freeipa

#7316 The Issuer DN field in IPA is not updating properly
Closed: fixed Opened by frenaud.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1518932

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

Description of problem:
When changing the Certificate Chain from Self-signed CA certificate to
externally-signed CA certificate, the CA is updated but the Issuer DN field is
not updated accordingly
Version-Release number of selected component (if applicable):
RHEL 7.4
ipa-server-4.5.0-21.el7_4.2.2.x86_64
How reproducible:
everytime
Steps to Reproduce:
1. ipa-cacert-manage renew
2. ipa-certupdate
3. ipa ca-show ipa
Actual results:
ipa ca-show ipa shows
Subject DN: CN=Certificate Authority,O=IDMTEST.DOMAIN.COM
Issuer DN: CN=Certificate Authority,O=IDMTEST.DOMAIN.COM
Expected results:
ipa ca-show ipa shows
Subject DN: CN=Certificate Authority,O=IDMTEST.DOMAIN.COM
Issuer: DC=xx, DC=xx, DC=xx, DC=xx, CN=External Issuing CA

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1518932

Metadata Update from @frenaud:
- Issue priority set to: critical

I'll need to look into this. Probably involves the lightweight CA data that gets
returned by Dogtag.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

Metadata Update from @pvoborni:
- Issue tagged with: bug

PR: https://github.com/freeipa/freeipa/pull/1503

Metadata Update from @ftweedal:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1503

master:

  • b07937d0b80c8ccc714ea62fafcc7090bbaecc23 Update IPA CA issuer DN upon renewal

Fraser, please backport the fix to 4.5. ipatool failed to auto-create a backport:

Aplying to ipa-4-5: Update IPA CA issuer DN upon renewal
Failed to apply patches onto origin/ipa-4-5. Manual backport is needed.

ipa-4-6:

  • 69681c552c983ee1a303bcf04b78e5c6d19caa9d Update IPA CA issuer DN upon renewal

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @cheimes:
- Issue status updated to: Open (was: Closed)

ipa-4-5 PR: https://github.com/freeipa/freeipa/pull/1555

ipa-4-5:

  • e04c315b85e0eb585f662ddc02b728859129869d Update IPA CA issuer DN upon renewal

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • e90d90c5c36c5c415613930baf8559f47362b446 Check if issuer DN is updated after self-signed > external-ca

ipa-4-5:

  • 13037e60eb3eb4d929fb146a4aa22388836074a2 Check if issuer DN is updated after self-signed > external-ca

ipa-4-6:

  • 39350af2fe5b3a8a4e164f432190a10281d31a18 Check if issuer DN is updated after self-signed > external-ca
Metadata

bug

None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.