Issues - certmonger

#302 certmonger is repeatedly requesting certificates from IPA

2

Opened Feb 13, 2026 by mrd000. Modified Feb 13, 2026

PR#303

#298 Dedicated listening socket uses pid instead of uid for pre/post command

8

Opened Sep 30, 2025 by charlietx. Modified Dec 2, 2025

PR#300

#294 de-duplicate and improve PEM-to-base64 code

Opened Sep 1, 2025 by ftweedal. Modified Sep 1, 2025

#292 Fix deprecation warnings related to OpenSSL 3.0

Opened Aug 6, 2025 by rcritten. Modified Aug 6, 2025

#289 postsave command should get cert info via environment variables

1

Opened Mar 20, 2025 by dagwieers. Modified Mar 20, 2025

#286 Assigment to long from int64_t

1

Opened Dec 30, 2024 by carl-di-ortus. Modified Jan 2, 2025

#285 AD certificate authentication changes kb5014754

9

Opened Dec 5, 2024 by lloorens. Modified Feb 6, 2025

#284 Update certmonger to use the IPA-based request, check, approve, retrieve workflow

2

Opened Nov 27, 2024 by rcritten. Modified Nov 27, 2024

PR#296

#283 Don't log NULL param values

Opened Jun 24, 2024 by rcritten. Modified Jun 24, 2024

#281 Add support for conditional certificate chain verification

5

Opened Jun 10, 2024 by iabdullin. Modified Feb 13, 2025

#278 possible multiple certificates requested

11

Opened Apr 16, 2024 by dmulder. Modified Jul 11, 2024

#272 getcert list-cas -c CA doesn't return an error if not found

Opened Jan 23, 2024 by asn. Modified Jan 23, 2024

#271 Please add `getcert version`

1

Opened Jan 23, 2024 by asn. Modified Jan 23, 2024

#269 Add its own return code for EEXISTS for getcert tool

4

Opened Jan 22, 2024 by asn. Modified Jan 30, 2024

#241 RFE: output issued certificate + subordinate CA chain to a single file

Opened May 21, 2022 by yrro. Modified May 21, 2022

#227 Address existing mal-formed CSRs that may be stored by certmonger

4

Opened Oct 7, 2021 by rcritten. Modified Oct 8, 2021

Low

#217 certmonger service starts but not able to handle dbus communication immediately

