freeipa

#7759 ipa-server-certinstall --http allows to install a server cert even though the CA is not known
Opened by frenaud. Modified

Open
Close Issue

Issue

IPA server installed CA-less, with ldap/http certs signed by rootCA.
The admin replaces the http cert with a certificate signed by subCA (subCA is a sub-CA of rootCA).
The command succeeds but clients are not able any more to use ipa * commands

Steps to Reproduce

  1. ipa-server-certinstall --http --pin <pin> --dirman-password <pwd> /path/to/cert.pem /path/to/cert.key /path/to/subca.pem
  2. ipactl restart
  3. ipa user-find
    ipa: ERROR: cannot connect to 'https://vm-064.abc.idm.lab.eng.brq.redhat.com/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:866)

Actual behavior

As the subCA is not trusted (not installed in /etc/ipa/nssdb, not present in /etc/ipa/ca.crt), the clients do not trust the http server cert.

Expected behavior

I would expect ipa-server-certinstall to refuse changing the http cert. Note that ipa-server-certinstall --dirsrv (for ldap cert) properly refuses the new cert, but it's using a NSS database instead of openssl.

Version/Release/Distribution

freeipa-server-4.7.0-3.fc28.x86_64
(this happens since the move from mod-nss to mod-ssl for apache servre certificates).

Actually I argue that it's correct to not have the subCA in /etc/ipa/nssdb and /etc/ipa/ca.crt. it should be enough to have the root CA in the trust store. Apache, 389-DS, and other services should be configured to correctly send intermediate CA certs with the server cert.

See https://pagure.io/freeipa/issue/6454

master:

  • 8b7e17aa16fa20b2917ee6bb2343b2658306b548 ipatests: update tests for ipa-server-certinstall
  • 5483f9f6bb268f42b70eef227e268f8e28922f01 temp commit: run test_integration/test_caless.py::TestCertInstall

master:

  • 1dd98d251 Revert "temp commit: run test_integration/test_caless.py::TestCertInstall"
Edited by frenaud
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.