Repository: privacyidea/privacyidea

Issue:
Can't revoke certificate token
<!--
Thank you for filing a bug within privacyIDEA.
Please read the following blog post.
https://www.privacyidea.org/getting-help/

The more information you provide, the easier it is to identify 
the problem!

Issues are not meant for asking questions!
If you simply wonder how things work and need some explanation 
please visit the community forum:

https://community.privacyidea.org

If you do not like the NO-WARRANTY of this software and need
reliable, professional help, please consider getting either
- consultancy 
  (https://netknights.it/en/leistungen/one-time-services/)
- or the privacyIDEA Enterprise Edition 
  (https://netknights.it/en/leistungen/service-level-agreements/)

If you still think, you should open an issue, please do so:
-->

# What did you try to do?

I can't revoke certificate token. 

# What outcome did you expect?

Revoke the certificate token with Openssl commands.

# What outcome did you experience?

When clicking on "revoke" button, an alert message is displayed on the screen : 
"ERR503: Using configuration from /etc/privacyidea/certificates/openssl.cnf Can't open 41.pem for reading, No such file or directory 139669700621312:error:02001002:system library:fopen:No such file or directory:crypto/bio/bss_file.c:72:fopen('41.pem','r') 139669700621312:error:2006D080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:79: unable to load certificate "

# Configuration

* privacyIDEA Version: 2.23.3

* Installation method:
  (from source, github, virtualenv, ubuntu packages...)
Privacyidea-nginx using commande : "apt-get install privacyidea-nginx"

## more details: 

* OS: Ubuntu 18

* Webserver: Nginx

* Tokendatabase: (like MySQL, PostgreSQL, ...) : MySQL


# Log file

**Turn on debug level and take a look at the privacyidea.log!**
**If appropriate, attach the log file.**

## Correction 

I corrected the file privacyidea/lib/caconnectors/localca.py to get the path to certificates directory from configuration and then revoke the certificate. 
It works fine like that : 


```
cd ./privacyidea/lib/caconnectors
diff localca.py localcaORI.py
507c507
<         # Custom dev : Bug detected, path to certificate was not mentioned.
---
>
510c510
<                                certificate=self.config.get(ATTR.CERT_DIR)+'/'+filename,
---
>                                certificate=filename,
```





Discussion:
Interesting, @Voyrx 

Could it be that you have different "WorkingDir" and "CertificateDir" in your configuration?
We probably had the same directory and thus did not stumble over this.
Hello M. Kolbel,

Yes exactly.

I did have different working directory and certificates directory.

I pushed a pull request with the correction, I may have done this a little bit "ugly", it took also the code for #1511 ticket 🙁 , sorry.
________________________________
De : Cornelius Kölbel <notifications@github.com>
Envoyé : mardi 19 mars 2019 17:04
À : privacyidea/privacyidea
Cc : Tarek EL ALLAM; Mention
Objet : Re: [privacyidea/privacyidea] Can't revoke certificate token (#1510)


Interesting, @Voyrx<https://github.com/Voyrx>

Could it be that you have different "WorkingDir" and "CertificateDir" in your configuration?
We probably had the same directory and thus did not stumble over this.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub<https://github.com/privacyidea/privacyidea/issues/1510#issuecomment-474445056>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AuduUhChnL5fOxCkv2luoKg-ZwXl9S2eks5vYQqXgaJpZM4b8LeE>.


Resolving patch:
diff --git a/privacyidea/lib/caconnectors/localca.py b/privacyidea/lib/caconnectors/localca.py
--- a/privacyidea/lib/caconnectors/localca.py
+++ b/privacyidea/lib/caconnectors/localca.py
@@ -502,10 +502,9 @@ def revoke_cert(self, certificate, reason=CRL_REASONS[0]):
         serial = cert_obj.get_serial_number()
         serial_hex = int_to_hex(serial)
         filename = serial_hex + ".pem"
-
         cmd = CA_REVOKE.format(cakey=self.cakey, cacert=self.cacert,
                                config=self.config.get(ATTR.OPENSSL_CNF),
-                               certificate=filename,
+                               certificate="/".join(p for p in [self.config.get(ATTR.CERT_DIR), filename] if p),
                                reason=reason)
         workingdir = self.config.get(ATTR.WORKING_DIR)
         args = shlex.split(cmd)


Test patch: