Bug 1919282
| Summary: | ACME cert enrollment failed with HTTP 500 | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Mohammad Rizwan <myusuf> | ||||
| Component: | pki-core | Assignee: | Endi Sukma Dewata <edewata> | ||||
| Status: | CLOSED ERRATA | QA Contact: | PKI QE <bugzilla-pkiqe> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 8.4 | CC: | aakkiang, edewata, mharmsen, pasik, rcritten, tscherf | ||||
| Target Milestone: | rc | ||||||
| Target Release: | 8.0 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | pki-core-10.6-8040020210209003343.d4d99205 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2021-05-18 15:25:16 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Mohammad Rizwan
2021-01-22 14:07:17 UTC
Created attachment 1749794 [details]
letsencrypt.log
version:
ipa-client-4.9.0-1.module+el8.4.0+9275+6e05eb02.x86_64
ipa-server-4.9.0-1.module+el8.4.0+9274+259c83ee.x86_64
version: pki-acme-10.10.3-1.module+el8.4.0+9456+88377f87.noarch Rob have raised a PR to test Endi's copr build here: https://github.com/freeipa/freeipa/pull/5464 This PR also replicates "acme.errors.ClientError: <Response [500]>" error. Re-assigning to the PKI team for evaluation since the ACME service is raising a 500 to the request. If this indeed an unauthorized request it should return a 401 I think. I'm also unclear why the request is unauthorized as registration was successful. The topology is a single IPA server and client. The error was coming from the CA. Could you provide the CA debug log and the ACME's issuer.conf? When was the last time ACME was tested to work in IPA (using the @pki/master COPR repo instead of mine)? Just to clarify, my COPR repo contains the build for this PR: https://github.com/dogtagpki/pki/pull/3435 which is meant to fix the load balancing issue between multiple IPA servers. If this problem is happening with a single IPA server using the @pki/master repo, that would be a different issue. Please also note that we now have a CI test that validates ACME using certbot: https://github.com/dogtagpki/pki/blob/master/.github/workflows/acme-tests.yml This bug is against the current compose for RHEL 8.4. The upstream test seems to be failing in a similar way and was included only for reference. Apparently IPA is using acmeIPAServerCert profile (which is defined in IPA) which requires profile auth, and the profile auth in ACME fails due to a regression. ACME in PKI has been tested using acmeServerCert profile which uses REST auth instead of profile auth so doesn't have this problem. The following PR should fix the regression and add a CI test for ACME in IPA: https://github.com/dogtagpki/pki/pull/3445 Please file a separate ticket for the load balancing issue. Thanks. Fixed upstream: * main branch (PKI 10.11): https://github.com/dogtagpki/pki/commit/3bf3fccfb96f83e777c9f96b7a6d7cdaadfe20cc * v10.10 branch: https://github.com/dogtagpki/pki/commit/8b769282ad5354cddfba04cf38bf2233e370dc57 COPR builds are available here: * https://copr.fedorainfracloud.org/coprs/g/pki/master/builds/ * https://copr.fedorainfracloud.org/coprs/g/pki/10.10/builds/ version: pki-acme-10.10.4-1.module+el8.4.0+9861+7cddd5b6.noarch using : http://download.devel.redhat.com/rhel-8/nightly/RHEL-8/RHEL-8.4.0-20210211.n.0/compose/AppStream/x86_64/os/ [root@client1 ~]# certbot --server https://ipa-ca.testrelm.test/acme/directory register -m myusuf --agree-tos Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: y Account registered. [root@client1 ~]# [root@client1 ~]# [root@client1 ~]# [root@client1 ~]# certbot --server https://ipa-ca.testrelm.test/acme/directory certonly --domain `hostname` --standalone Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator standalone, Installer None Requesting a certificate for client1.testrelm.test Performing the following challenges: http-01 challenge for client1.testrelm.test Waiting for verification... Cleaning up challenges Subscribe to the EFF mailing list (email: myusuf). We were unable to subscribe you the EFF mailing list because your e-mail address appears to be invalid. You can try again later by visiting https://act.eff.org. IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at: /etc/letsencrypt/live/client1.testrelm.test/fullchain.pem Your key file has been saved at: /etc/letsencrypt/live/client1.testrelm.test/privkey.pem Your certificate will expire on 2021-05-12. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le [root@client1 ~]# [root@client1 ~]# openssl x509 -text -in /etc/letsencrypt/live/client1.testrelm.test/fullchain.pem Certificate: Data: Version: 3 (0x2) Serial Number: 11 (0xb) Signature Algorithm: sha256WithRSAEncryption Issuer: O = TESTRELM.TEST, CN = Certificate Authority Validity Not Before: Feb 11 07:30:16 2021 GMT Not After : May 12 06:30:16 2021 GMT Subject: CN = client1.testrelm.test Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:d6:8f:d0:03:3b:81:80:53:cd:ee:9b:b5:5d:38: 4a:8c:de:3d:eb:18:9f:0c:c9:2e:ea:3d:3d:1a:39: b1:a3:df:0f:1f:37:d4:ab:a9:44:68:59:1a:70:bb: e2:da:1f:a7:57:a2:f0:40:27:14:60:a9:eb:03:29: 68:64:02:c0:b8:a2:90:1d:06:0e:05:a9:b2:80:1e: dd:b4:58:be:c7:a2:8c:aa:a6:c8:c6:e7:3c:92:38: 82:33:4d:4e:56:39:eb:eb:42:0e:a4:f3:c6:9c:0f: d1:62:3f:9f:63:48:f4:aa:4e:73:62:51:0a:ae:2d: e5:44:14:e8:08:18:9b:f6:05:e1:af:f6:a2:0c:a3: 4a:0c:a5:b7:95:7c:0d:27:6b:68:bc:92:05:06:ba: 4d:07:f9:37:d9:6c:ea:a2:45:d4:c5:5d:02:4b:b7: e9:8f:fc:27:c3:ae:e1:6c:fd:03:99:cb:68:28:b0: 76:63:96:32:4a:fc:89:9e:bc:6a:98:24:d2:9b:08: 19:6e:a5:f2:2b:9e:0d:7c:4b:1c:6b:c4:b8:17:98: 4d:8d:7f:cd:c6:c5:8a:55:b1:4d:2a:c9:c5:29:92: 95:2a:43:58:37:66:5d:65:bf:9d:4e:f7:98:ae:a0: 32:6d:a9:10:7d:54:6e:8f:42:f5:5a:f1:18:f1:7b: 73:21 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Subject Key Identifier: 13:31:48:45:C2:7F:FE:D7:65:65:63:09:37:9C:85:5F:02:FA:3C:37 X509v3 Authority Key Identifier: keyid:04:B4:A0:1D:DF:56:E2:4F:4F:A9:B2:BE:2F:D5:19:0C:3E:FE:7D:84 Authority Information Access: OCSP - URI:http://ipa-ca.testrelm.test/ca/ocsp X509v3 Subject Alternative Name: DNS:client1.testrelm.test X509v3 CRL Distribution Points: Full Name: URI:http://ipa-ca.testrelm.test/ipa/crl/MasterCRL.bin CRL Issuer: DirName:O = ipaca, CN = Certificate Authority Signature Algorithm: sha256WithRSAEncryption 70:03:23:56:41:38:77:83:37:10:7b:ba:00:49:f4:be:5c:00: 32:79:d9:2c:44:a4:27:c5:da:07:63:e9:18:ce:b6:b6:19:55: 41:6d:fc:9b:09:bb:dd:35:6f:9e:e3:89:2a:db:0e:3c:98:78: 94:92:c2:46:ed:52:a0:12:79:00:d0:56:59:32:b1:06:ef:e6: d0:de:ef:82:7e:a1:50:90:b3:fc:3b:e4:17:9e:c4:c1:7f:48: fe:ce:5c:5f:2d:62:6e:98:13:ed:0e:00:4e:72:ef:cd:56:e9: 74:c4:89:36:1f:0e:4e:76:7c:3c:71:07:44:a6:f6:07:9a:e7: 7a:48:cb:52:49:51:b2:19:0f:be:2b:dd:4a:d0:2a:f1:5d:6c: ff:eb:82:1c:c0:ab:19:94:cc:0f:5f:db:aa:bd:29:2a:29:ba: bd:84:d9:32:89:08:f6:34:ef:08:9f:a4:4a:81:10:08:a8:fc: fb:9d:04:af:b4:70:94:d4:6f:ad:8f:60:91:21:d1:05:b2:ad: 80:b1:77:24:5b:3d:7f:12:85:7f:d4:dd:57:38:2f:dd:bf:a7: 31:33:6d:02:dc:b2:0c:ab:21:7a:50:6d:01:d7:92:97:b8:41: 16:6f:ef:ed:ff:3b:1e:dd:bf:d0:69:b1:37:cb:da:d6:c1:be: 89:3b:94:7a:61:28:f2:72:13:6c:09:3e:89:fe:a7:e0:5c:3a: fd:f2:a6:d8:7e:89:1b:88:77:14:dc:57:09:fd:24:bb:07:dc: 6e:8e:af:43:1b:e5:e6:f7:eb:ff:39:77:5c:17:6e:4f:10:84: 6d:15:dd:4a:89:05:55:dd:d4:01:4a:65:25:4a:16:51:e1:e7: 4b:5b:4a:6c:43:be:e7:35:da:9f:70:5d:0f:e4:84:63:34:e3: ec:49:93:06:36:9f:27:37:65:e5:a7:44:60:13:9f:b3:fd:a4: 45:8e:d6:66:88:2d:6c:33:39:78:0c:4b:dd:ee:a6:56:4c:82: 6b:b7:cb:b3:ad:da -----BEGIN CERTIFICATE----- MIIEpTCCAw2gAwIBAgIBCzANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKDA1URVNU UkVMTS5URVNUMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMjEw MjExMDczMDE2WhcNMjEwNTEyMDYzMDE2WjAgMR4wHAYDVQQDDBVjbGllbnQxLnRl c3RyZWxtLnRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDWj9AD O4GAU83um7VdOEqM3j3rGJ8MyS7qPT0aObGj3w8fN9SrqURoWRpwu+LaH6dXovBA JxRgqesDKWhkAsC4opAdBg4FqbKAHt20WL7HooyqpsjG5zySOIIzTU5WOevrQg6k 88acD9FiP59jSPSqTnNiUQquLeVEFOgIGJv2BeGv9qIMo0oMpbeVfA0na2i8kgUG uk0H+TfZbOqiRdTFXQJLt+mP/CfDruFs/QOZy2gosHZjljJK/ImevGqYJNKbCBlu pfIrng18SxxrxLgXmE2Nf83GxYpVsU0qycUpkpUqQ1g3Zl1lv51O95iuoDJtqRB9 VG6PQvVa8Rjxe3MhAgMBAAGjggFQMIIBTDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQTMUhFwn/+12VlYwk3 nIVfAvo8NzAfBgNVHSMEGDAWgBQEtKAd31biT0+psr4v1RkMPv59hDA/BggrBgEF BQcBAQQzMDEwLwYIKwYBBQUHMAGGI2h0dHA6Ly9pcGEtY2EudGVzdHJlbG0udGVz dC9jYS9vY3NwMCAGA1UdEQQZMBeCFWNsaWVudDEudGVzdHJlbG0udGVzdDB4BgNV HR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlc3RyZWxtLnRlc3QvaXBhL2Ny bC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwV Q2VydGlmaWNhdGUgQXV0aG9yaXR5MA0GCSqGSIb3DQEBCwUAA4IBgQBwAyNWQTh3 gzcQe7oASfS+XAAyedksRKQnxdoHY+kYzra2GVVBbfybCbvdNW+e44kq2w48mHiU ksJG7VKgEnkA0FZZMrEG7+bQ3u+CfqFQkLP8O+QXnsTBf0j+zlxfLWJumBPtDgBO cu/NVul0xIk2Hw5Odnw8cQdEpvYHmud6SMtSSVGyGQ++K91K0CrxXWz/64IcwKsZ lMwPX9uqvSkqKbq9hNkyiQj2NO8In6RKgRAIqPz7nQSvtHCU1G+tj2CRIdEFsq2A sXckWz1/EoV/1N1XOC/dv6cxM20C3LIMqyF6UG0B15KXuEEWb+/t/zse3b/QabE3 y9rWwb6JO5R6YSjychNsCT6J/qfgXDr98qbYfokbiHcU3FcJ/SS7B9xujq9DG+Xm 9+v/OXdcF25PEIRtFd1KiQVV3dQBSmUlShZR4edLW0psQ77nNdqfcF0P5IRjNOPs SZMGNp8nN2Xlp0RgE5+z/aRFjtZmiC1sMzl4DEvd7qZWTIJrt8uzrdo= -----END CERTIFICATE----- Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:1775 |