Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
manual renew self-signed CA cert to external CA cert fails with no context.ldap2 in thread 'MainThread'
Version-Release number of selected component (if applicable):
ipa-server-4.2.0-15
pki-ca-10.2.5-6
How reproducible:
Always
Steps to Reproduce:
1.install ipa with self-signed ca cert
2.manual renew ca with option to change to external ca
Actual results:
renew fails
Expected results:
renew succeeds
Additional info:
[root@qe-blade-01 ~]# ipa-cacert-manage renew --external-ca
Exporting CA certificate signing request, please wait
The next step is to get /var/lib/ipa/ca.csr signed by your CA and re-run ipa-cacert-manage as:
ipa-cacert-manage renew --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate
The ipa-cacert-manage command was successful
[root@qe-blade-01 ~]# mkdir /root/RootCA1
[root@qe-blade-01 ~]# cd /root/RootCA1
[root@qe-blade-01 RootCA1]# rm -f *
[root@qe-blade-01 RootCA1]# echo Secret123 > mypass1
[root@qe-blade-01 RootCA1]# certutil -N -d . -f mypass1
[root@qe-blade-01 RootCA1]# echo -e "y\n10\ny\n" | \
> certutil -S -d . \
> -n RootCA1 \
> -s "CN=MyRootCA1, O=fakerealm1" \
> -x \
> -t "CTu,CTu,CTu" \
> -g 2048 \
> -m $RANDOM\
> -v 60 \
> -z /etc/group \
> -2 \
> --keyUsage certSigning \
> --nsCertType sslCA,smimeCA,objectSigningCA \
> -f mypass1
Generating key. This may take a few moments...
Is this a CA certificate [y/N]?
Enter the path length constraint, enter to skip [<0 for unlimited path]: > Is this a critical extension [y/N]?
Notice: Trust flag u is set automatically if the private key is present.
[root@qe-blade-01 RootCA1]# echo -e "y\n10\ny\n" | \
> certutil -C -d . \
> -c RootCA1 \
> -m $RANDOM \
> -v 60 \
> -2 \
> --keyUsage digitalSignature,nonRepudiation,certSigning \
> --nsCertType sslCA,smimeCA,objectSigningCA \
> -i /var/lib/ipa/ca.csr \
> -o /root/ca.crt \
> -f mypass1 \
> -a
Is this a CA certificate [y/N]?
Enter the path length constraint, enter to skip [<0 for unlimited path]: > Is this a critical extension [y/N]?
[root@qe-blade-01 RootCA1]# certutil -L -d . -n "RootCA1" -a >> /root/RootCA1_chain.asc
[root@qe-blade-01 RootCA1]# cd /root
[root@qe-blade-01 ~]# getcert list -n 'caSigningCert cert-pki-ca'| grep expires
expires: 2035-11-18 15:15:35 UTC
[root@qe-blade-01 ~]# ipa-cacert-manage renew \
> --external-cert-file=/root/ca.crt \
> --external-cert-file=/root/RootCA1_chain.asc
Directory Manager password:
Importing the renewed CA certificate, please wait
no context.ldap2_62808656 in thread 'MainThread'
[root@qe-blade-01 ~]# getcert list -n 'caSigningCert cert-pki-ca'| grep expires
expires: 2035-11-18 15:15:35 UTC