2

Opened Aug 11, 2021 by ssslll. Modified Sep 19, 2022

#213 Fix GCC analyzer issues

1

Opened Jul 6, 2021 by rcritten. Modified Aug 5, 2021

Normal

#195 automatic cert renewal using cepces not working

15

Opened Mar 10, 2021 by jockesssd. Modified Apr 21, 2021

#189 RFE: retrieve the IPA subCA certificate when the -X option is used with -F

1

Opened Feb 15, 2021 by rcritten. Modified Feb 18, 2021

Normal

#174 covscan and clang issues to investigate

Opened Nov 24, 2020 by rcritten. Modified Nov 24, 2020

#144 getcert request -a has no effect

7

Opened Feb 17, 2020 by cheimes. Modified Feb 18, 2020

#143 manual resubmit is not retried upon failure

9

Opened Feb 3, 2020 by ftweedal. Modified May 20, 2020

#137 Buffer overflow when resubmitting cert

5

Opened Nov 6, 2019 by joshbenner. Modified Nov 6, 2019

#135 RFE: JSON or some sort of machine parsable output for CLI

2

Opened Oct 11, 2019 by erinn. Modified Oct 11, 2019

#133 Certmonger implicitly triggers NSS DB migration

Opened Sep 30, 2019 by slev. Modified Sep 30, 2019

#121 dogtag-submit doesn't send nonce on approval request

3

Opened Jul 10, 2019 by detchen. Modified Jul 17, 2019

#110 [i586] max unix date problem

2

Opened Apr 12, 2019 by slev. Modified Aug 14, 2019

#101 local-submit does not read /etc/certmonger/certmonger.conf

1

Opened Mar 21, 2018 by rcritten. Modified Feb 17, 2021

0.79 Normal

#73 More reasonable default keysize for EC

2

Opened Mar 30, 2017 by rcritten. Modified Jul 5, 2019

#63 Certmonger is unable to use encrypted private key to submit a CSR

1

Opened Jan 24, 2017 by stlaz. Modified Feb 16, 2021

0.0 NEEDS_TRIAGE Normal

#62 Different "Subject" interpretation with NSS/OpenSSL in CSR

Opened Jan 24, 2017 by stlaz. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Low

#61 dogtag-ipa-renew-agent-submit should use https when --agent-submit is specified

Opened Nov 7, 2016 by frenaud. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#60 Allow CSR to be provided to getcert

2

Opened Oct 3, 2016 by nkinder. Modified Nov 3, 2021

0.0 NEEDS_TRIAGE Normal

#59 [RFE] watch & warn only mode

Opened Sep 27, 2016 by pspacek. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#56 ipa submission should not retry without 'profile' or 'cacn' argument

Opened Aug 23, 2016 by ftweedal. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#54 add certmonger proxy support

Opened Aug 8, 2016 by c031917. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE High

#53 Add support for EST (Enrollment over Secure Transport) RFC7030

Opened Jul 29, 2016 by rcritten. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#52 ipa-getcert does not reach IPA server if cert issued by other CA

1

Opened Jun 30, 2016 by admiyo. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#49 Python based example Helper

Opened May 13, 2016 by admiyo. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#48 Support for short certificate expiry

Opened May 12, 2016 by admiyo. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#47 certmonger does not automatically recover from CA_UNREACHABLE

Opened Apr 19, 2016 by cheimes. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE High

#46 ipa-getcert: misleading error message with -D option

2

Opened Apr 13, 2016 by cheimes. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Highest

#45 [RFE] Add support for the Dogtag 10 REST API

Opened Mar 17, 2016 by jcholast. Modified Apr 25, 2024

0.0 NEEDS_TRIAGE Normal

#44 Required parameter with argument should show respective error message

1

Opened Sep 29, 2015 by akasurde. Modified Feb 21, 2017

0.79 High

#43 RFE: Monitor/maintain local CRL copies

1

Opened Jul 2, 2015 by lans. Modified Jan 10, 2018

0.0 NEEDS_TRIAGE Normal

#34 Add an 'enrollment options' option

1

Opened May 1, 2014 by nalin. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#30 Be able to receive multiple certificates during issuance

2

Opened Apr 23, 2014 by nalin. Modified May 23, 2022

0.76 Normal

#29 Start caching issuer certificates and their chains and roots if issuers aren't roots

2

Opened Apr 23, 2014 by nalin. Modified Aug 21, 2018

0.76 Normal

#23 Add support for generating CRMF alongside PKCS#10

Opened Jan 25, 2014 by nalin. Modified Feb 21, 2017

0.80 Normal

#19 Enable tracking multiple CA certs in anticipation of CA cert expiration

2

Opened May 2, 2013 by admiyo. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#18 When reading certificates from an NSS database, read the associated trust value

1

Opened Nov 9, 2012 by nalin. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#16 Pass the private key's PublicKeyInfo to enrollment helpers

2

Opened Nov 9, 2012 by nalin. Modified Feb 21, 2017

0.78 Normal

#14 Expose CA, crldp, and ocsp location options at the getcert command line

Opened Nov 8, 2012 by nalin. Modified Feb 21, 2017

0.79 High

#12 Flesh out Dogtag support to make it usable outside of an IPA context

3

Opened Aug 16, 2012 by nalin. Modified Feb 21, 2017

0.78 Normal

#11 Learn to obtain and renew certificates using Active Directory Certificate Services

2

Opened Aug 16, 2012 by nalin. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#1 Learn to store/use keys and certs in guest images

