freeipa

#7928 cn=cacert could show expired certificate
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1544470

Description of problem:
this bug is related to
https://bugzilla.redhat.com/show_bug.cgi?id=1543335
 rhel6 ipa-client fails to retrieve right CA certificates, particularly when
external CA installed
When installing a RHEL6 client, ipa-client-install is retrieving the
certificate from ldap. In the case of RHEL6, the certificate is taken from:
    dn = DN(('cn', 'CAcert'), ('cn', 'ipa'), ('cn', 'etc'), basedn)
it has happened that if the CA was expired and re-newed it (in the customer
case was external CA), this entry is not updated and only the ones at
"cn=certificates".
It could be interesting to replace the usercertificate in this entry so as the
certificate retrieved in case of RHEL6 client will not show as expired one.
In the scenario where we have had this, the customer was using external CA. I
don't have an exact reproducer but as we have seen that the CA cert in
cn=cacert was still expired, we have agreed to report this new bug.
Version-Release number of selected component (if applicable): master 7.4
(latest) / client 6.9 (latest).

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1544470

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/3169
- Issue set to the milestone: FreeIPA 4.6.6

master:

  • 9cd88587e45c4a588b4cbd9ce1eb31d4a0c711b0 CA: set ipaconfigstring:compatCA in cn=DOMAIN IPA CA
  • 4804103315617bf1fab1db84a3ed4737418b4908 ipatests: CA renewal must refresh cn=CAcert

ipa-4-7:

  • 5d0ed95344115508e001cad9e87d60686ed4db23 CA: set ipaconfigstring:compatCA in cn=DOMAIN IPA CA
  • 180cbdd67fdf03e6b23293e30148381dfd6b6abe ipatests: CA renewal must refresh cn=CAcert

ipa-4-6:

  • c442b95db57a3f56f291de35e6f11767c1dbaf9f CA: set ipaconfigstring:compatCA in cn=DOMAIN IPA CA
  • c3e6abfe687dc3540adfde72d6a5225444b23ee1 ipatests: CA renewal must refresh cn=CAcert

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/3169
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.