ipa-client-install uninstall always tries to remove /etc/ipa/ca.crt irrespective what is name of ca file present in /etc/ipa or other path.
# ipa-client-install --ca-cert-file=/root/MyRootCA.pem ........ Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin Password for admin@<>: GIVE WRONG PASSWORD HERE Installation failed. Rolling back changes. The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
# ipa-client-install --ca-cert-file=/root/MyRootCA.pem
Why this happens is: uninstall() function always deletes hardcoded value. Rather it should search for file present in path provided in --ca-cert-file option. ./ipaplatform/base/paths.py IPA_CA_CRT = "/etc/ipa/ca.crt" ./ipaclient/install/client.py remove_file(paths.IPA_CA_CRT)
ca cert file named other than /etc/ipa/ca.crt is not removed.
ca cert file what ever is provided in --ca-cert-file option should be removed.
# rpm -qa | grep ipa-server ipa-server-dns-4.5.4-7.el7.noarch ipa-server-common-4.5.4-7.el7.noarch ipa-server-4.5.4-7.el7.x86_64 ipa-server-trust-ad-4.5.4-7.el7.x86_64 # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.5 Beta (Maipo)
# rpm -qa | grep ipa-server
ipa-server-dns-4.5.4-7.el7.noarch
ipa-server-common-4.5.4-7.el7.noarch
ipa-server-4.5.4-7.el7.x86_64
ipa-server-trust-ad-4.5.4-7.el7.x86_64
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.5 Beta (Maipo)
We in fact do NOT want to remove the user-provided certificate. I think this is working as expected.
This seems to be the inverse of https://pagure.io/freeipa/issue/7384
Closing as duplicate of https://pagure.io/freeipa/issue/7384
Metadata Update from @rcritten: - Issue close_status updated to: duplicate - Issue status updated to: Closed (was: Open)