removed entirely for Certificate System 7.2, 7.3, and 8.0. Any certificate enrollments or other
operations must be performed using the new profile framework.

Red Hat Certificate System 8.0
6
2.5. Removing Mac Support for Enterprise Security Client
The Enterprise Security Client was previously supported on Apple Mac, but the smart card client is not
currently supported on Mac for Certificate System 8.0.
3. Supported Platforms
This section covers the different server platforms, hardware, tokens, and software supported by Red
Hat Certificate System 8.0.
3.1. Server Support
The Certificate System subsystems are supported on the following platforms:
• Red Hat Enterprise Linux 5.3 and later for x86
• Red Hat Enterprise Linux 5.3 and later for x86_64
3.1.1. Server Requirements
Component Details
CPU Intel — 2.0 ZZ Pentium 4 or faster
RAM 1 GB (required)
Hard disk storage space Total is approximately 5 GB
• Total transient space required during installation: 1 GB
• Hard disk storage space required for installation:
• Space required to set up, configure, and run the server:
approximately 2 GB
• Additional space for database growth in pilot deployment:
approximately 1 GB
• Total disk storage space for installation: approximately 1
GB
Table 2. Red Hat Enterprise Linux Server Requirements
3.1.2. Red Hat Enterprise Linux Considerations
Before installing the Certificate System packages, ensure that the proper dependencies are installed
on the Red Hat Enterprise Linux system.
The following package groups and packages must be installed on all Red Hat Enterprise Linux
systems:
• gnome-desktop (package group)
• compat-arch-support (package group)
• web-server (package group)
• kernel-smp (package)

Client Support
7
• e2fsprogs (package)
• firefox (package)
On 64-bit Red Hat Enterprise Linux platforms, ensure that the 64-bit (x86_64) compat-libstdc
++ libraries are installed, and not only the 32-bit (i386) libraries. To confirm this, run the following
command as root:
rpm --qi compat-libstdc++ ---queryformat -'%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}.rpm\n' -|
grep x86_64
Numerous libraries should be displayed.
3.2. Client Support
The Enterprise Security Client is supported on the following platforms:
• Microsoft Windows Vista 32-bit
• Microsoft Windows Vista 64-bit
• Microsoft Windows XP 32-bit
• Microsoft Windows XP 64-bit
• Red Hat Enterprise Linux 5.3 x86
• Red Hat Enterprise Linux 5.3 x86_64
IMPORTANT
The Enterprise Security Client was supported on Apple Mac for Red Hat Certificate
System 7.x, but is not supported on Mac for 8.0.
3.3. Supported Web Browsers
The services pages for the subsystems require a web browser that supports SSL. It is strongly
recommended that users such as agents or administrators use Mozilla Firefox to access the agent
services pages. Regular users should use Mozilla Firefox or Microsoft Internet Explorer.
NOTE
The only browser that is fully-supported for the HTML-based instance configuration wizard
is Mozilla Firefox.
Platform Agent Services End User Pages
Red Hat Enterprise Linux Firefox 3.x Firefox 3.x
Windows Vista Firefox 2.x Firefox 2.x
Internet Explorer 7 and higher
Windows XP Firefox 2.x Firefox 2.x
Internet Explorer 6 and higher

Red Hat Certificate System 8.0
8
Platform Agent Services End User Pages
Mac OS 10.x Agent services are not
supported for Mac
Firefox 2.x
Table 3. Supported Web Browsers by Platform
3.4. Supported Smart Cards
The Enterprise Security Client supports Global Platform 2.01-compliant smart cards and JavaCard 2.1
or higher.
The Certificate System subsystems have been tested using the following tokens:
• Gemalto TOP IM FIPS CY2 64K token, both as a smart card and GemPCKey USB form factor key
• Gemalto Cyberflex e-gate 32K token (Red Hat Enterprise Linux only)
• Safenet 330J Java smart card
Smart card testing was conducted using the SCM SCR331 CCID reader.
The only card manager applet supported with Certificate System is the CoolKey applet which ships
with Red Hat Enterprise Linux 5.3.
3.5. Supported HSM
Red Hat Certificate System supports the Safenet Chrysalis-IT LunaSA and nCipher netHSM 2000
hardware security modules (HSM) by default. The tested and supported versions are listed in Table 4,
“Tested HSM Versions for Red Hat Certificate System 8.0”. Other HSMs can be added by loading their
libraries in the local machine and configuring the default configuration files after the Certificate System
packages are installed, but before configuring the instances; this is described in the Administrator's
Guide.
HSM Firmware Appliance Software Client Software
Safenet Chrysalis-ITS
LunaSA
4.5.2 3.2.4 3.2.4
nCipher netHSM 2000 2.33.60 11.10
Table 4. Tested HSM Versions for Red Hat Certificate System 8.0
4. Installing Red Hat Certificate System Subsystems
The following sections contain information on the prerequisites and procedures for installing Certificate
System subsystems, including basic information that you need to begin installing the packages.
Installing and configuring Certificate System 8.0 subsystems is described in more detail in the
Installation Guide.
4.1. Installation Notes
• Packages are non-relocatable. The Red Hat Certificate System base packages can not be installed
to a user-designated location.
• Remove any installed libsqlite RPM files before installing the RA. The sqlite RPM files that
ship with RA cause conflicts with those files.

