Hide Forgot
This bug has been copied from bug #1277691 and has been proposed to be backported to 7.2 z-stream (EUS).
Pushed to DOGTAG_10_2_5_RHEL_BRANCH: commit 05ee3265165f93b357ed17b47fe3f62f9b67ae8b Author: Endi S. Dewata <edewata> Date: Sun Dec 20 21:46:56 2015 +0100 Fixed mismatching certificate validity calculation. The CAValidityDefault has been modified to use Calendar API to calculate the certificate validity range to be consistent with the ValidityConstraint and ValidityDefault. https://fedorahosted.org/pki/ticket/1682
According to https://bugzilla.redhat.com/show_bug.cgi?id=1277691#c15,verified on pki-ca-10.2.5-7.el7_2 [root@auto-hv-02-guest10 ~]# date +%Y%m%d -s "20151102" 20151102 [root@auto-hv-02-guest10 ~]# ipa-server-install --setup-dns --forwarder=$DNSFORWARD --hostname=$(hostname) -r $RELM -n $DOMAIN -p $ADMINPW -a $ADMINPW -U . . . Setup complete Next steps: 1. You must make sure these network ports are open: TCP Ports: * 80, 443: HTTP/HTTPS * 389, 636: LDAP/LDAPS * 88, 464: kerberos * 53: bind UDP Ports: * 88, 464: kerberos * 53: bind * 123: ntp 2. You can now obtain a kerberos ticket using the command: 'kinit admin' This ticket will allow you to use the IPA tools (e.g., ipa user-add) and the web user interface. Be sure to back up the CA certificates stored in /root/cacert.p12 These files are required to create replicas. The password for these files is the Directory Manager password [root@auto-hv-02-guest10 ~]# pki cert-find | grep "CN=Certificate Authority" -A 8 Subject DN: CN=Certificate Authority,O=TESTRELM.TEST Status: VALID Type: X.509 version 3 Key Algorithm: PKCS #1 RSA with 2048-bit key Not Valid Before: Mon Nov 02 00:02:43 EST 2015 Not Valid After: Fri Nov 02 00:02:43 EDT 2035 Issued On: Mon Nov 02 00:02:43 EST 2015 Issued By: system [root@auto-hv-02-guest10 ~]# db_pw="Secret123" [root@auto-hv-02-guest10 ~]# pki -c $db_pw client-init --force ------------------ Client initialized ------------------ [root@auto-hv-02-guest10 ~]# pki -c $db_pw client-cert-request "cn=Certificate Authority" --profile caCACert ----------------------------- Submitted certificate request ----------------------------- Request ID: 11 Type: enrollment Request Status: pending Operation Result: success
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-1042.html