1

Opened Dec 2, 2009 by nalin. Modified Feb 21, 2017

0.0 NEEDS_TRIAGE Normal

#297 Build fails during test suite with NSS 3.115.1

7

Opened Sep 21, 2025 by rauty. Modified Jan 5, 2026

PR#299

#290 getcert list not showing certificate information

3

Opened Apr 17, 2025 by ayrtonl. Modified Apr 23, 2025

#282 compilation issue

2

Opened Jun 23, 2024 by quaternionma. Modified Jun 24, 2024

#276 certmonger (or nss libs) does not list TPM2 slot/token (via libtpm2_pkcs11)

15

Opened Feb 26, 2024 by genesmi. Modified Feb 29, 2024

#275 Test failure with openssl 3.2

6

Opened Feb 18, 2024 by yselkowitz. Modified Feb 20, 2024

#274 Automatic cert renewal does not work

12

Opened Feb 14, 2024 by jockesssd. Modified Oct 23, 2024

#266 Invalid or expired token in Weblate

2

Opened Jan 4, 2024 by rffontenelle. Modified Jan 5, 2024

#260 certmonger does not see all NSS tokens in certsave-n

2

Opened Apr 6, 2023 by rcritten. Modified Jul 26, 2023

Lowest PR#261

#258 Renewing a certificate on a token doesn't remove the old certificate from the default token

1

Opened Mar 15, 2023 by rcritten. Modified Apr 4, 2023

Lowest PR#259

#256 certmonger behaves badly if /etc/pki/nssdb doesn't exist

2

Opened Feb 28, 2023 by rcritten. Modified Apr 4, 2023

Normal PR#257

#251 new tag's naming convention?

2

Opened Dec 1, 2022 by slev. Modified Dec 1, 2022

#249 Add owner/mode info for certs & keys to 'getcert list' output

5

Opened Nov 9, 2022 by yrro. Modified Apr 4, 2023

PR#253

#248 Multiple RA certificate support?

8

Opened Nov 7, 2022 by bmagistro. Modified Nov 14, 2022

#244 libcrypto issues with openssl3

14

Opened Aug 10, 2022 by diegoboff. Modified Aug 23, 2022

PR#245

#243 Renewing a certificate stored in softhsm results in unreadable token

3

Opened Jul 29, 2022 by rcritten. Modified Nov 30, 2022

Normal PR#246

#233 Does not build with OpenSSL 3

6

Opened Dec 8, 2021 by tjaalton. Modified Jan 6, 2022

#228 Drop "NEW" from certificate request headers

1

Opened Nov 2, 2021 by rcritten. Modified Jan 6, 2022

#223 Certmonger creates CSRs with invalid DER syntax for X509v3 extensions with critical=FALSE

5

Opened Oct 4, 2021 by cheimes. Modified Oct 5, 2021

#216 How to check if CA configured properly/completely?

1

Opened Aug 10, 2021 by ssslll. Modified Aug 10, 2021

#211 RFE: Make the certmonger RSA keysize configurable

2

Opened Jun 22, 2021 by rcritten. Modified Aug 6, 2021

Normal

#203 man page of getcert seems outdated

6

Opened Jun 2, 2021 by hennsch. Modified Jun 4, 2021

#202 SCEP renewal with OpenXPKI is not working (+patch PoC)

6

Opened May 23, 2021 by morian. Modified Aug 6, 2021

#197 Unable to use glossary on Weblate

5

Opened Apr 11, 2021 by rffontenelle. Modified Apr 13, 2021

#196 korean translated!

