freeipa

#7404 Incorrect certs are being updated with "ipa-certupdate"
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1542737

Description of problem:
Noticed there were a expired internal and external CA certs in the NSS DBs.
After manually removing old certs from the NSS DB, they are being re-added
after running the "ipa-certupdate" command.
How reproducible:
Every time
Steps to Reproduce:
Exported the ASCII format of the certs in the databases below.
 - /etc/httpd/alias
 - /etc/dirsrv/slapd-<instance name>
 - /etc/ipa/nssdb
 - /var/lib/pki/pki-tomcat/alias
Next, we found/verified the correct cert blob using the openssl command.
Then, we deleted the certs out of the NSS DBs and imported the correct certs in
the databases below.
 - /etc/httpd/alias
 - /etc/dirsrv/slapd-<instance name>
 - /etc/ipa/nssdb
 - /var/lib/pki/pki-tomcat/alias
When we ran "ipa-certupdate" all of the expired certs were added back to the
NSS DBs.
After deleting the  we deleted the expired certs from
"cn=certificates,cn=ipa,cn=etc,SUFFIX", we were able to run "ipa-certupdate"
successfully.
The expired certs were not added back to the NSS DBs.

The proper fix for this is to add a delete comment to ipa-cacert-manage so that unwanted, expired, etc. CA certificates can be removed.

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1542737

This raises the question: is there a convenient way (i.e. a CLI command) to list the currently
known CA certs? We may need more than just ipa-cacert-manage delete, but also
ipa-cacert-manage list so that admins can easily find out what certs are currently "installed".

IMO the delete command should either take a subject DN (removing all certs matching
that subject DN, with a sanity check to make sure that the subject is not the IPA CA or in the current trust chain of the IPA CA), or a specific issuer,serial pair (removing just one specific cert, again with sanity check).

There is also the possibility of a prune subcommand, that removes all expired certs from the LDAP certstore and reports what was removed.
Edited by ftweedal

You're right, a list option would be very helpful. I also agree with your delete and prune suggestions. May as well make it as useful as possible.

list capability was added in 35d1d345c16fe1adb4cda2e0c33b715d85297dae

delete command was added in acfb619

Metadata Update from @antorres:
- Issue set to the milestone: None (was: FreeIPA 4.7 backlog)

This work was completed in https://pagure.io/freeipa/issue/8124. Marking as done.

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 5d8cb1dd1fbfbdb7feb7f33c60eb6066f48aa563 ipa-cacert-manage: add prune option
  • 8a2e6ec3202ece070e6d9f529727ea89cec460f1 ipatests: add test for ipa-cacert-manage prune

Metadata Update from @frenaud:
- Custom field changelog adjusted to ipa-cacert-manage command now supports the "prune" subcommand, that allows to remove the expired CA certificates.
Metadata
None
None
None
None
None
ipa-cacert-manage command now supports the "prune" subcommand, that allows to remove the expired CA certificates.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.