freeipa

#5348 [tracker] dig + dnssec does not display signature of freshly created root zone
Closed: fixed Opened by ofayans.

Closed: fixed
Reopen Issue

On a freshly installed ipa configured to be dnssec-master:

ipa-dns-install --dnssec-master

When I create a dnssec-signed root zone with one record in it

ipa dnszone-add --dnssec true .
ipa dnsrecord-add "." rhts.englab.brq.redhat.com. --ns-rec=dell-pe1950-06.rhts.englab.brq.redhat.com

And then query dnssec info for this zone:

dig +dnssec @localhost "." SOA

The response does NOT contain the key. After I restart named-pkcs11.service the key starts to be shown

This is not happening always.

Issue is caused by a bug somewhere between BIND and Softhsm storage, we have not find where exactly this happens yet.

Symptoms are that named cannot read the private keys, following entry is listed in named log

dns_dnssec_findmatchingkeys: error reading key file Kexample.test.+008+51274.private: not found

Restart of named-pkcs11 service fixes it.

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1272869

FreeIPA 4.2.3 was released, moving to next bug fixing milestone.

Some patches were posted for review but IMHO it is not a complete fix yet.

Improvements of debugging has been pushed together within ticket #5334

The issue is not resolved yet.

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1296214 (Red Hat Enterprise Linux 7)

I do not have to investigate it right now.

I do not have time to investigate it right now.

AFAIK workaround exists so it should not be a test blocker.

Test workarounds

ipa-4-3:

  • 377d75b98b3e62a6c224940420b61c6e8a7846a1 A workaround for ticket N 5348

master:

  • 5567dff4b46cc05bf0ea44dd03afdd12645143a5 A workaround for ticket N 5348

It seems that it works now. Hopefully some underlying component was fixed.

master:

  • 8bc677512296a7e94c29edd0c1a96aa7273f352a Remove named-pkcs11 workarounds from DNSSEC tests.

Metadata Update from @ofayans:
- Issue assigned to pspacek
- Issue set to the milestone: FreeIPA 4.5

It is happening again :-(

Metadata Update from @mbasti:
- Custom field blocking reset (from ipa-tests)
- Issue status updated to: Open (was: Closed)

Metadata Update from @mbasti:
- Issue assigned to tkrizek (was: pspacek)
- Issue set to the milestone: None (was: FreeIPA 4.5)

The issue is easily reproducible running "test_dnssec" test suite.

Metadata Update from @pvoborni:
- Issue priority set to: important (was: normal)
- Issue set to the milestone: FreeIPA 4.7
- Issue tagged with: test-failure

Metadata Update from @pvoborni:
- Issue assigned to cheimes (was: tkrizek)

master:

  • 6fb45d2f5649e516b0e6b865d07649a8583f90e6 test_dnssec: re-add named-pkcs11 workarounds
  • dae4aac912123db5f8152c566b96c2183b8a0cdc Tests: Set default TTL for DNS zones to 1 sec
  • 3a8f0bb16b9201089638eb4cbbcfe032be878ddc Remove restarted_named and xfail

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)

FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone

ipa-4-5:

  • a4502fe35afdc44a7f2a5dde84e659c8aed7b6ee Test: fix definition of template for dnssec
  • 6700f89cffc41310fb9b5e0ecd8dcd0102a91143 test_dnssec: re-add named-pkcs11 workarounds
  • 8cbc97111e1ab1d30f03f889e32a9429298582a9 Tests: Set default TTL for DNS zones to 1 sec
  • 8ae69a43cc507086fe9ad5d9c1e5f7a9ae0c4e4e Remove restarted_named and xfail

Metadata Update from @tdudlak:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure

None
None
Low
defect
Tests
https://github.com/freeipa/freeipa/pull/333
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.