Install the Required JDK
9
4.2. Install the Required JDK
Certificate System requires Sun JDK 1.6.0. This JDK must be installed separately.
The OpenJDK can be installed by using yum or by downloading the packages directly from http://
openjdk.java.net/install/. For example:
yum install java-1.6.0-openjdk
After installing the JDK, run /usr/sbin/alternatives as root to insure that the proper JDK is
available:
/usr/sbin/alternatives ---config java
There are 3 programs which provide -'java'.
Selection Command
-----------------------------------------------
1 -/usr/lib/jvm/jre-1.4.2-gcj/bin/java
2 -/usr/lib/jvm/jre-1.6.0-openjdk/bin/java
*+ 3 -/usr/lib/jvm/jre-1.6.0-sun.x86_64/bin/java
See http://kbase.redhat.com/faq/FAQ_54_4667.shtm for more information on using the JDK for Red
Hat Certificate System.
4.3. Verifying Red Hat Directory Server
All subsystems require access to Red Hat Directory Server 8.1 on the local machine or a remote
machine. The Directory Server can be installed on Red Hat Enterprise Linux 5.3 32-bit, Red Hat
Enterprise Linux 5.3 64-bit, or Solaris 9 Sparc 64-bit.
Check that the Red Hat Directory Server is already installed. For example:
yum info redhat-ds
Installed Packages
Name -: redhat-ds
Arch -: x86_64
Version -: 8.1.0
Release -: 1.4.el5dsrv
Size -: 136M
Repo -: installed
...
Install Red Hat Directory Server 8.1, if a directory service is not already available. For example:
yum install redhat-ds
Installing Red Hat Directory Server is described in more detail in the Red Hat Directory Server
Installation Guide.
4.4. Verifying Apache
Apache 2.x must be installed on Red Hat Enterprise Linux systems in order to install the TPS
subsystem. Check that the appropriate version of Apache is installed.

Red Hat Certificate System 8.0
10
yum info httpd
Installed Packages
Name -: httpd
Arch -: x86_64
Version: 2.2.3
Release: 1.4.el5
Size -: 2.9 M
Repo -: installed
...
Install Apache if it is not already available. For example:
yum install httpd
4.5. Installing mod_nss
Before installing the subsystem packages on Red Hat Enterprise Linux, first install or upgrade
mod_nss. mod_nss is required for all Red Hat Certificate System packages, but is not included in the
Red Hat Certificate System repositories, so make sure that the appropriate Red Hat Network channels
are configured.
yum install mod_nss
4.6. Installing through yum
To install the subsystems on Red Hat Enterprise Linux 5 (32-bit), run a command like the following for
each subsystem:
yum install pki-subsystem
subsystem can be any of the Certificate System subsystems:
•ca for the Certificate Manager.
•ra for the Registration Authority.
•drm for the Data Recovery Manager.
•ocsp for the Online Certificate Status Protocol Responder.
•tks for the Token Key System.
•tps for the Token Processing System.
•console for the Java console.
When the installation process is complete, a URL to access this instance is printed to the screen which
gives the subsystem instances hostname, port, and a login PIN to access the configuration wizard.
Configuration Wizard listening on http://hostname.domainname:unsecure-port/subsystem_type/
admin/console/config/login?pin=pin
For example:

