| Summary: | Errors from AD when trying to sign ipa.csr, conflicting template on | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Amy Farley <afarley> | ||||
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Sudhir Menon <sumenon> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 7.2 | CC: | aheverle, dkupka, eric.onspaugh.ap, gparente, ipa-qe, jcholast, mkosek, nsoman, pvoborni, rcritten, tscherf | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | ipa-4.5.0-12.el7 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2017-08-01 09:37:23 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1396494, 1399979 | ||||||
| Attachments: |
|
||||||
|
Comment 2
Jan Cholasta
2016-04-06 08:52:49 UTC
Alternative workaround would be to manually create an AD-compatible CSR: # echo -e -n '\x1E\x0A\x00\x53\x00\x75\x00\x62\x00\x43\x00\x41' >ext-value # certutil -R -d /etc/pki/pki-tomcat/alias -f <(grep -Po '(?<=internal=).*' /etc/pki/pki-tomcat/password.conf) -k 'caSigningCert cert-pki-ca' --extGeneric=1.3.6.1.4.1.311.20.2:not-critical:ext-value -o ipa.csr -a Upstream ticket: https://fedorahosted.org/freeipa/ticket/5799 From Thorsten: The issue reported by the customer (CA installed on replica is always configured as renewal master) has been fixed with this errata: https://access.redhat.com/errata/RHBA-2016:1256 In c#225 the customer mentioned, that they do their installs using a RHEL-7.2 DVD image. The fix has been released for RHEL-7.3 and as an async update for RHEL-7.2.z. It's not part of RHEL-7.2 GA release though. This means, they need to install at least the following package to get rid of the issue: ipa-4.2.0-15.el7_2.17. (or later). See this BZ for details: CA installed on replica is always marked as renewal master https://bugzilla.redhat.com/show_bug.cgi?id=1339304 From customer: That bugzilla does appear to describe the behavior. As both projects (using 7.1 and 7.2 respectively) are in a phase where package updates are not possible, is running "ipa-csreplica-manage set-renewal-master" on the master a viable workaround? It has corrected the LDAP entries every time I've run it, and the CS.cfg files on the master and replica already appear to be okay. Are there any other parts related to this that were fixed that require the updated packages? Fixed upstream master: https://pagure.io/freeipa/c/ce9eefe53b398b73f956df420ea8694b90e24f76 https://pagure.io/freeipa/c/5abd9bb99680df45b6cd87de3b08466d612344bb https://pagure.io/freeipa/c/09a49ad45846e3c2e76c5a035a27d0fa95b347b9 https://pagure.io/freeipa/c/25aeeaf46dd92e06f14de83459ab9be8ab846922 https://pagure.io/freeipa/c/0bf41e804e89937fc72502cfbe1363dd7591675e https://pagure.io/freeipa/c/21f4cbf8da8091b898fc8032fff65e821223d042 https://pagure.io/freeipa/c/b03ede87963bc5933691c9e3f88768e1bf92736f ipa-4-5: https://pagure.io/freeipa/c/36fc44b90ceb9e98abd93a3abb1e5b8d18df6ff0 https://pagure.io/freeipa/c/b55dd9cee5c2161002f56c63d7e0ae86e792fbbd https://pagure.io/freeipa/c/4a01114f1e49fd73e88e2d9f1512a11cbab0176e https://pagure.io/freeipa/c/920d56a8f0321c4b092da6c173961c82aa1d6bd3 https://pagure.io/freeipa/c/25b0a9cf6c60c709cacb74ad188cd6e91d4b60ea https://pagure.io/freeipa/c/bb952827b84d7b47ffd77549b3a7c9da2fe537ae https://pagure.io/freeipa/c/c56d12aeaccb455a193271a31362b7412b2d2e60 Upstream ticket: https://pagure.io/freeipa/issue/6950 Fixed upstream master: https://pagure.io/freeipa/c/d9ed2573fd5b4dcdc8ea865f16d81325707e0f9d ipa-4-5: https://pagure.io/freeipa/c/752e167497eca87632261dec7bbb352cd0e599c8 Verified on RHEL7.4 using ipa-server-4.5.0-11.el7.x86_64 sssd-1.15.2-29.el7.x86_64 krb5-server-1.15.1-8.el7.x86_64 selinux-policy-3.13.1-148.el7.noarch pki-ca-10.4.1-4.el7.noarch Attaching the steps used for verification. Created attachment 1279705 [details]
Verification Steps
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2304 |