Bug 1203661 - [CRY] sslclientcert and sslclientkey not supported
Summary: [CRY] sslclientcert and sslclientkey not supported
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: dnf (Show other bugs)
(Show other bugs)
Version: 22
Hardware: x86_64 Linux
low
medium
Target Milestone: ---
Assignee: Michael Mráka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-03-19 11:28 UTC by Freddy Willemsen
Modified: 2015-06-21 00:16 UTC (History)
11 users (show)

Fixed In Version: dnf-1.0.1-2.fc22
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-06-21 00:16:28 UTC
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Freddy Willemsen 2015-03-19 11:28:37 UTC
Description of problem:
I have my own repository secured by ssl client certificate. This works like a charm using yum. I tested dnf as well but that fails.

Version-Release number of selected component (if applicable):
dnf-0.6.4

How reproducible:
Create a repository secured by client certificate using sslcacert, 
sslverify=true, sslclientcert and sslclientkey. Use dnf to fetch the repos xml files or install/update a package


Steps to Reproduce:
1. Create a repository secured by client certificate
2. Use dnf to install/update a package
3.

Actual results:
Cannot download repomd.xml

Expected results:
No errors

Additional info:

Comment 1 Honza Silhan 2015-04-03 16:36:28 UTC
Thanks for the report, DNF does not have sslclientcert and sslclientkey config option. Why do you need secure transfer using SSL? Do you need to transfer this data in privacy? You can verify metadata/packages by GPG.

Comment 2 Freddy Willemsen 2015-04-03 17:08:06 UTC
I need to transfer this data in privacy, correct (and control who gets access, more importantly). I know about the verification methods but that is not the same functionality. I don't mind using yum as it works as expected but since dnf is set to replace yum in the (near) future it would be a good thing to see the same functionality resembled.

Comment 3 Paul Clifford 2015-04-08 12:22:06 UTC
I've just encountered the same issue.  At work we package and deploy all of our software in RPMs and use SSL client certificates to control access to the repositories, so currently it's not possible to use them with dnf.  More specifically, it looks like librepo doesn't yet support client certificates.

As with Freddy it isn't breaking anything for us at the moment, but it would be nice to have client certificate support before dnf starts replacing yum by default.

Comment 4 Tomas Mlcoch 2015-04-10 13:18:15 UTC
JFYI, thanks to Paul, Librepo now supports client certs (https://github.com/Tojaj/librepo/pull/52)

Comment 5 Michael Mráka 2015-06-01 08:08:46 UTC
Has been fixed in
https://github.com/rpm-software-management/dnf/pull/273

Comment 6 Fedora Update System 2015-06-12 09:05:47 UTC
dnf-1.0.1-2.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/dnf-1.0.1-2.fc22

Comment 7 Freddy Willemsen 2015-06-12 09:38:24 UTC
Confirmed, with this latest version I can use a repository secured by client certificate. Great stuff!

Comment 8 Fedora Update System 2015-06-14 17:33:42 UTC
Package dnf-1.0.1-2.fc22:
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing dnf-1.0.1-2.fc22'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-10004/dnf-1.0.1-2.fc22
then log in and leave karma (feedback).

Comment 9 Fedora Update System 2015-06-21 00:16:28 UTC
dnf-1.0.1-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.