Red Hat Bugzilla – Bug 707001
Illegal CL input results in NULL csr when requesting external ca.
Last modified: 2015-01-04 18:48:42 EST
Description of problem: Illegal CL input results in NULL csr when requesting external ca. [root@ipa ~]# ipa-server-install --external-ca --external_cert_file=/root/ipa.crt --external_ca_file=/etc/pki/tls/certs/Foo-CA.crt The log file for this installation can be found in /var/log/ipaserver-install.log ============================================================================== This program will set up the FreeIPA Server. This includes: * Configure the Network Time Daemon (ntpd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) To accept the default shown in brackets, press the Enter key. Enter the fully qualified domain name of the computer on which you're setting up server software. Using the form <hostname>.<domainname> Example: master.example.com. Server host name [ipa.foo.com]: The domain name has been calculated based on the host name. Please confirm the domain name [foo.com]: The IPA Master Server will be configured with Hostname: ipa.foo.com IP address: 192.168.0.1 Domain name: foo.com The kerberos protocol requires a Realm name to be defined. This is typically the domain name converted to uppercase. Please provide a realm name [FOO.COM]: Certain directory server operations require an administrative user. This user is referred to as the Directory Manager and has full access to the Directory for system management tasks and will be added to the instance of directory server created for IPA. The password must be at least 8 characters long. Directory Manager password: Password (confirm): The IPA server requires an administrative user, named 'admin'. This user is a regular system account used for IPA server administration. IPA admin password: Password (confirm): Password mismatch! IPA admin password: Password (confirm): The following operations may take some minutes to complete. Please wait until the prompt is returned. Configuring certificate server: Estimated time 6 minutes [1/4]: creating certificate server user [2/4]: creating pki-ca instance [3/4]: restarting certificate server [4/4]: configuring certificate server instance The next step is to get /root/ipa.csr signed by your CA and re-run ipa-server-install as: ipa-server-install --external_cert_file=/path/to/signed_certificate --external_ca_file=/path/to/external_ca_certificate [root@ipa ~]# cat ipa.csr null Version-Release number of selected component (if applicable): ipa-server-2.0.0-23.el6.x86_64 Additional info: I know it is an illegal construction using the command line, but it either ought ot be prevented or well it probably ought to be prevented.
https://fedorahosted.org/freeipa/ticket/1244
master: 9f72637b13c2001d1c7e8842f75347f9af74190e ipa-2-0: e66aa074de3209f3c5dd4fdf2738bab893012dd5
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Cause: When installing IPA to be signed by an external CA the command-line options were not validated properly. Consequence: The resulting CSR would contain only the string "null". Fix: Add better detection of whether the CA 389-ds instance has been installed to identify which stage of the installation we are in. Result: Passing incorrect installation options will not result in an invalid CSR.
[root@sideswipe ~]# ipa-server-install --external-ca --external_cert_file=/root/ipa.crt --external_ca_file=/etc/pki/tls/certs/Foo-CA.crt Usage: ipa-server-install [options] ipa-server-install: error: You cannot specify --external_cert_file together with --external-ca [root@sideswipe ~]# [root@sideswipe ~]# ipa-server-install --external-ca --external_ca_file=/etc/pki/tls/certs/Foo-CA.crt Usage: ipa-server-install [options] ipa-server-install: error: You cannot specify --external_ca_file together with --external-ca [root@sideswipe ~]# [root@sideswipe ~]# rpm -qi ipa-server | head Name : ipa-server Relocations: (not relocatable) Version : 2.1.3 Vendor: Red Hat, Inc. Release : 8.el6 Build Date: Wed 02 Nov 2011 03:21:27 AM IST Install Date: Thu 03 Nov 2011 04:36:14 PM IST Build Host: x86-012.build.bos.redhat.com Group : System Environment/Base Source RPM: ipa-2.1.3-8.el6.src.rpm Size : 3381421 License: GPLv3+ Signature : (none) Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> URL : http://www.freeipa.org/ Summary : The IPA authentication server [root@sideswipe ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html