Bug 1455200

Created attachment 1281952 [details]
ipa-server-install.log

Created attachment 1281953 [details]
pki-ca-spawn.log

Created attachment 1281954 [details]
bug_reproduce.sh

The PKI error is not very helpful:

com.netscape.certsrv.base.PKIException: Error in setting certificate names and key sizes: java.io.IOException: Unable to create local certificate: extension not found

Which certificate, key, extension?

Looks as hardened validation. 

Fraser any idea if the issues is in IPA, PKI, usage?

The problem is that the External CA's certificate does not have an AuthorityKeyIdentifier extension.  So it is user error.  But the "fix"
will be better error reporting and, ideally, a sanity check in IPA to
prevent installation from proceeding and to explain to the user
what has to be changed.

Here is a n updated version of the attached script
that adds the required extensions.

(note: I changed the $PASSWORD and $domain variables, too)

---

#!/bin/bash

PASSWORD="4me2Test"
DBDIR="/root/nssdb"
PWDFILE="$DBDIR/pwdfile.txt"
NOISE="/etc/passwd"

domain="IPA.LOCAL"

IP=$(ip addr|grep "global"|cut -d " " -f6|cut -d "/" -f1|head -n 1)

/usr/sbin/ipa-server-install -p ${PASSWORD} -a ${PASSWORD} --ip-address ${IP} --domain ${domain} -r ${domain^^} --setup-dns --no-reverse --auto-forwarders -U --external-ca

ROOT_KEY_ID=0x$(dd if=/dev/urandom bs=20 count=1 | xxd -p)
IPA_CA_KEY_ID=0x$(dd if=/dev/urandom bs=20 count=1 | xxd -p)

rm -rf "$DBDIR"
mkdir "$DBDIR"
echo "$PASSWORD" > "$PWDFILE"
certutil -N -d "$DBDIR" -f "$PWDFILE"
echo -e "0\n1\n5\n6\n9\ny\ny\n\ny\n${ROOT_KEY_ID}\nn\n" \
  | certutil -d "$DBDIR"  -f "$PWDFILE" -S -z "$NOISE" -n ca -x -t C,C,C \
    -s "CN=PRIMARY,O=IPA.LOCAL" -x -1 -2 --extSKID

openssl req -outform der -in /root/ipa.csr -out "$DBDIR/req.csr"
echo -e "0\n1\n5\n6\n9\ny\ny\n\ny\ny\n${ROOT_KEY_ID}\n\n\nn\n${IPA_CA_KEY_ID}\nn\n" \
  | certutil -d "$DBDIR" -f "$PWDFILE" -C -z "$NOISE" -c ca \
    -i "$DBDIR/req.csr" -o "$DBDIR/external.cer" -1 -2 -3 --extSKID

openssl x509 -inform der -in "$DBDIR/external.cer" -out "$DBDIR/external.pem"
certutil -L -n ca -d "$DBDIR" -a > "$DBDIR/ca.crt"
cat "$DBDIR/external.pem" "$DBDIR/ca.crt" > "$DBDIR/chain.crt"
ipa-server-install --external-cert-file "$DBDIR/chain.crt" -p ${PASSWORD}

It's good that the error reporting will be improved.

Unfortunately atm. the only options IPA installer has is to either:
- re-implement the check
- fail when pkispawn ends on validation the input, which is too late in installation

So the better error will help only partially - but better than nothing.

Best would be to have `pkispawn --validate` mode which would only validate input so that IPA installer can call it in it's validation step. Jcholast created RFE for that long time ago. But that is obviously not for IPA 4.5 or PKI 10.4.1