Bug 624142 - certmonger defunct process ipa-submit
certmonger defunct process ipa-submit
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: certmonger (Show other bugs)
6.0
All Linux
low Severity medium
: rc
: ---
Assigned To: Nalin Dahyabhai
BaseOS QE Security Team
:
Depends On: 624120
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-13 15:35 EDT by Nalin Dahyabhai
Modified: 2011-05-19 09:07 EDT (History)
5 users (show)

See Also:
Fixed In Version: certmonger-0.26-1
Doc Type: Bug Fix
Doc Text:
If the certmonger service failed to contact a CA, the subprocess that submitted the request became defunct. This occurred because the parent process did not read the subprocess status. With this update, the parent process reads the subprocess status and there is no defunct process after a CA contact failure.
Story Points: ---
Clone Of: 624120
Environment:
Last Closed: 2011-05-19 09:07:09 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Nalin Dahyabhai 2010-08-13 15:35:37 EDT
+++ This bug was initially created as a clone of Bug #624120 +++

Description of problem:

In the context of IPA I was doing more testing on expiring certs. I would do an installation and then set the current date forward to expire the certificates to ensure that certmonger would automaticaly renew them. I messed with the date too far so *everything* was expired, it wasn't pretty.

I reset the date back to now and wanted to fix the certmonger state which was CA_UNREACHABLE b/c the CA was down due to expired certs (it was 2030 after all).

I did ipa-getcert resubmit -i <id>, twice in a row (fat fingers)

Then I ran ipa-getcert list over and over to monitor it generating the CSR, submitting it and finally back to MONITORING.

I happened to run ps -ef and noticed a defunct process. I can only assume it is related to my fat fingering, I don't know for sure.

The process is:

root 4731 0.3 0.0 0 0 ? Z 13:53 0:00 [ipa-submit] <defunct>

Version-Release number of selected component (if applicable):

certmonger-0.24-0.2010081019git8dd6042.fc12.x86_64

--- Additional comment from nalin@redhat.com on 2010-08-13 14:13:22 EDT ---

Literally minutes after I tagged 0.25.  When canceling a child process, the daemon isn't reaping its status, hence zombies.  Targeting 0.26.

--- Additional comment from updates@fedoraproject.org on 2010-08-13 15:28:45 EDT ---

certmonger-0.26-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/certmonger-0.26-1.fc13

--- Additional comment from updates@fedoraproject.org on 2010-08-13 15:28:55 EDT ---

certmonger-0.26-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/certmonger-0.26-1.fc12

--- Additional comment from updates@fedoraproject.org on 2010-08-13 15:29:04 EDT ---

certmonger-0.26-1.fc14 has been submitted as an update for Fedora 14.
http://admin.fedoraproject.org/updates/certmonger-0.26-1.fc14
Comment 2 Kaleem 2011-03-10 10:00:59 EST
Verified

RHEL version:

[root@localhost ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 6.1 Beta (Santiago)

Certmonger version:

[root@localhost ~]# rpm -qi certmonger | head
Name        : certmonger                   Relocations: (not relocatable)
Version     : 0.34                              Vendor: Red Hat, Inc.
Release     : 1.el6                         Build Date: Fri 14 Jan 2011 08:30:16 PM IST
Install Date: Wed 09 Mar 2011 05:25:48 PM IST      Build Host: x86-004.build.bos.redhat.com
Group       : System Environment/Daemons    Source RPM: certmonger-0.34-1.el6.src.rpm
Size        : 683642                           License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://certmonger.fedorahosted.org
Summary     : Certificate status monitor and PKI enrollment client


Steps used to verify:
(1)install and configure ipa-server with default values(it will also install certmonger since it is a dependency) 
  #yum install ipa-server ipa-client ipa-admintools bind caching-nameserver expect krb5-workstation bind-dyndb-ldap ntpdate krb5-pkinit-openssl
  #ipa-server-install -N --setup-dns (accept all default values and proceed)

(2)started certmonger service
   #service certmonger start

(3)issuing a certificate

[root@jupiter kaleem]# ipa-getcert request -d /tmp/kaleem/ -n test 
New signing request "20110310140151" added.

