I am unable to install a valid certificate on a ca-less master using ipa-server-certinstall:
# ipa-server-certinstall -p '<dirman_password>', '-w', 'server.p12', '--pin', '<certificate_pin>' Command '/usr/bin/certutil -d /etc/httpd/alias -D -n 'ca1/server'' returned non-zero exit status 255 The ipa-server-certinstall command failed.
Steps to reproduce: 1. Export the following environmental variables: - domain - domain name - server1 - master hostname - server2 - replica hostname - client - client hostname - dbdir - name of the certificate database folder (will be created) - crl_path - a folder for crl files (will be created) - dirman_password 2. Run the attached script to generate the set of certificates 3. Export server cert: {{{ pk12util -o "server.p12" -n "ca1/server" -d "" -K "" -W "" }}} 4. export pem file: {{{ certutil -L -d "" -n "ca1" -a > root.pem }}} 5. Install ca-less server with '--http-cert-file=server.p12 --dirsrv-cert-file=server.p12 --ca-cert-file=root.pem' 6. Export ca1/server-altname certificate {{{ pk12util -o "server.p12" -n "ca1/server-altname" -d "" -K "" -W "" }}} 7. Run ipa-server-certinstall with the parameters listed in the description to install the freshly exported certificate[[BR]] Expected results:[[BR]] Installation successful[[BR]]
Actual results[[BR]] Installation fails
attachment caless-create-pki
Oleg, which test covers this scenario?
test should be: TestCertinstall.test_valid_ds
This ticket is a duplicate of #6460 (NSSNickname enclosed in single quotes causes ipa-server-certinstall failure).
When ipa-server-install is called for a CA-less installation, the directive NSSNickname in /etc/httpd/conf.d/nss.conf looks like the following:
$ grep NSSNickname /etc/httpd/conf.d/nss.conf NSSNickname 'ca1/server'
The quotes are causing issues when calling certutil.
Metadata Update from @ofayans: - Issue assigned to someone - Issue set to the milestone: 0.0 NEEDS_TRIAGE