9

Opened Apr 2, 2021 by simmon. Modified Apr 28, 2021

#191 Certmonger segfault after cert renewal request

4

Opened Feb 17, 2021 by rcritten. Modified Dec 18, 2021

#188 [tests] 002-keygen-rsa hangs

4

Opened Feb 2, 2021 by slev. Modified Aug 30, 2021

#187 ipa cert-show behavior difference between versions of dogtag

1

Opened Jan 28, 2021 by rcritten. Modified Sep 19, 2022

Normal

#185 Certmonger spawns Zombie Processes

2

Opened Jan 11, 2021 by rcritten. Modified Feb 16, 2021

Normal

#179 certmonger local ca does not save when system is in fips mode

2

Opened Dec 9, 2020 by vakwetu. Modified Nov 3, 2022

#166 SCEP with Digicert's Managed PKI Service

1

Opened Aug 10, 2020 by buserror. Modified Aug 12, 2020

#163 Invalid free causing dogtag-ipa-renew-agent-submit to crash

2

Opened Jul 1, 2020 by rcritten. Modified Jul 6, 2020

Normal

#161 Crash when displaying SCEP thumbprints in 0.79.10

Opened Jun 30, 2020 by rcritten. Modified Jun 30, 2020

Low

#155 Skip NSS DBM specific tests if NSS_DISABLE_DBM

5

Opened Jun 9, 2020 by slev. Modified Jun 29, 2020

#153 configure wrongly reports about the lack of supported NSS db type

1

Opened Jun 9, 2020 by slev. Modified Jun 9, 2020

PR#154

#141 please migrate to the new Fedora translation platform

7

Opened Jan 1, 2020 by jibecfed. Modified Feb 18, 2021

#138 Migrate tests helpers to Python3

4

Opened Nov 7, 2019 by slev. Modified Jun 9, 2020

PR#139

#132 ipa-submit should use system trust

5

Opened Sep 23, 2019 by ftweedal. Modified May 14, 2021

#127 A principal cannot be added to a request using start-tracking

1

Opened Sep 3, 2019 by rcritten. Modified Sep 3, 2019

0.79 Normal

#125 Certmonger fails to read token in HSM

29

Opened Aug 22, 2019 by magnuskkarlsson. Modified Sep 15, 2019

#124 getcert resubmit overwrites an existing key

5

Opened Aug 16, 2019 by linkvt. Modified Sep 6, 2019

#122 test suite fails with '--disable-dsa'

1

Opened Aug 14, 2019 by slev. Modified Sep 3, 2019

PR#123

#120 Enroll EC keys with SCEP

5

Opened Jul 5, 2019 by brunovernay. Modified Jun 26, 2020

#117 update 'getcert list' output to show template, v2-template and issuer fields

7

Opened May 17, 2019 by ftweedal. Modified Jul 30, 2019

0.79 Normal

#116 SCEP CA_UNREACHABLE

24

Opened May 9, 2019 by ssslll. Modified Jul 18, 2019

#114 cepces (kerberos auth for Windows CA) integration?

