freeipa

#7877 External CA installation: sanity check pathLenConstraints
Closed: fixed by cheimes. Opened by ftweedal.

Closed: fixed
Reopen Issue

Request for enhancement

As an admin, I want FreeIPA to sanity check the pathLenConstraints in the certificate chain when installing with (or renewing) an externally-signed CA.

Issue

See https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/AKXCAG2NGPWWS2IG5JDVNT76YIFXRWXM/ for description. Installation begins, and fails quite a long way through the CA component installation:

[20/28]: Configure HTTP to proxy connections
[21/28]: restarting certificate server
[22/28]: updating IPA configuration
[23/28]: enabling CA instance
[24/28]: migrating certificate profiles to LDAP
[error] NetworkError: cannot connect to 'https://thisserver.domain.dev:8443/ca/rest/account/login': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) 
ipapython.admintool: ERROR cannot connect to 'https://thisserver.domain.dev:8443/ca/rest/account/login': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) 
ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

The underlying error is:

Certificate path length constraint is invalid. Error code: SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID␣

We should detect this issue during certificate chain validation and not allow installation to proceed.

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2989
- Issue assigned to cheimes
- Issue priority set to: normal
- Issue set to the milestone: FreeIPA 4.7.3

master:

  • 3c354e74f389da6bfd8f444a58cf3900fdf97434 Verify external CA's basic constraint pathlen

ipa-4-7:

  • 18623d490fbca86f4b35f5cfa49740f2a2b42f9a Verify external CA's basic constraint pathlen

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-7:

  • c34819c277c28d622c6a3427701eca74f048686e add test for external CA key size sanity check
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.