RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

The installation script of the openldap rpm includes executing the script:
/usr/libexec/openldap/create-certdb.sh
which supposedly creates an empty certificate database in /etc/openldap/certs

But when you install the openldap package the /etc/openldap/certs is empty.

You have to execute /usr/libexec/openldap/create-certdb.sh in order for this files to appear in /etc/openldap/certs:

cert8.db
key3.db
secmod.db

Those are the empty Mozilla NSS certificate database files.


Version-Release number of selected component (if applicable):
openldap-2.4.23-26.el6.x86_64

How reproducible:

Installing openldap

Steps to Reproduce:
yum install openldap

  
Actual results:
The /etc/openldap/certs directory is empty


Expected results:
The /etc/openldap/certs should have an empty certificate database.

Additional info:

Workaround:
Executing the script manually, and then installing openldap-servers, to execute
/usr/libexec/openldap/generate-server-cert.sh

to generate test certificates.

Thank you for the report. I will take a look at it.

Ricardo, please, can you provide detailed steps to reproduce the issue? I'm not successful in it. I tried downgrading, upgrading, and reinstalling various versions of the openldap package, but certs directory was always created for me.

The /etc/openldap/certs directory is created indeed, but since the /usr/libexec/openldap/create-certdb.sh is executed from the rpm installation, it should have created an empty certificate *database*, with these files:

/etc/openldap/certscert8.db
/etc/openldap/certskey3.db
/etc/openldap/certssecmod.db

Those files don't exist after installing opendap. They should existe because the /usr/libexec/openldap/create-certdb.sh script is invoked as part of the installation in rpm.

Yes, I know how it should work. The thing is that it works for me just fine. Please, can you provide exact steps to reproduce?

$ ls /etc/openldap/certs/
cert8.db  key3.db  password  secmod.db

This bugzilla has stalled on needinfo for a long time. Closing it now.