Bug 1203661 - [CRY] sslclientcert and sslclientkey not supported
Summary: [CRY] sslclientcert and sslclientkey not supported
Alias: None
Product: Fedora
Classification: Fedora
Component: dnf
Version: 22
Hardware: x86_64
OS: Linux
Target Milestone: ---
Assignee: Michael Mráka
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2015-03-19 11:28 UTC by Freddy Willemsen
Modified: 2015-06-21 00:16 UTC (History)
11 users (show)

Fixed In Version: dnf-1.0.1-2.fc22
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-06-21 00:16:28 UTC
Type: Bug

Attachments (Terms of Use)

Description Freddy Willemsen 2015-03-19 11:28:37 UTC
Description of problem:
I have my own repository secured by ssl client certificate. This works like a charm using yum. I tested dnf as well but that fails.

Version-Release number of selected component (if applicable):

How reproducible:
Create a repository secured by client certificate using sslcacert, 
sslverify=true, sslclientcert and sslclientkey. Use dnf to fetch the repos xml files or install/update a package

Steps to Reproduce:
1. Create a repository secured by client certificate
2. Use dnf to install/update a package

Actual results:
Cannot download repomd.xml

Expected results:
No errors

Additional info:

Comment 1 Honza Silhan 2015-04-03 16:36:28 UTC
Thanks for the report, DNF does not have sslclientcert and sslclientkey config option. Why do you need secure transfer using SSL? Do you need to transfer this data in privacy? You can verify metadata/packages by GPG.

Comment 2 Freddy Willemsen 2015-04-03 17:08:06 UTC
I need to transfer this data in privacy, correct (and control who gets access, more importantly). I know about the verification methods but that is not the same functionality. I don't mind using yum as it works as expected but since dnf is set to replace yum in the (near) future it would be a good thing to see the same functionality resembled.

Comment 3 Paul Clifford 2015-04-08 12:22:06 UTC
I've just encountered the same issue.  At work we package and deploy all of our software in RPMs and use SSL client certificates to control access to the repositories, so currently it's not possible to use them with dnf.  More specifically, it looks like librepo doesn't yet support client certificates.

As with Freddy it isn't breaking anything for us at the moment, but it would be nice to have client certificate support before dnf starts replacing yum by default.

Comment 4 Tomas Mlcoch 2015-04-10 13:18:15 UTC
JFYI, thanks to Paul, Librepo now supports client certs (https://github.com/Tojaj/librepo/pull/52)

Comment 5 Michael Mráka 2015-06-01 08:08:46 UTC
Has been fixed in

Comment 6 Fedora Update System 2015-06-12 09:05:47 UTC
dnf-1.0.1-2.fc22 has been submitted as an update for Fedora 22.

Comment 7 Freddy Willemsen 2015-06-12 09:38:24 UTC
Confirmed, with this latest version I can use a repository secured by client certificate. Great stuff!

Comment 8 Fedora Update System 2015-06-14 17:33:42 UTC
Package dnf-1.0.1-2.fc22:
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing dnf-1.0.1-2.fc22'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).

Comment 9 Fedora Update System 2015-06-21 00:16:28 UTC
dnf-1.0.1-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.