freeipa

#7579 ipa-cacert-manage cannot import PKCS#7 files
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1572674

Description of problem:
Windows AD often provides files in PKCS#7 format (with p7b extensions)
importing with ipa-cacert-manage fails:
# ipa-cacert-manage install /tmp/ca.p7b
Installing CA certificate, please wait
Not a valid certificate: Unable to load certificate
The ipa-cacert-manage command failed.
I heard from another reported that this could also throw a padding error (which
I assumed meant the entire contents of the PKCS#7 file was passed to the base64
decoder).
Version-Release number of selected component (if applicable):
ipa-server-4.5.4-10.el7
Steps to Reproduce:
1. openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt -out /tmp/ca.p7b
2. ipa-cacert-manage install /tmp/ca.p7b

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1572674

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.6.5 (was: FreeIPA 4.6.4)

Metadata Update from @rcritten:
- Issue assigned to rcritten

master:

  • 3e8f550c29bb984a87309514d277683bf2e75012 Add tests for ipa-cacert-manage install
  • 35d1d345c16fe1adb4cda2e0c33b715d85297dae Add support for multiple certificates/formats to ipa-cacert-manage

Failed to apply patches onto origin/ipa-4-6. Manual backport is needed.

ipa-4-7:

  • 8b0f74961b45d7b2f4cdbccc65d48ce55bc90952 Add tests for ipa-cacert-manage install
  • 30995f8f16b6b048af19960489477938eadfd471 Add support for multiple certificates/formats to ipa-cacert-manage

PR https://github.com/freeipa/freeipa/pull/2854 for manual backport

ipa-4-6:

  • 6bea9b12bfc0e2fa8445f6ab33e8544db0d0b537 Add support for multiple certificates/formats to ipa-cacert-manage
  • 5e51c31ad17b01be65e73b160460ad2446ad9f0e Add tests for ipa-cacert-manage install

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.