Installing from an ISO
11
http://server.example.com:9180/ca/admin/console/config/login?pin=Yc6EuvuY2OeezKeX7REk
4.7. Installing from an ISO
Red Hat Certificate System 8.0 can also be downloaded from Red Hat Network as an ISO image. This
ISO image contains an RPMS/ directory which can be used as a local yum repository.
Place that RPMS/ directory on a web server and then configure yum to use that location as a
repository. After that, install Certificate System as described in Section 4.6, “Installing through yum”.
5. Documentation for Certificate System 8.0
The Red Hat Certificate System 8.0 documentation includes a complete set of usage and
management documentation for both regular users and administrators. Along with the existing
documentation set, there are important changes and enhancements to the 8.0 documentation:
5.1. Documentation Changes in 8.0
• The Administrator's Guide has been reorganized and partially rewritten to have a better structure
and flow to the content. The intent of rewriting the Administrator's Guide is to make information
easier and more intuitive to find.
• A new Installation Guide has been added to the doc set. This is based on the installation sections
from the Administrator's Guide.
• A new Certificate System Deployment Guide has been written to cover PKI concepts and
deployment planning.
• A new end-entities guide, Using End User Services, has been created to have a small, handy guide
for the end-user services for the CA and RA which are available through Certificate System.
All of the new features implemented in Certificate System 8.0 are covered in the documentation:
• New information on port separation has been added in all of the guides and all examples and
screenshots have been updated with the new port settings.
• The renewal sections in the Administrator's Guide have been rewritten and updated for the new
profile framework. This includes adding information on new CA profiles for renewal and new
procedures to renew user and server SSL certificates. The enrollment pages list in the Agent's
Guide has also been updated.
• The existing auto enrollment proxy information has been added to the Administrator's Guide.
• A new method for publishing CRLs over HTTP has been added, and the corresponding sections of
the publishing chapter in the Administrator's Guide have been updated.
• The new TPS operator role has been added to the TPS chapter of the Agent's Guide, and the
information for the agent and admin roles has been updated.
• The cloning sections have been updated to cover enhancements for managing and assigning serial
numbers and for changes in the configuration procedure.
• There is enhanced UTF-8 support for subject alt names in certificates. This has been noted in the
Administrator's Guide.

Red Hat Certificate System 8.0
12
• Some information on audit log signing has been added to the logs section of the Administrator's
Guide.
• The procedure for loading third-party ECC modules to provide ECC support has been added to the
Installation Guide.
• The procedure for enabling Windows smart card logins has been added to the token management
chapter of the Administrator's Guide.
• Changes to the Enterprise Security Client configuration and to the security officer configuration have
been added to the Managing Smart Cards with the Enterprise Security Client guide.
• The section on security domains has been updated to reference the new LDAP entries rather than
the domain.xml file.
• The directory paths have been updated for the new locations.
5.2. Documentation with 8.0
Along with these release notes, the documentation for Certificate System includes the following
guides:
•Certificate System Deployment Guide1 describes basic PKI concepts and gives an overview of the
planning process for setting up Certificate System.
This manual is intended for Certificate System administrators.
•Certificate System Installation Guide2 covers the installation process for all Certificate System
subsystems.
This manual is intended for Certificate System administrators.
•Certificate System Administrator's Guide3 explains all administrative functions for the Certificate
System. Administrators maintain the subsystems themselves, so this manual details backend
configuration for certificate profiles, publishing, and issuing certificates and CRLs. It also covers
managing subsystem settings like port numbers, users, and subsystem certificates.
This manual is intended for Certificate System administrators.
•Certificate System Agent's Guide4 describes how agents — users responsible for processing
certificate requests and managing other aspects of certificate management — can use the
Certificate System subsystems web services pages to process certificate requests, key recovery,
OCSP requests and CRLs, and other functions.
This manual is intended for Certificate System agents.
•Managing Smart Cards with the Enterprise Security Client5 explains how to install, configure,
and use the Enterprise Security Client, the user client application for managing smart cards, user
certificates, and user keys.
This manual is intended for Certificate System administrators, agents, privileged users (such as
security officers), and regular end users.
•Using End User Services6 is a quick overview of the end-user services in Certificate System, a
simple way for users to learn how to access Certificate System services.