(4)looking at the certificate status

[root@jupiter kaleem]# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20110310140151':
	status: MONITORING
	stuck: no
	key pair storage: type=NSSDB,location='/tmp/kaleem',nickname=test
	certificate: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	CA: IPA
	issuer: CN=Certificate Authority,O=LAB.ENG.PNQ.REDHAT.COM
	subject: CN=jupiter.lab.eng.pnq.redhat.com,O=LAB.ENG.PNQ.REDHAT.COM
	expires: 20110906140153
	eku: id-kp-serverAuth
	track: yes
	auto-renew: yes

(5)chaning the date so certificate expires

[root@jupiter kaleem]# date -s "11 MAR 2012 19:21:00"
Sun Mar 11 19:21:00 IST 2012

(6)looking at the status after date change

[root@jupiter kaleem]# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20110310140151':
	status: CA_UNREACHABLE
	ca-error: Server failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates).
	stuck: yes
	key pair storage: type=NSSDB,location='/tmp/kaleem',nickname=test
	certificate: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	CA: IPA
	issuer: CN=Certificate Authority,O=LAB.ENG.PNQ.REDHAT.COM
	subject: CN=jupiter.lab.eng.pnq.redhat.com,O=LAB.ENG.PNQ.REDHAT.COM
	expires: 20110906140153
	eku: id-kp-serverAuth
	track: yes
	auto-renew: yes
  
   It shows status as CA_UNREACHABLE.

(5)resetting the date now

[root@jupiter kaleem]# date -s "10 MAR 2011 19:48:00"
Thu Mar 10 19:48:00 IST 2011

(6)certificate status after re-setting the date

[root@jupiter kaleem]# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20110310140151':
	status: CA_UNREACHABLE
	ca-error: Server failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates).
	stuck: yes
	key pair storage: type=NSSDB,location='/tmp/kaleem',nickname=test
	certificate: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	CA: IPA
	issuer: CN=Certificate Authority,O=LAB.ENG.PNQ.REDHAT.COM
	subject: CN=jupiter.lab.eng.pnq.redhat.com,O=LAB.ENG.PNQ.REDHAT.COM
	expires: 20110906140153
	eku: id-kp-serverAuth
	track: yes
	auto-renew: yes

 Its still CA_UNREACHABLE

(7)now resubmitting the request(twice as mentioned in #comment 1 of bug)

[root@jupiter kaleem]# ipa-getcert resubmit -i 20110310140151
Resubmitting "20110310140151" to "IPA".
[root@jupiter kaleem]# ipa-getcert resubmit -i 20110310140151
Resubmitting "20110310140151" to "IPA".

(8)checking the status of certificate

 [root@jupiter kaleem]# ipa-getcert list
Number of certificates and requests being tracked: 1.
Request ID '20110310140151':
	status: MONITORING
	stuck: no
	key pair storage: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	certificate: type=NSSDB,location='/tmp/kaleem',nickname=test,token='NSS Certificate DB'
	CA: IPA
	issuer: CN=Certificate Authority,O=LAB.ENG.PNQ.REDHAT.COM
	subject: CN=jupiter.lab.eng.pnq.redhat.com,O=LAB.ENG.PNQ.REDHAT.COM
	expires: 20110906142059
	eku: id-kp-serverAuth
	track: yes
	auto-renew: yes

    Now certmonger starts monitoring the certificate

(9)ran command ps -ef and did not find any defunct process of ipa-resubmit 

[root@jupiter kaleem]# ps -ef|grep -i ipa-submit
root     29763 26016  0 20:22 pts/2    00:00:00 grep -i ipa-submit

Result:
Now there is no defunct process left in current processes list.
Comment 3 Eva Kopalova 2011-05-02 13:01:39 EDT
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
If the certmonger service failed to contact a CA, the subprocess that submitted the request became defunct. This occurred because the parent process did not read the subprocess status. With this update, the parent process reads the subprocess status and there is no defunct process after a CA contact failure.
Comment 4 errata-xmlrpc 2011-05-19 09:07:09 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0570.html

Note You need to log in before you can comment on or make changes to this bug.