Red Hat Bugzilla – Bug 1203661
[CRY] sslclientcert and sslclientkey not supported
Last modified: 2015-06-20 20:16:28 EDT
Description of problem:
I have my own repository secured by ssl client certificate. This works like a charm using yum. I tested dnf as well but that fails.
Version-Release number of selected component (if applicable):
Create a repository secured by client certificate using sslcacert,
sslverify=true, sslclientcert and sslclientkey. Use dnf to fetch the repos xml files or install/update a package
Steps to Reproduce:
1. Create a repository secured by client certificate
2. Use dnf to install/update a package
Cannot download repomd.xml
Thanks for the report, DNF does not have sslclientcert and sslclientkey config option. Why do you need secure transfer using SSL? Do you need to transfer this data in privacy? You can verify metadata/packages by GPG.
I need to transfer this data in privacy, correct (and control who gets access, more importantly). I know about the verification methods but that is not the same functionality. I don't mind using yum as it works as expected but since dnf is set to replace yum in the (near) future it would be a good thing to see the same functionality resembled.
I've just encountered the same issue. At work we package and deploy all of our software in RPMs and use SSL client certificates to control access to the repositories, so currently it's not possible to use them with dnf. More specifically, it looks like librepo doesn't yet support client certificates.
As with Freddy it isn't breaking anything for us at the moment, but it would be nice to have client certificate support before dnf starts replacing yum by default.
JFYI, thanks to Paul, Librepo now supports client certs (https://github.com/Tojaj/librepo/pull/52)
Has been fixed in
dnf-1.0.1-2.fc22 has been submitted as an update for Fedora 22.
Confirmed, with this latest version I can use a repository secured by client certificate. Great stuff!
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing dnf-1.0.1-2.fc22'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
dnf-1.0.1-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.