Bugs Fixed in Certificate System 8.0
13
This manual is intended for regular end users.
•Certificate System Command-Line Tools Guide7 covers the command-line scripts supplied with Red
Hat Certificate System.
This manual is intended for Certificate System administrators.
•Certificate System Migration Guide8 covers version-specific procedures for migrating from older
versions of Certificate System to Red Hat Certificate System 8.0.
This manual is intended for Certificate System administrators.
All of the latest information about Red Hat Certificate System and both current and archived
documentation is available at https://www.redhat.com/docs/manuals/cert-system9.
6. Bugs Fixed in Certificate System 8.0
Along with the many new features and enhancements in Red Hat Certificate System 8.0, this release
is also a bug fixing and maintenance release.
The following bugs have been fixed in the 8.0 release of Red Hat Certificate System.
Bug Number Description
209213 There was a random error in the Enterprise Security Client that when an enrolled card was inserted and removed, the Reset
Password window would not allow users to type in a new password.
211053 There Enterprise Security Client would not restart on Microsoft Windows Vista after the machine was rebooted, so the client would
have to be started manually.
223309 When a CA was cloned, certain attributes that are required for the clone were not properly copied over, including attributes containing
the CA certificates. This meant that the cloned CA could not function.
223367
224902
When a subsystem configuration failed or if a subsystem were uninstalled and then a new instance, with the same instance name
was created, then the configuration would fail at the internal database configuration window because there was no way to overwrite
the existing database with the same name. A new checkbox has been added that allows the new instance to reuse the database
name.
224691 With two TPS instances on the same server, if one instance were restarted, then the other one would be stopped.
224765 When cloning a CA, the configuration wizard would claim that a new administrator certificate was generated and imported into the
browser, even though no certificate was created.
224889 If a TPS was configured not to support server-side key generation, the DRM-related server-side key generation parameters were still
added to the CS.cfg file with wrong values.
240083
241423
Inconsistently, expired certificates were included and published in new CRLs.
243921
490461
Publishing certificates and CRLs to a text file (file-based publishing) failed.
245661 Cloning a DRM on an HSM resulted in numerous errors, such as Java null pointer exceptions, authorization failures, and improper
configuration for the instance state, request numbers, and serial numbers.
246252 A CA would accept a certificate request which was signed with an obviously bad signature because it only verified the certificate
request itself.
9 http://www.redhat.com/docs/manuals/cert-system/

Red Hat Certificate System 8.0
14
Bug Number Description
250188 During subsystem configuration, the Authority Key Identifier extension was not be generated on the issued subsystem certificates.
251226 Opening the CA console threw a null pointer exception referencing the CMSAdmin class because of a misnamed jar file.
251569
482935
The search time limit for end-entities pages set in the web.xml file was being inconsistently ignored, which could allow the LDAP
process (ns-slapd) to reach 100% CPU.
253323 When using the Certicom PKCS #11 module with the OCSP, the OCSP failed to start because the OCSP signing certificate nickname
was missing in the database token configuration.
253657 When attempting to enroll 64K smart cards in the TPS, key generation failed, causing the enrollment process to fail. This is resolved
with the newest CoolKey applet.
285241 The Enterprise Security Client on Microsoft Windows and Apple MacIntosh would intermittently display only one certificate for a token
in the View Certificates window, even though dual certificates (signing and encryption) had been enrolled.
286491 The OCSP signing certificate incorrectly was generated with the Basic Constraints value set to indicate it was a CA signing certificate
(isCA=true).
357581 The Validity Constraints extension was not properly implemented in the profile framework so that the before and after grace periods
were not honored.
435170 Going through the RA configuration wizard could blank out the nss.conf file that was created when the instance was created. The
initial installation was run as root, but the configuration process was run as pkiuser, which caused the file permission and write
problems.
435476 The DRM failed to start when self-tests were enabled.
437188 When a user requested a certificate through the CA's end-entities pages, the enrollment form always prompted for a key archival
option and claimed to archive the new keys successfully, even though the profile was not configured for key archival and, in fact, no
keys were archived.
439027 Certificates could not be imported into a subsystem instance's certificate database using the administrative console.
441896
442387
443657
480804
A number of different actions in the CA console would make the console freeze and hang, including:
• Deleting certificates from the certificate database.
• Changing the automated notifications configuration.
• Editing CRL issuing points.
• Changing the validity nesting requirement setting.
442239 The contents of CRL issuing points entry fields were not being shown in the console window, so none of the entry values that were
typed when adding or editing CRL issuing points were visible.
443120 Trying to delete an imported CA certificate in the console returned the message You're not authorized to perform that operation, and
the deletion failed.
443413 The notification email sent to an agent for a new certificate request had the wrong URL to view the request.
443417 Even if the requester entered his email when submitting a certificate request, the notification email sent to the agent always read
requestor email is VALUE UNKNOWN.
445436 Searching for certificates through the Revoke Certificates page in the CA's agent services reported a bad search filter. The schema
used for search filter generation have been updated to enhance the filtering options.
458499 The Unique Subject Name Constraint rejected requests with duplicate subject names even if the existing certificate was revoked or
expired (when the duplicate name should have been allowed). Along with fixes to this error, a new parameter has been added to the
constraint to allow administrators to set whether to allow duplicate subject names as long as the key usage bits are different.
463343 Key generation failed on the DRM when it was configured to use nCipher netHSM.

