Bug 1257074

Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/43ee695195c2024c2875663f7bc1d9c3c291865d
https://fedorahosted.org/freeipa/changeset/e9a76c3d126367f72e353919ecbff45bed3abaaf
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/a3310c3b512c7812b6f658c5bff828d3c8329e48
https://fedorahosted.org/freeipa/changeset/cea66362621f6ab6219a689c2da4025c37f496bb

Should this one be ON_QA already?  

Looks like certmonger is tracking these:

[root@master pki]# getcert list|grep KRA
	subject: CN=KRA Audit,O=TESTRELM.TEST
	subject: CN=KRA Transport Certificate,O=TESTRELM.TEST
	subject: CN=KRA Storage Certificate,O=TESTRELM.TEST


This is all that is needed to cover this right?

No, the fix makes /etc/httpd/alias/kra-agent.pem to be updated after ipaCert in /etc/httpd/alias is renewed.

Honza,

How do I test this?

Is cycling the time forward the only way?

Thanks,
Scott

1. manually request renewal of the CA/KRA agent cert by running "getcert resubmit -d /etc/httpd/alias -n ipaCert"

2. wait until certmonger is done with the renewal (the certmonger requst must be in MONITORING state, you can check it by running "getcert list -d /etc/httpd/alias -n ipaCert")

3.1. check that the certificate in /etc/httpd/alias/kra-agent.pem is the same as the certificate returned by "certutil -d /etc/httpd/alias -L -n ipaCert -a"

3.2. check that vault_archive/vault_retrieve IPA commands still work after the renewal

Verified.

Version ::

ipa-server-4.2.0-9.el7.x86_64

Results ::

[root@master ~]# getcert list -d /etc/httpd/alias/ -n ipaCert
Number of certificates and requests being tracked: 11.
Request ID '20150910212808':
	status: MONITORING
	stuck: no
	key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
	certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB'
	CA: dogtag-ipa-ca-renew-agent
	issuer: CN=Certificate Authority,O=TESTRELM.TEST
	subject: CN=IPA RA,O=TESTRELM.TEST
	expires: 2017-08-30 21:28:02 UTC
	key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
	eku: id-kp-serverAuth,id-kp-clientAuth
	pre-save command: 
	post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert
	track: yes
	auto-renew: yes

[root@master ~]# getcert resubmit -d /etc/httpd/alias -n ipaCert
Resubmitting "20150910212808" to "dogtag-ipa-ca-renew-agent".

[root@master ~]# sleep 120; (getcert list -d /etc/httpd/alias -n ipaCert | egrep "status|expires")
	status: MONITORING
	expires: 2017-09-04 15:52:38 UTC

[root@master ~]# certutil -d /etc/httpd/alias -L -n ipaCert -a | sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' | tr -d '\r' > /tmp/ipaCert.crt

[root@master ~]# sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' /etc/httpd/alias/kra-agent.pem > /tmp/kra1.crt

[root@master ~]# diff /tmp/ipaCert.crt /tmp/kra1.crt

[root@master ~]#

Forgot to cover vault-archive/retrieve functionality:

[root@master ~]# kinit admin
Password for admin: 
[root@master ~]# ipa vault-add vrenewed --password=1234
----------------------
Added vault "vrenewed"
----------------------
  Vault name: vrenewed
  Type: symmetric
  Salt: OV1hHWAOUPJggZneEuqfkg==
  Owner users: admin
  Vault user: admin
[root@master ~]# ipa vault-archive vrenewed --password=1234 --data=$(echo Secret123|base64)
-----------------------------------
Archived data into vault "vrenewed"
-----------------------------------
[root@master ~]# ipa vault-retrieve vrenewed --password=1234 --out=/tmp/vrenewed.out
------------------------------------
Retrieved data from vault "vrenewed"
------------------------------------
[root@master ~]# cat /tmp/vrenewed.out
Secret123
[root@master ~]#

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html