Bug: Certificate Revocation Fails to Find or Revoke Valid Certificates

Version Affected: All
Bug Number: EE-3710, EE-3694
Bug Status: Open - No Permanent Fix
Fixed in Version(s): Not yet fixed as of this article's last review — check current release notes for status.

 

Overview

This article explains two defects in a Certificate Revocation realm's certificate search and revoke functionality: searching for issued certificates can fail to return results, and revoking a certificate found by search can fail with a "cannot find the certificate" error.

 

Cause

These are two separate defects in the same feature:

• Searching for a certificate known to have been successfully requested and delivered returns no results. The certificate deployment and revocation search feature relies on the server's Locale/Culture setting being en-US (1033), because the dates recorded for issued certificates are stored in MM/dd/yyyy format, but the search feature interprets dates using the server's Locale/Culture setting. If the Locale/Culture is set to something else — for example en-GB (2057), which expects dd/MM/yyyy — the second segment of the date is limited to a maximum of 12, and any certificate issued after the 12th of the month can cause the search to fail completely or return incomplete results. (EE-3710)
• After finding a valid certificate to revoke, clicking Revoke can return Cannot find the certificate with SN '<serial number>' even though the certificate was just found by search.
  This happens when the search that found the certificate was a wildcard search rather than an exact-match search. (EE-3694)

Resolution / Workaround

For the search failure (EE-3710): edit the date values in the affected realm's %Realm%\CertLog CSV files to use MM/dd/yyyy format, matching what the server's Locale/Culture setting expects.

For the revoke failure (EE-3694): check the Exact match checkbox before searching, then find and revoke the certificate again using that exact-match result.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.