Bug 1810149
| Summary: | ipa-server-certinstall of IPA-issued certificate will fail | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Rob Crittenden <rcritten> |
| Component: | ipa | Assignee: | Florence Blanc-Renaud <frenaud> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | --- | CC: | hgcoin, pasik, pcech, rcritten, sorlov, ssidhaye, tscherf, twoerner |
| Target Milestone: | rc | Keywords: | TestCaseProvided, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.9.0-1 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-09 18:21:19 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Rob Crittenden
2020-03-04 15:46:56 UTC
This is seen when replacing a certificate with one issued by IPA. The call to fix is in ipaserver/install/ipa_server_certinstall.py before the add_subject call. The typical usage is: subject = str(DN(cert.subject)) Rob,
Thanks.
This patch corrects the error above.
--- a/ipaserver/install/ipa_server_certinstall.py
+++ b/ipaserver/install/ipa_server_certinstall.py
@@ -170,7 +170,7 @@
if req_id is not None:
certmonger.add_principal(
req_id, 'HTTP/{host}'.format(host=api.env.host))
- certmonger.add_subject(req_id, cert.subject)
+ certmonger.add_subject(req_id, str(DN(cert.subject)))
def replace_kdc_cert(self):
# pass in `realm` to perform `NSSDatabase.verify_kdc_cert_validity()`
Upstream ticket: https://pagure.io/freeipa/issue/8204 Fixed upstream.
master:
040d48f ipatests: test ipa_server_certinstall with an IPA-issued cert
f249c51 Set the certmonger subject with a string, not an object
ipa-4-8:
099ab6c ipatests: test ipa_server_certinstall with an IPA-issued cert
2a5a2a0 Set the certmonger subject with a string, not an object
Verified using latest nightly compose with ipa-server-4.9.5-1.module+el8.5.0+11410+91a33fe4.x86_64 Upstream test suite test_installation.py is broken in RHEL8.5, thus verifyed by manually executing steps from test_installation.py::TestInstallCA::test_cert_install_with_IPA_issued_cert: # ipa-server-install -a Secret123 -p Secret123 -n testrelm.test -U -r TESTRELM.TEST ... The ipa-server-install command was successful # cp -p /var/lib/ipa/certs/httpd.crt /tmp/ # cp -p /var/lib/ipa/private/httpd.key /tmp/ # export PASSWD="/var/lib/ipa/passwds/`hostname`-443-RSA" # export PASSWD_STR=`cat $PASSWD` # ipa-server-certinstall -p Secret123 -w --pin "$PASSWD" /tmp/httpd.crt /tmp/httpd.key Please restart ipa services after installing certificate (ipactl restart) The ipa-server-certinstall command was successful # echo $? 0 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (ipa bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:4230 |