437804 - certutil -R for cert renewal should derive the subject from the cert if none is specified.

Status: RESOLVED FIXED

(NSS :: Tools, enhancement, P2)

Description

[Elio Maldonado]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.14) Gecko/20080416 Fedora/2.0.0.14-1.fc8 Firefox/2.0.0.14
Build Identifier: nss-3.12.0.3


Certutil has a way to request a certificate with an existing key (#341371). The user must provide the subject which should be optional as it can be obtained from the cert itself. 
Use case: 
certutil -R -s $subject -k $nickname \   #<---- instead of rsa use nickname -y $publicExponent -t $trust_args -d $dir -o $outcsrfile ... other arguments

The -k nickname option enables finding the cert, from which the keys are obtained, the subject could be obtained from the cert.


Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Elio Maldonado]

Attachment: changes to extract subject when nickname is specified

Possible implementation for review.

Comment 2

[Elio Maldonado]

Upgrading severity from enhancement to normal as this bug blocks porting fedora crypto-utils (certificate management) tools to use NSS for their cryptographic operations, please see https://bugzilla.redhat.com/show_bug.cgi?id=346731 for more information.

Comment 3

[Elio Maldonado]

Attachment: extract subject from cert when nickname is specified on cert renewal

fix a memory leak on previous attachement

Comment 4

[Elio Maldonado]

Attachment: fix bad indentation in previous attachement

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

I confirm this is an enhancement request :)

Comment 6

[Robert Relyea]

Comment on attachment 330795 [details] [diff] [review]
fix bad indentation in previous attachement

r- 

but close. There is one minor issue and a nit.

minor issue (caused the r-):
> PR_fprintf(PR_STDERR, "%s -s: improperly formatted name: \"%s\"\n",
>+	    	               progName, certutil.options[opt_Subject].arg);


This is incorrect. it should read something like "%s couldn't get subject from certificate %s", progname, keysource);

The current error message is for the case where the user supplied the subject.

Comment 7

[Robert Relyea]

arg, missed the nit.

You are adding a nested 'if' inside a compound if. Simply add another && clause.

bob

Comment 8

[Elio Maldonado]

Attachment: Fixes from review comments #6 and #7

Comment 9

[Robert Relyea]

Comment on attachment 335482 [details] [diff] [review]
Fixes from review comments #6 and #7

r+

Comment 10

[Elio Maldonado]

Checked in mozilla/security/nss/cmd/certutil/certutil.c, v1.143.