Incorrect trust flags in NSSDB when renewing subsystem certificates

[travis armstrong]

OS: ubuntu 18.04
Dogtag: 10.6.0

When renewing subsystem certificates in dogtag (by following the process described here: https://www.dogtagpki.org/wiki/System_Certificate_Renewal), OCSP will break due to incorrect trust flags in NSS.

The certificate IDs are:

'ocsp_signing' (gets 'u,u,u' should get 'CTu,Cu,Cu')
'ocsp_audit_signing' (gets 'u,u,u' should get 'u,u,Pu')
'ca_audit_signing' (gets 'u,u,u' should get 'u,u,Pu')

To fix this certutil must be executed to correct them.

In case anyone else finds this bugreport and need an emergency fix,

certutil -M -t 'CTU,Cu,Cu' -d 'sql:/etc/pki/pki-tomcat/alias' -n 'ocspSigningCert cert-pki-tomcat OCSP'

certutil -M -t 'u,u,Pu' -d 'sql:/etc/pki/pki-tomcat/alias' -n 'auditSigningCert cert-pki-tomcat OCSP'

certutil -M -t 'u,u,Pu' -d 'sql:/etc/pki/pki-tomcat/alias' -n 'auditSigningCert cert-pki-tomcat CA'

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.