1

Opened Apr 30, 2019 by jockesssd. Modified Sep 3, 2019

#113 multi-tiered Windows based CA issue

2

Opened Apr 30, 2019 by jockesssd. Modified Feb 17, 2021

#112 AVC for dogtag-submit

2

Opened Apr 24, 2019 by cheimes. Modified Oct 5, 2020

#111 Replace legacy /var/run with /run

2

Opened Apr 24, 2019 by cheimes. Modified May 22, 2019

#109 Release tag for certmonger-0.79.7

2

Opened Mar 4, 2019 by slev. Modified Aug 14, 2019

#105 Expand getcert-request doc for -D option

6

Opened Nov 6, 2018 by erinn. Modified Nov 7, 2018

#103 Drop message from GetCACaps and GetCACert to improve spec compliance

25

Opened Jul 26, 2018 by rcritten. Modified Jun 2, 2020

0.79 Normal

#102 support libidn2

1

Opened Apr 2, 2018 by pbrobinson. Modified Apr 16, 2018

#99 migrate away from nss so that nss-pem would not be needed anymore

2

Opened Mar 1, 2018 by tjaalton. Modified Sep 3, 2019

#97 src/dogtag.c hardcodes paths

3

Opened Feb 21, 2018 by tjaalton. Modified May 14, 2021

#94 Set LANG/LC_CTYPE=C.UTF-8 or pass the environment down to subprocesses

3

Opened Feb 21, 2018 by tjaalton. Modified Feb 22, 2018

0.79 Lowest

#93 Certmonger cannot obtain a SCEP certificate from a Dogtag sub-CA

35

Opened Feb 2, 2018 by tvaughan. Modified Mar 14, 2018

0.79 Normal

#90 ipa-server-install breaks if subject base RDN has an escaped comma

16

Opened Jan 10, 2018 by rcritten. Modified Feb 18, 2019

0.79

#89 scep-submit should support configuration of allowed encryption and hash algorithms

9

Opened Jan 8, 2018 by tvaughan. Modified Sep 10, 2018

#88 Unit tests failed on rawhide

9

Opened Jan 3, 2018 by lslebodn. Modified Jul 24, 2019

#85 start-tracking: principal name is not added to tracking request

3

Opened Nov 21, 2017 by ftweedal. Modified Nov 23, 2017

#84 Running certmonger as non-root user

3

Opened Oct 27, 2017 by jremitz. Modified Jul 24, 2019

#82 Unreasonable time to check a CA for certificate if helper exist status is 1

2

Opened Sep 22, 2017 by erinn. Modified Sep 29, 2017

#78 Add support for MS Certificate Template V2 extension

1

Opened Aug 18, 2017 by ftweedal. Modified Aug 31, 2017

#76 dogtag-ipa-renew-agent-submit returns PEM with unrecommended formatting

15

Opened Jun 27, 2017 by stlaz. Modified Aug 22, 2017

#65 Fix few plaform specific compilation errors

3

Opened Feb 14, 2017 by lslebodn. Modified Feb 28, 2017

0.80 Normal

#64 Allow to build with openssl-1.1

12

Opened Feb 14, 2017 by lslebodn. Modified Jul 24, 2019

0.0 NEEDS_TRIAGE Lowest

#58 CA identifier not passed to scep-submit helper from 'getcert add-scep-ca'

2

Opened Sep 27, 2016 by lexushko. Modified Sep 6, 2019

0.79 Normal

#57 [RFE] Add start of certificate validity into ouput of 'getcert list'

1

Opened Sep 15, 2016 by mbasti. Modified Nov 9, 2022

0.0 NEEDS_TRIAGE Normal

#55 Remove tlslayer

2

Opened Aug 12, 2016 by cheimes. Modified Feb 21, 2017

0.79 Normal

#51 Support for specifying IPA lightweight CA

2

Opened Jun 13, 2016 by ftweedal. Modified Jun 13, 2017

0.0 NEEDS_TRIAGE Low

#50 SCEP operation GetCAChain is not valid. Should be GetCACertChain

8

Opened Jun 3, 2016 by jgarland79. Modified Jan 8, 2018

0.79 Normal

#42 Hide PIN in getcert output

4

Opened May 11, 2015 by jcholast. Modified Feb 21, 2017

0.77.4 Normal

#41 expose certificate expiration time property through the API

2

Opened Apr 9, 2015 by spoore. Modified Feb 21, 2017

0.78 High

#40 Move localization from Transifex to Zanata

1

Opened Feb 10, 2015 by jcholast. Modified Feb 21, 2017

0.77 Normal

#39 Core was generated by `/usr/libexec/certmonger/ipa-submit' on Fedora 20

3

Opened Jan 22, 2015 by adelton. Modified Feb 21, 2017

0.77 Normal

#38 [RFE] Start certmonger with incoming D-Bus message

4

Opened Jan 20, 2015 by dkupka. Modified Feb 16, 2021

0.78 Normal

#37 Investigate ACME client implementation

5

Opened Nov 21, 2014 by ftweedal. Modified Jan 3, 2024

0.0 NEEDS_TRIAGE Normal

#36 Get/Set external-helper using D-Bus Property interface

4

Opened Aug 13, 2014 by dkupka. Modified Feb 21, 2017

Normal

#35 Add option for requesting IP address subjectAltNames

1

Opened May 1, 2014 by nalin. Modified Feb 21, 2017

0.75 Normal

#33 Rework getcert argument parsing

1

Opened Apr 23, 2014 by nalin. Modified Feb 21, 2017

0.78 High

#32 Add a 'wait' flag to getcert's request/resubmit commands

2

Opened Apr 23, 2014 by nalin. Modified Feb 21, 2017

0.76 Normal

#31 Add getcert location options for storing root and chain certificates

2

Opened Apr 23, 2014 by nalin. Modified Feb 21, 2017

0.76 Normal

#28 Add a 'rekey' command to getcert

1

Opened Apr 23, 2014 by nalin. Modified Feb 16, 2021

0.78 Normal

#27 tests should use /bin/bash instead of /bin/sh

1

Opened Apr 9, 2014 by tjaalton. Modified Feb 21, 2017

0.75 Normal

#26 Use original DER encoding of subject in generated CSRs

5

Opened Mar 10, 2014 by jcholast. Modified Feb 21, 2017

0.74 Normal

#25 certmonger does not save certs from Dogtag

Opened Feb 28, 2014 by admiyo. Modified Feb 21, 2017

0.74 Normal

#24 Add support for generating EC keys

Opened Jan 27, 2014 by nalin. Modified Feb 21, 2017

0.74 Normal

#22 Certmonger aborts after unsuccessful attempt to save certificate

4

Opened Dec 4, 2013 by jcholast. Modified Feb 21, 2017

Normal

#21 Fix static analysers warnings

9

Opened Sep 19, 2013 by lslebodn. Modified Feb 16, 2021

0.75 High

#20 store-gen.c:244: Buffer out of bounds ?

2

Opened May 9, 2013 by dcb. Modified Feb 21, 2017

Normal

#17 Request a Windows-style CertificateTemplate extension using the client-supplied profile name

2

Opened Nov 9, 2012 by nalin. Modified Feb 21, 2017

0.78 Normal

#15 Record a private key's public key using PublicKeyInfo rather than just a raw public key

1

Opened Nov 8, 2012 by nalin. Modified Feb 21, 2017

Normal

#13 Add a "memo" field for certificates

2

Opened Nov 8, 2012 by nalin. Modified Feb 3, 2020

0.79 High

#10 Thread the ability to specify enrollment profiles from getcert to enrollment helpers

1

Opened Jun 13, 2012 by nalin. Modified Feb 21, 2017

Normal

#9 Add a pre-save hook

1

Opened Jun 8, 2012 by nalin. Modified Feb 21, 2017

Normal

#8 Add ability to use Dogtag interfaces directly

6

Opened Jun 2, 2012 by nkinder. Modified Feb 21, 2017

Normal

#7 Quotes not translatable

3

Opened Apr 5, 2011 by goeran. Modified Feb 21, 2017

0.41 Normal

#6 a couple of errors noticed in the "getting-started.txt" file

3

Opened Dec 19, 2009 by kashyapc. Modified Feb 21, 2017

Normal

#5 Force FIPS mode for NSS.

1

Opened Dec 2, 2009 by nalin. Modified Feb 21, 2017

Normal

#4 Build a "local" signer.

1

Opened Dec 2, 2009 by nalin. Modified Feb 21, 2017

0.78 Normal

#3 Support PIN values, directly and in named files.

2

Opened Dec 2, 2009 by nalin. Modified Feb 21, 2017

Normal

#2 Offer digests other than SHA256.

1

Opened Dec 2, 2009 by nalin. Modified Feb 21, 2017

Normal

certmonger

Issues 57 Open 102 Closed

Issues
57 Open 102 Closed