Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 947916

Summary:	ca.crt is not removed on client uninstall
Product:	Red Hat Enterprise Linux 7	Reporter:	Rob Crittenden <rcritten>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED CURRENTRELEASE	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	7.0	CC:	dpal, ksiddiqu, mkosek, nsoman
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-3.2.1-1.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 10:21:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Rob Crittenden 2013-04-03 14:16:58 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3537

The file /etc/ipa/ca.crt is not removed when a client is unconfigured.

This can cause future enrollments to fail if the IPA server is replaced which can happen ina  dev/test environment.

Comment 1 Martin Kosek 2013-04-04 10:51:18 UTC

Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/43fc525fbb98f5b6ff09df172f969a1707a6cbf4
ipa-3-1: https://fedorahosted.org/freeipa/changeset/b5e4039119a82cec104679133ad09d897c463279

Comment 4 Kaleem 2014-01-06 12:16:34 UTC

Verified.

IPA Version:
============

+---------------[RPMs & OS: [RedHat - x86_64]----------------+
|       ipa-admintools-3.3.3-8.el7.x86_64
|       ipa-client-3.3.3-8.el7.x86_64
|       sssd-ipa-1.11.2-15.el7.x86_64
-------------------------------------------------------------

Snippet from automation log:
============================

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: BZ947916 ca.crt is not removed on client uninstall
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Hostname: sgi-xe250-02.testrelm.com
Realm: TESTRELM.COM
DNS Domain: testrelm.com
IPA Server: ibm-x3250m4-03.testrelm.com
BaseDN: dc=testrelm,dc=com
Synchronizing time with KDC...
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=TESTRELM.COM
    Issuer:      CN=Certificate Authority,O=TESTRELM.COM
    Valid From:  Mon Jan 06 10:06:48 2014 UTC
    Valid Until: Fri Jan 06 10:06:48 2034 UTC

Enrolled in IPA realm TESTRELM.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm TESTRELM.COM
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.
WARNING: ntpd time&date synchronization service will not be configured as
conflicting service (chronyd) is enabled
Use --force-ntpd option to disable it and force configuration of ntpd


:: [   PASS   ] :: Installing ipa client (Expected 0, got 0)
:: [   PASS   ] :: File /etc/ipa/ca.crt should exist 
Unenrolling client from IPA server
Removing Kerberos service principals from /etc/krb5.keytab
Disabling client Kerberos and LDAP configurations
Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted
Restoring client configuration files
nscd daemon is not installed, skip configuration
Client uninstall complete.
:: [   PASS   ] :: uninstall ipa client success 
:: [   PASS   ] :: File /etc/ipa/ca.crt should not exist 
:: [   PASS   ] :: ca.crt removed after ipa-client un-installation 
'4dbec172-72bf-4378-8a27-f28ee18627db'
BZ947916-ca-crt-is-not-removed-on-client-uninstall result: PASS

Comment 5 Ludek Smid 2014-06-13 10:21:43 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.