Bug 4696 – grid-cert-info cannot extract info from .p12 files

Bug 4696 - grid-cert-info cannot extract info from .p12 files

Summary:

grid-cert-info cannot extract info from .p12 files

Status:	RESOLVED FIXED

Product:	GSI C
Component:	Credentials and Proxies
Version:	unspecified
Platform:	All Linux

Importance:	P3 enhancement
Target Milestone:	4.2.2
Assigned To:	Joe Bester

URL:
Keywords:	4.0.x, usability

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2006-09-13 10:10 by John Kewley
Modified:	2008-10-30 04:46 (History)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note

You need to log in before you can comment on or make changes to this bug.

Description From John Kewley 2006-09-13 10:10:20

grid-cert-info returns useful information (in particular the cert's DN and
validity) for all bar one of the scenarios listed for user credentials on

http://www-unix.globus.org/toolkit/docs/4.0/admin/docbook/ch05.html#prewsaa-env-credentials

# If X509_USER_CERT and X509_USER_KEY exist and contain a valid certificate ...
# If the files usercert.pem and userkey.pem exist in .globus ...
# If a PKCS-12 file called usercred.p12 exists in .globus directory

Note that the 3rd case is the only one where the user's certificate is
protected by a passphrase.

My suggestion is to allow grid-cert-info to be able to print the
same information for when the .p12 file is used rather than the pair
of .pem files. Of course, the user would have to be prompted for his passphrase
in this situation.

Additionally, can we have a X509_USER_CRED as well for consistency?

JK

------- Comment #1 From Joe Bester 2007-12-03 11:14:35 -------

Fix committed to 4.0 branch and trunk.

------- Comment #2 From Charles Bacon 2008-09-30 19:30:59 -------

This broke backwards compat for someone who was used to running "grid-cert-info
-file cacertbb.0 -subject".  Perhaps the default should be to assume x509
unless you see a p12 in the filename?

4.0.5:
$ grid-cert-info -file /TRUSTED_CA/e1fce4e9.0 -subject
/DC=gov/DC=fnal/O=Fermilab/OU=Certificate Authorities/CN=Kerberized CA

4.0.7:
$ grid-cert-info -file /TRUSTED_CA/e1fce4e9.0 -subject
Error: certificate file "/TRUSTED_CA/e1fce4e9.0" is not .pem or .p12

------- Comment #3 From Joe Bester 2008-10-01 08:21:02 -------

I created a new patch that adds a check for PEM headers in the file if the
extension is neither pem nor p12:
http://www.mcs.anl.gov/~bester/patches/bug4696-2.diff

Let me know if there are any issues with that.

------- Comment #4 From Joe Bester 2008-10-30 04:46:14 -------

Fix committed to 4.2 branch, 4.0 branch, and trunk.