Bug 1203661

Summary:	[CRY] sslclientcert and sslclientkey not supported
Product:	[Fedora] Fedora	Reporter:	Freddy Willemsen <freddy>
Component:	dnf	Assignee:	Michael Mráka <mmraka>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	22	CC:	freddy, i.grok, jsilhan, mluscon, mmraka, packaging-team-maint, paul.clifford+redhat, pnemade, rholy, tim.lauridsen, tmlcoch
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	dnf-1.0.1-2.fc22	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-06-21 00:16:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Freddy Willemsen 2015-03-19 11:28:37 UTC

Description of problem:
I have my own repository secured by ssl client certificate. This works like a charm using yum. I tested dnf as well but that fails.

Version-Release number of selected component (if applicable):
dnf-0.6.4

How reproducible:
Create a repository secured by client certificate using sslcacert, 
sslverify=true, sslclientcert and sslclientkey. Use dnf to fetch the repos xml files or install/update a package


Steps to Reproduce:
1. Create a repository secured by client certificate
2. Use dnf to install/update a package
3.

Actual results:
Cannot download repomd.xml

Expected results:
No errors

Additional info:

Comment 1 Honza Silhan 2015-04-03 16:36:28 UTC

Thanks for the report, DNF does not have sslclientcert and sslclientkey config option. Why do you need secure transfer using SSL? Do you need to transfer this data in privacy? You can verify metadata/packages by GPG.

Comment 2 Freddy Willemsen 2015-04-03 17:08:06 UTC

I need to transfer this data in privacy, correct (and control who gets access, more importantly). I know about the verification methods but that is not the same functionality. I don't mind using yum as it works as expected but since dnf is set to replace yum in the (near) future it would be a good thing to see the same functionality resembled.

Comment 3 Paul Clifford 2015-04-08 12:22:06 UTC

I've just encountered the same issue.  At work we package and deploy all of our software in RPMs and use SSL client certificates to control access to the repositories, so currently it's not possible to use them with dnf.  More specifically, it looks like librepo doesn't yet support client certificates.

As with Freddy it isn't breaking anything for us at the moment, but it would be nice to have client certificate support before dnf starts replacing yum by default.

Comment 4 Tomas Mlcoch 2015-04-10 13:18:15 UTC

JFYI, thanks to Paul, Librepo now supports client certs (https://github.com/Tojaj/librepo/pull/52)

Comment 5 Michael Mráka 2015-06-01 08:08:46 UTC

Has been fixed in
https://github.com/rpm-software-management/dnf/pull/273

Comment 6 Fedora Update System 2015-06-12 09:05:47 UTC

dnf-1.0.1-2.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/dnf-1.0.1-2.fc22

Comment 7 Freddy Willemsen 2015-06-12 09:38:24 UTC

Confirmed, with this latest version I can use a repository secured by client certificate. Great stuff!

Comment 8 Fedora Update System 2015-06-14 17:33:42 UTC

Package dnf-1.0.1-2.fc22:
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing dnf-1.0.1-2.fc22'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-10004/dnf-1.0.1-2.fc22
then log in and leave karma (feedback).

Comment 9 Fedora Update System 2015-06-21 00:16:28 UTC

dnf-1.0.1-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.