| Summary: | Profile caIPAserviceCert Not Found | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Dmitri Pal <dpal> |
| Component: | ipa | Assignee: | Rob Crittenden <rcritten> |
| Status: | CLOSED ERRATA | QA Contact: | Chandrasekar Kannan <ckannan> |
| Severity: | urgent | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.1 | CC: | awnuk, benl, jgalipea, rcritten, syeghiay |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-2.0.0-12.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 675742 | Environment: | |
| Last Closed: | 2011-05-19 13:44:26 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 675742 | ||
| Bug Blocks: | |||
|
Description
Dmitri Pal
2011-02-07 18:44:13 UTC
IPA installer modifies caIPAserviceCert profile by adding instance specific names for example:
policyset.serverCertSet.1.default.params.name=
CN=$request.req_subject_name.cn$, O=SJC.REDHAT.COM
or
policyset.serverCertSet.9.default.params.crlDistPointsPointName_0=
https://works4me.sjc.redhat.com/ipa/crl/MasterCRL.bin
Above modification are also causing change of file ownership from
-rw-rw----. 1 pkiuser pkiuser 6215 Feb 1 14:04 caIPAserviceCert.cfg
to
-rw-rw----. 1 root root 6215 Feb 1 14:04 caIPAserviceCert.cfg
IPA installer after profile update should run command like
"chown pkiuser:pkiuser caIPAserviceCert.cfg"
to recover original file ownership.
Note that user and group names have to synchronized with parameters used by pkicreate.
pkicreate -pki_instance_root=/var/lib \
-pki_instance_name=pki-ca \
-subsystem_type=ca \
-agent_secure_port=9443 \
-ee_secure_port=9444 \
-ee_secure_client_auth_port=9446 \
-admin_secure_port=9445 \
-unsecure_port=9180 \
-tomcat_server_port=9701 \
-user=pkiuser \
-group=pkiuser \
-redirect conf=/etc/pki-ca \
-redirect logs=/var/log/pki-ca \
-verbose
I think dogtag should raise an appropriate error message when a file cannot be opened for reading. fixed in IPA in commit 95b0563817c20bd7d7d82719d8baf8eac2bc9098 verified: # ls -al /var/lib/pki-ca/profiles/ca/caIPAserviceCert.cfg -rw-rw----. 1 pkiuser pkiuser 6217 Mar 11 11:39 /var/lib/pki-ca/profiles/ca/caIPAserviceCert.cfg Version: ipa-server-2.0.0-13.el6.x86_64 An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHEA-2011-0631.html |