Bugs Fixed in Certificate System 8.0
15
Bug Number Description
478909 In some situations, the internal LDAP database for a CA could run out of connections because of memory leaks associated with the
operations to get and set serial numbers.
480143 SELinux errors at the time an instance was created could potentially prevent the configuration wizard from opening for the OCSP,
TKS, or RA.
480825 The publisher ignored the encoding parameter and always published files in base-64 encoding.
481177 Normally, when a certificate is published to a file, and then the certificate is revoked, the publisher removes the published file for the
revoked certificate. However, base-64 encoded files were not being unpublished by the publisher.
481790 If a value other than a UUID was set for the OtherName parameter for the Subject Alternative Name extension, than the subject
alternative name was ignored and not included in the issued certificate.
483184 Attempting to add or register a custom authentication plug-in to the CA configuration through the console threw several different Java
IO exception errors, and adding the plug-in failed.
490551 The key size is now selectable in end-entity forms, so the same profile can be used to issue both 1024-bit and 2048-bit certificates,
for example. The fully range is 512 bits to 8192 bits, for RSA keys.
490782 The security officer token was reset whenever the Enterprise Security Client esc-prefs.js file was edited to go from security
officer mode to regular mode. The security officer token was mistakenly being formatted when it was inserted to control a user token
format operation.
490814 The format operation for a token updates its master key from the default to a new one. However, the default master key version is
set in the TPS CS.cfg. Whenever master key changeover occurred, the formatted tokens could not be re-enrolled because their
new master key version did not match the one in the TPS configuration. However, changing the master key version in the TPS
configuration prevented new tokens (with the default master key) from being enrolled.
New configuration parameters have been added to allow the TPS configuration to set both the default master key version and an
indexed key version.
491000 Trying to format or re-enroll a formatted security officer token caused the Enterprise Security Client to throw error 28 on the format
window because the command to revoke the existing certificates failed.
491185 All of the schema and elements implemented according to RFC 2256 have been updated to RFC 5280.
492180 Trying to enroll a temporary token for a security officer with a lost token failed with error 28, claiming that the connection to the CA
was lost. The actual error was that key generation failed.
492189 A security officer token that was a temporarily lost state could be used to log into the security officer work station.
492361 An improved error message has been added to clarify why the enrollment operation was rejected when a user attempts to format a
token which was enrolled to a different user.
499291 Installing the Enterprise Security Client on Microsoft Windows Vista was interrupted or failed because it attempted to call the
eginstall.exe drivers, which are not shipped with Vista.
499439 The tokens activities display page was hard-coded to display only 25 entries, regardless of the actual number of records. This limit
has been removed.
500698 If a CA, TKS, or TPS were installed on an HSM, the subsystem could crash after a large number of token operations (10,000 or
more). A memory leak in the token operation exhausted the memory on the HSM.
501336 The Enterprise Security Client hung if a user attempted to re-enroll a token when the profile was set to reject re-enrollment operations
(RE_ENROLL=NO).
502861 Attempting to enroll a certificate through the Signed CMC Authentication User Certificate Enrollment form always failed with an
authorization error.
503045 Attempting to perform a CMC revocation through the end-entities services pages failed with a Java null pointer exception and an
authorization error.

