Bug 1700990
| Summary: | ipa certficate bundle export fails with padding error message | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Glenn Snead <gsnead> | ||||||
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> | ||||||
| Status: | CLOSED NEXTRELEASE | QA Contact: | ipa-qe <ipa-qe> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 7.6 | CC: | frenaud, pvoborni, rcritten, tscherf | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2019-04-23 15:31:20 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
What is the package version of ipa-server? What is the IPA CA configuration? Are you using an IPA CA, externally-signed, no-CA? What certificate are you showing? Does this happen for all serial numbers? Does it display correctly if you omit --out? Without --chain? Can you attach the raw LDAP entry? Created attachment 1556194 [details]
LDAP Certificate Entry Example
What is the package version of ipa-server? ipa-server-common-4.6.4-10.el7_6.3.noarch What is the IPA CA configuration? Are you using an IPA CA, externally-signed, no-CA? I'm using an IPA CA and I have two nodes. What certificate are you showing? Does this happen for all serial numbers? This happens for all serial numbers. Does it display correctly if you omit --out? Without --chain? This command works correctly if I omit --out or --chain. It's the combination of --out and --chain that causes the error. I think we can get a peek into the data being returned with: ipa -vvv cert-show --ca=ipa --raw --chain --out=<filename> <cert_id> I'd also look at the contents of the entries under cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=vm Specifically: cACertificate;binary::MII.... If the binary is missing or the prefix is not MII it indicates an issue with the storage format. Created attachment 1557176 [details]
ipa cert-show -vvv command output
(In reply to Glenn SNead from comment #6) > Created attachment 1557176 [details] > ipa cert-show -vvv command output I've attached the file: ipa_command_output.txt Let me know if you need anything else. From the output we can see that result['result']['certificate_chain'] contains a base64-encoded value (note the __base64__: in the result) while result['result']['certificate'] is not encoded.
The code in ipaclient/plugins/cert.py is the following:
if certificate_out is not None:
if options.get('chain', False):
certs = result['result']['certificate_chain']
else:
certs = [result['result']['certificate']]
certs = (x509.load_der_x509_certificate(base64.b64decode(cert))
for cert in certs)
x509.write_certificate_list(certs, certificate_out)
i.e. it expects the value to be base64-encoded in all the cases, while it should not.
This issue has already been fixed in the master branch, ipa-4-6 (4.6.5) and ipa-4-7 (4.7.1), please see https://pagure.io/freeipa/issue/7700.
If you can wait for RHEL 7.7, the fix will be incorporated in RHEL 7.7. Otherwise we would need business justification for a backport to RHEL 7.6 z-stream.
Upstream ticket: https://pagure.io/freeipa/issue/7700 Fixed upstream:
master:
https://pagure.io/freeipa/c/a2ad41749027c2c5e2b03f4d8b7e0d712f98e1b3 Fix writing certificate chain to file
ipa-4-7:
https://pagure.io/freeipa/c/5c8f39ab11993941f370ae5956b41adf2d03537f Fix writing certificate chain to file
ipa-4-6:
https://pagure.io/freeipa/c/b94e1d1df3275e9107feae5c4483e94acd164cc8 Fix writing certificate chain to file
Workaround: use both ipa cert-show and ipa ca-show then combine their outputs. For instance: ipa cert-show --ca=ipa --raw --out=<filename1> <cert_id> ipa ca-show ipa --chain --certificate-out=<filename2> cat filename1 filename2 > filename.out I agree with the closing of this item. |
Description of problem: ipa cert-show --ca=ipa --raw --chain --out=<filename> <cert_id> returns the following: ipa: ERROR: non-public: TypeError: Incorrect padding Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 141, in execute return self.Command[_name](*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__ return self.__do_call(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 478, in __do_call ret = self.run(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 801, in run return self.forward(*args, **options) File "/usr/lib/python2.7/site-packages/ipaclient/plugins/cert.py", line 101, in forward return super(cert_show, self).forward(*args, **options) File "/usr/lib/python2.7/site-packages/ipaclient/plugins/cert.py", line 65, in forward x509.write_certificate_list(certs, certificate_out) File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 535, in write_certificate_list for cert in certs: File "/usr/lib/python2.7/site-packages/ipaclient/plugins/cert.py", line 64, in <genexpr> for cert in certs) File "/usr/lib64/python2.7/base64.py", line 76, in b64decode raise TypeError(msg) TypeError: Incorrect padding ipa: ERROR: an internal error has occurred How reproducible: Steps to Reproduce: 1. Create a new csr 2. Generate a new certificate 3. Attempt to export the certificate bundle Additional info: I'm running RHEL 7.6 with all current patches on a physical server.