Red Hat Bugzilla – Bug 724036
Internal error revoking certificate - default revocation reason
Last modified: 2015-01-04 18:50:07 EST
Description of problem: Revoking certificate is causing an internal error and tracebace. ipa cert-revoke is being executed without supplying --revocation-reason= The default should be zero .. but the trace back indicates reason 7 https://bugzilla.redhat.com/show_bug.cgi?id=712889 (existing bug) errors_log traceback: [Thu Jul 21 13:44:47 2011] [error] ipa: ERROR: non-public: KeyError: 'revocation_reason' [Thu Jul 21 13:44:47 2011] [error] Traceback (most recent call last): [Thu Jul 21 13:44:47 2011] [error] File "/usr/lib/python2.6/site-packages/ipaserver/rpcserver.py", line 220, in wsgi_execute [Thu Jul 21 13:44:47 2011] [error] result = self.Command[name](*args, **options) [Thu Jul 21 13:44:47 2011] [error] File "/usr/lib/python2.6/site-packages/ipalib/frontend.py", line 425, in __call__ [Thu Jul 21 13:44:47 2011] [error] ret = self.run(*args, **options) [Thu Jul 21 13:44:47 2011] [error] File "/usr/lib/python2.6/site-packages/ipalib/frontend.py", line 731, in run [Thu Jul 21 13:44:47 2011] [error] return self.execute(*args, **options) [Thu Jul 21 13:44:47 2011] [error] File "/usr/lib/python2.6/site-packages/ipalib/plugins/cert.py", line 554, in execute [Thu Jul 21 13:44:47 2011] [error] if kw['revocation_reason'] == 7: [Thu Jul 21 13:44:47 2011] [error] KeyError: 'revocation_reason' Automated Test: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: ipa-functionalservices-ldap-006: Revoke certificate :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: kdestroy: No credentials cache found while destroying cache spawn /usr/bin/kinit -V admin Using default cache: /tmp/krb5cc_0 Using principal: admin@TESTRELM Password for admin@TESTRELM: Authenticated to Kerberos v5 Default principal: admin@TESTRELM :: [02:11:49] :: kinit as admin with password Secret123 was successful. :: [ PASS ] :: Get administrator credentials :: [02:11:52] :: ldap/hp-dl360g5-02.testrelm certificate serial number: 14 ipa: ERROR: an internal error has occurred :: [ FAIL ] :: Revoke LDAP server's certificate (Expected 0, got 1) :: [02:11:54] :: Checking certificate revokation via OCSP :: [02:11:54] :: EXECUTING: /usr/lib64/nss/unsupported-tools/ocspclnt -S "hp-dl360g5-02.testrelm" -d /etc/dirsrv/slapd-instance1/ :: [ PASS ] :: Running ocspclnt :: [ FAIL ] :: File '/tmp/ocsp.out' should contain 'Peer's Certificate has been revoked.' Version-Release number of selected component (if applicable): # rpm -qi ipa-server Name : ipa-server Relocations: (not relocatable) Version : 2.0.99 Vendor: (none) Release : 3.20110721T0516zgit8e8ad51.el6 Build Date: Thu 21 Jul 2011 01:29:18 AM EDT Install Date: Thu 21 Jul 2011 12:43:27 PM EDT Build Host: goofy-vm16.dsdev.sjc.redhat.com Group : System Environment/Base Source RPM: ipa-2.0.99-3.20110721T0516zgit8e8ad51.el6.src.rpm Size : 3314423 License: GPLv3+ Signature : (none) URL : http://www.freeipa.org/ Summary : The IPA authentication server Description : IPA is an integrated solution to provide centrally managed Identity (machine, user, virtual machines, groups, authentication credentials), Policy (configuration settings, access control information) and Audit (events, logs, analysis thereof). If you are installing an IPA server you need to install this package (in other words, most people should NOT install this package). How reproducible: Steps to Reproduce: 1. ipa cert-revoke <servial_number> 2. 3. Actual results: # ipa cert-revoke 15 ipa: ERROR: an internal error has occurred Expected results: successful revocation with default reason 0 Additional info:
https://fedorahosted.org/freeipa/ticket/1514
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/abb5ee22d2c842b8ba1f68ce4d2ec47c306448aa ipa-2-0: https://fedorahosted.org/freeipa/changeset/6c49412da11f66258ec4d54a050604e12ba43cff
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Do not document
Verified using ipa-client-2.1.3-8.el6.x86_64 Revoking certificate is not causing an internal error :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: ipa-functionalservices-ldap-006: Revoke certificate :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: kdestroy: No credentials cache found while destroying cache spawn /usr/bin/kinit -V admin Using default cache: /tmp/krb5cc_0 Using principal: admin@TESTRELM Password for admin@TESTRELM: Authenticated to Kerberos v5 Default principal: admin@TESTRELM :: [22:54:37] :: kinit as admin with password Secret123 was successful. :: [ PASS ] :: Get administrator credentials :: [22:54:41] :: ldap/dell-pesc1420-01.testrelm certificate serial number: 17 Revoked: True :: [ PASS ] :: Revoke LDAP server's certificate :: [22:54:44] :: Checking certificate revokation via OCSP :: [22:54:44] :: EXECUTING: /usr/lib64/nss/unsupported-tools/ocspclnt -S "dell-pesc1420-01.testrelm" -d /etc/dirsrv/slapd-instance1/ :: [ PASS ] :: Running ocspclnt :: [ PASS ] :: File '/tmp/ocsp.out' should contain 'Peer's Certificate has been revoked.' '61f19dcc-eb19-4e42-8a62-fc0a7528c0c1' ipa-functionalservices-ldap-006 result: PASS metric: 0 Log: /tmp/beakerlib-3510265/journal.txt Info: Searching AVC errors produced since 1320548075.91 (Sat Nov 5 22:54:35 2011) Searching logs... Info: No AVC messages found. Writing to /mnt/testarea/tmp.Oz2Lzo : AvcLog: /mnt/testarea/tmp.Oz2Lzo
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1533.html