Red Hat Certificate System 8.0
16
Bug Number Description
503783 If a certificate request was submitted without a requester email address, the request notification email sent to the CA agent gave the
email address for the requester of the previous certificate.
508378 Attempting to connect to the internal database using LDAPS (LDAP over SSL) failed and caused the subsystem console to hang.
Table 5. Fixed Bugs
7. Errata Releases for Certificate System 8.0
The following errata have been issued for Red Hat Certificate System, fixing important security and
performance issues. The complete list of errata issued for Red Hat Certificate System 8.0 is available
through Red Hat Network10.
Advisory Description Release Date
RHBA-2010:0169 This update supplies a fix to
a vulnerability in the TLS/SSL
protocols that could allow a
specific type of man-in-the-
middle attack. This errata (and
related configuration changes)
make all Certificate System
subsystems compliant with
RFC 5746.
March 25, 2010
RHBA-2010:0097 This update addresses a
problem (Bugzilla 557346) in
marking the Name Constraints
Extension as critical. When the
criticality was marked "true"
in the enrollment profile or if
the agent marked the criticality
as "true" when approving the
request, the criticality always
came up as "false."
February 11, 2010
RHBA-2009:1687 This release added support for
Enterprise Security Client on
64-bit Windows servers.
This release included a new
configuration parameter for the
Enterprise Security Client which
allows administrators to set up
a shared security database with
common certificates that can be
used when there are multiple
Enterprise Security Client users
on a single machine.
This release also included fixes
for these bugs:
December 21, 2009
10 https://rhn.redhat.com/errata/rhel-certificate-system-8-errata.html

Errata Releases for Certificate System 8.0
17
Advisory Description Release Date
• Bugzilla 530633. The
Enterprise Security Client on
Windows didn't recognize
when a Gemalto token was
inserted.
• Bugzilla 530482. With a poor
network connection, a blank
screen would sometimes
pop-up instead of the token
enrollment window. A more
helpful error message has
been added to the client.
• Bugzilla 523568. Smart cards
could not be enrolled using
LDAP authentication when
the passwords where stored
using the password storage
scheme.
RHBA-2009:1665 These packages included
an enhancement which
allows a subsystem to be
configured to prompt for
subsystem passwords rather
than reading them out of the
plaintext password.conf file.
New instances can have the
password.conf file removed
and prompt for all necessary
passwords immediately;
existing and fully-updated
instances can be configured to
prompt for passwords once the
password.conf file is removed.
A new watchdog process
ensures that the instance can
restart cleanly if a process is
interrupted.
This release also included fixes
for these bugs:
• Bugzilla 529280. TPS HTTP
responses were not properly
formatted according to RFC
2616. Chunked data were
supposed to end with the
sequence 0\r\n, but this
December 11, 2009

Red Hat Certificate System 8.0
18
Advisory Description Release Date
was not included in the TPS
responses.
• Bugzilla 533510. If signed
audit logging was enabled
for the TPS, then it was not
possible to start the TPS
instance.
RHBA-2009:1602 This release added functionality
to select signature digest
algorithms (like SHA256 and
SHA512) for RSA and ECC.
This release also included fixes
for these bugs:
• Bugzilla 529945
• Bugzilla 351162
November 25, 2009
RHBA-2009:1596 This update addresses Bug
505682 - Allow configuration
of NSS OCSP cache settings.
New parameters are enabled
to allow user-defined cache
sizes, OCSP check times,
and timeout periods for OCSP
responses.
November 19, 2009
RHBA-2009:1443 This release had
enhancements for ECC
support, including extending
support on Firefox for ECC
enrollments and adding support
for ECC POP. This release also
included these bug fixes:
• Bugzilla 512831
• Bugzilla 512828
• Bugzilla 513450
• Bugzilla 514093
• Bugzilla 514270
• Bugzilla 518431
September 14, 2009
Table 6. Errata Releases

