freeipa

#6460 NSSNickname enclosed in single quotes causes ipa-server-certinstall failure
Closed: Fixed Opened by ftweedal.

Closed: Fixed
Reopen Issue

When HTTP `nss.conf NSSNickname value is enclosed in single quotes (this occurs
when the cert came from a PKCS #12 file e.g. using externally
signed HTTP cert or domain-level 0 installation), running ipa-server-certinstall
to replace the cert fails because installutils.get_directive() interprets
the single quotes as part of the value.

This appears to be a regression introduced in ee96384c3ed5d93c8042e05461253e0c2ed5f721
(see also https://fedorahosted.org/freeipa/ticket/5809)

Excerpt of ipa-server-certinstall --verbose ... output:

ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/httpd/alias -D -n 'Server-Cert'
ipa: DEBUG: Process finished, return code=255
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=certutil: could not find certificate named "'Server-Cert'": SEC_ERROR_BAD_DATABASE: security library: bad database.
ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_certinstall.py", line 113, in run
    self.install_http_cert()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_certinstall.py", line 145, in install_http_cert
    'restart_httpd')
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_certinstall.py", line 211, in import_cert
    cdb.delete_cert(old_cert)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py", line 492, in delete_cert
    self.nssdb.delete_cert(nickname)
  File "/usr/lib/python2.7/site-packages/ipapython/certdb.py", line 488, in delete_cert
    self.run_certutil(["-D", "-n", nick])
  File "/usr/lib/python2.7/site-packages/ipapython/certdb.py", line 144, in run_certutil
    return ipautil.run(new_args, stdin, **kwargs)
  File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 518, in run
    raise CalledProcessError(p.returncode, arg_string, str(output))
ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: The ipa-server-certinstall command failed, exception: CalledProcessError: Command '/usr/bin/certutil -d /etc/httpd/alias -D -n 'Server-Cert'' returned non-zero exit s
tatus 255
ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: Command '/usr/bin/certutil -d /etc/httpd/alias -D -n 'Server-Cert'' returned non-zero exit status 255
ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: The ipa-server-certinstall command failed.

Credit to Flo for discovering this.

master:

  • e1ed8b5eff40331ba532d37f3fb08814d8a55b77 Fix the installutils.set_directive docstring
  • 517d43e78b8d8ea0b796a6ff6a379236eaae21df installutils: improve directive value parsing in get_directive
  • 2831b30e9a9de947481c058d8d32e174f951b1c0 Delegate directive value quoting/unquoting to separate functions
  • 86f4a93fb3aeb6742acab5abaa1c17b525ea4223 Explicitly handle quoting/unquoting of NSSNickname directive

Metadata Update from @ftweedal:
- Issue assigned to mbabinsk
- Issue set to the milestone: FreeIPA 4.5
Metadata
None
None
None
Normal
defect
IPA
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.