freeipa

#7287 kra install fails after ipa cert renewed
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

Description of problem:
kra install fails after ipa cert renewed

Version-Release number of selected component (if applicable):
ipa-server-4.5.0-22.el7_4.x86_64

How reproducible:
always

Steps to Reproduce:
1. Install ipa master
2. get expiration date from /root/ca-agent.p12
- openssl pkcs12 -in ca-agent.p12 -out ca-agent.pem -nodes
- cat ca-agent.pem | openssl x509 -noout -enddate

  1. move date forward to 20 days before ca-agent.p12 expires

  2. wait for certs to be renewed (watch with getcert list)

  3. move date to 3 days after ca-agent.p12 expired (i.e 3 days after date from step2).

  4. ipa-kra-install

Actual results:

Expected results:
ipa kra install success

Additional info:
ipa kra install failed

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

Metadata Update from @ftweedal:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1512482

Metadata Update from @ftweedal:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1343

Metadata Update from @pvoborni:
- Issue priority set to: critical
- Issue tagged with: regression

Metadata Update from @frenaud:
- Issue set to the milestone: FreeIPA 4.5.4

master:

  • 6a8c84718d67704dcb0055e0d3bf4bdf2027b3ee Don't use admin cert during KRA installation

ipa-4-6:

  • ca571cf10bcad079e31e6577de2f63621d4f9e4b Don't use admin cert during KRA installation

ipa-4-5:

  • 64ebd365fe9d8029959b29bc3ed4a3ca8385fefa Don't use admin cert during KRA installation

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

regression

None
None
Lowest
https://github.com/freeipa/freeipa/pull/1343
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.