Bug 952241
| Summary: | ipa cert automatic renew: wrong trust argument assigned to renewed certs | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Martin Kosek <mkosek> | ||||
| Component: | ipa | Assignee: | Martin Kosek <mkosek> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | 6.5 | CC: | dpal, emaldona, mkosek, nalin, nsoman, yzhang | ||||
| Target Milestone: | rc | Keywords: | ZStream | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | ipa-3.0.0-30.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: |
Cause: When an Identity Management PKI server certificate (auditSigningCert) was being renewed, wrong trust argument were assigned to the renewed cert.
Consequence: Identity Management PKI server was unable to use the renewed certificate.
Fix: Certificate renewal procedure was updated to assign correct trust arguments to the renewed certificate.
Result: Identity Management PKI certificate renewal does not fail.
|
Story Points: | --- | ||||
| Clone Of: | 918335 | Environment: | |||||
| Last Closed: | 2013-11-21 20:53:12 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 918335 | ||||||
| Bug Blocks: | 964130 | ||||||
| Attachments: |
|
||||||
|
Description
Martin Kosek
2013-04-15 13:04:18 UTC
Created attachment 738464 [details]
Patch fixing the issue
Moving to POST. Verified using ipa-server-3.0.0-35 Pasting snippets from test run: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: wrong trust argument assigned to renewed certs bz964130 6.5 bz 952241 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ PASS ] :: Uninstalling ipa server for next test (Expected 0, got 0) :: [ PASS ] :: Making sure that /etc/sssd/sssd.conf does not exist. BZ 819982 (Expected 2, got 2) :: [ PASS ] :: Setting to current system time (Expected 0, got 0) :: [ PASS ] :: IPA server install with DNS (Expected 0, got 0) ============ (Trust attributes before renewal) =============== certutil -L -d /var/lib/pki-ca/alias and /etc/httpd/alias/ for each cert Server-Cert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u ipaCert u,u,u Signing-Cert u,u,u Server-Cert u,u,u ======= report date [Wed Sep 11 20:08:13 EDT 2013] ========= :: [ PASS ] :: stop certmonger service before stop ipa server (Expected 0, got 0) :: [ PASS ] :: stop ipa server Success :: [ PASS ] :: Running 'echo "Current date and time: Wed Sep 11 20:09:14 EDT 2013"' (Expected 0, got 0) Tue Sep 1 00:01:47 EDT 2015 :: [ PASS ] :: Date reset to 1 day before certificate expiry (Expected 0, got 0) New date and time: Tue Sep 1 00:01:47 EDT 2015 :: [ PASS ] :: Running 'echo "New date and time: Tue Sep 1 00:01:47 EDT 2015"' (Expected 0, got 0) :: [ PASS ] :: start ipa server Success Starting certmonger: [ OK ] :: [ PASS ] :: start certmonger service after ipa server started (Expected 0, got 0) :: [ PASS ] :: New Expiry date for Server-Cert (Expected 0, got 0) :: [ PASS ] :: Server-Cert is renewed Not After : Mon Aug 21 04:03:18 2017 :: [ PASS ] :: New Expiry date for auditSigningCert (Expected 0, got 0) :: [ PASS ] :: auditSigningCert is renewed Not After : Mon Aug 21 04:02:18 2017 :: [ PASS ] :: New Expiry date for ocspSigningCert (Expected 0, got 0) :: [ PASS ] :: ocspSigningCert is renewed Not After : Mon Aug 21 04:02:18 2017 :: [ PASS ] :: New Expiry date for subsystemCert (Expected 0, got 0) :: [ PASS ] :: subsystemCert is renewed Not After : Mon Aug 21 04:02:18 2017 :: [ PASS ] :: New Expiry date for ipaCert (Expected 0, got 0) :: [ PASS ] :: ipaCert is renewed Not After : Tue Sep 12 00:07:28 2017 :: [ PASS ] :: New Expiry date for Signing-Cert (Expected 0, got 0) :: [ PASS ] :: Signing-Cert is renewed Not After : Fri Sep 01 04:02:22 2017 :: [ PASS ] :: New Expiry date for Server-Cert (Expected 0, got 0) :: [ PASS ] :: Server-Cert is renewed ============ (Trust attributes after renewal) =============== certutil -L -d /var/lib/pki-ca/alias and /etc/httpd/alias/ for each cert Server-Cert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u ipaCert u,u,u Signing-Cert u,u,u Server-Cert u,u,u ======= report date [Tue Sep 1 00:05:30 EDT 2015] ========= :: [ PASS ] :: Files /tmp/tmp.64WVaAEBor/before_renewal.txt and /tmp/tmp.64WVaAEBor/after_renewal.txt should not differ :: [ PASS ] :: BZ964130 not found. Trusts attibutes are not changed after renewal Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1651.html |