Known Issues
19
8. Known Issues
8.1. Reconfiguring the Red Hat Certificate System Subsystems to
Prevent a Potential TLS-Related Man-in-the-Middle Attack
Transport Layer Security (TLS) is a protocol which establishes a secure connection between a client
and a server. Marsh Ray of PhoneFactor discovered a flaw in the TLS protocol itself which could allow
an attack to insert plain text into an existing session during a TLS renegotiation operation.
The Educated Guesswork blog has a good description of this kind of attack at http://
www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html.
Either a client or a server may request a renegotiation of an existing TLS/SSL session (for instance,
to renew session encryption keys or to use different cipher suite). When TLS/SSL is used to secure
access to an HTTP service and a client attempts to access some protected resource, server-initiated
renegotiation asks client to authenticate with a certificate.
However, the TLS/SSL protocols did not use any mechanism to verify that session peers do not
change during the session renegotiation. Therefore, a man-in-the-middle attacker could use this flaw
to open TLS/SSL connections to the server, send attacker-chosen request to the server, trigger the
renegotiation (either by directly requesting it or by attempting to access protected resource, resulting
in server-initiated renegotiation) and splice victim's initial connection attempt to an existing TLS/
SSL session. Depending on the application-layer protocol, this may lead to attacker request being
performed by the server as if authenticated using victim's credentials or using data from victim's
request. After the renegotiation, attacker can no longer decrypt communication between the client and
the victim, so this attack is also referred to as a "blind prefix injection" attack. Eric Rescorla's blog post
"Understanding the TLS Renegotiation Attack" provides additional details about this flaw.
In Certificate System, this kind of session renegotiation occurs if a user connects to an end-entity port
that doesn't require client authentication, but then attempts to submit a certificate enrollment form for
an enrollment profile that requires client authentication. The Certificate System server requests and
then parses a client certificate for the user.
For both client-initiated and server-initiated renegotiation to be fixed, then both the client and server
need to be updated to apply RFC 5746. which resolves the man-in-the-middle vulnerability. For the
Certificate System subsystems, the resolution is supplied through Errata RHBA-2010:016911 and
Errata RHBA-2010:016512, plus these configuration changes.
Certificate System supports several different clients:
• Certificate System and third-party RA subsystems (used by both regular users and SCEP services)
• TPS subsystems, which connect to the CA for token operations
• The Windows Autoenrollment Proxy
• Web browsers, which are used by users to connect to the CA's end-entities pages
Updating the system NSS packages on any system that hosts a Certificate System subsystem will
take care of all subsystem communication. When the NSS packages are updated, the CA-RA and CA-
11 https://rhn.redhat.com/errata/RHBA-2010-0169.html
12 https://rhn.redhat.com/errata/RHBA-2010-0165.html

Red Hat Certificate System 8.0
20
TPS connections will use the new session renegotiation protocol and all of the operations will proceed
as normal.
Additional configuration changes may need to be made for the Windows auto-enrollment proxy or
third-party RAs if those systems aren't updated to use the new renegotiation protocol. Contact Red Hat
support for information on what needs to be done for those clients.
It is unclear on when browser clients will have updates available and applied to use the new session
renegotiation protocol. If these clients aren't updated, but the server is, then the connections to the
subsystem server may fail.
NOTE
These changes are not required if all clients accessing Certificate Systems are upgraded
to support RFC 5746.
Certificate System 8.0 uses the Red Hat Enterprise Linux 5 system NSS packages. Updated NSS
packages for Red Hat Enterprise Linux 5 are available as part of Errata RHBA-2010:016513. Existing
instances need to be reconfigured to add the new port, and direct requests to this port. Any new
instances will automatically have these changes applied.
Procedure 1. For Existing CAs
1. Before making any edits to the CA configuration, back up the following files:
• /var/lib/instance_name/webapps/ca/WEB-INF/web.xml
• /var/lib/instance_name/web-apps.ee/ca/ee/ca/ProfileSelect.template
• /var/lib/instance_name/conf/server.xml
• /etc/init.d/instance_name
2. Since database changes are also required, back up the database.
3. Modify the server.xml file to add the new client authentication end-entities port.
1. At the top of the file, replace the PKI status definitions with the following section, with the
correct hostname and ports. Replace all the lines with the exact excerpt because there are
important spacing differences in the definitions.
<!-- DO NOT REMOVE -- Begin PKI Status Definitions --->
<!--
Unsecure Port = http://server.example.com:9180/ca/ee/ca
Secure Agent Port = https://server.example.com:9443/ca/agent/ca
Secure EE Port = https://server.example.com:9444/ca/ee/ca
Secure Admin Port = https://server.example.com:9445/ca/services
EE Client Auth Port = https://server.example.com:9446/ca/eeca/ca
PKI Console Port = pkiconsole https://server.example.com:9445/ca
Tomcat Port = 9802 (for shutdown)
-->
<!-- DO NOT REMOVE -- End PKI Status Definitions --->
13 https://rhn.redhat.com/errata/RHBA-2010-0165.html