freeipa

#8164 Renewed certs are not picked up by IPA CAs
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1788907

Description of problem:
When the CA subsystem below associated certs renewal is due:
~~~
'subsystemCert cert-pki-ca'
'ocspSigningCert cert-pki-ca'
'auditSigningCert cert-pki-ca'
'/var/lib/ipa/ra-agent.pem'
~~~
A non-renewal master CA might submit a renewal request before the renewal
master actually updating the certs. This is expected.
But, if certmonger on this node is stopped/interrupted for any reason while the
resubmit request is in "CA_WORKING" state it will not be able to track changes
to this cert anymore.
Version-Release number of selected component (if applicable):
certmonger-0.78.4-11.el7.x86_64
ipa-server-4.6.5-11.el7_7.3.x86_64
How reproducible:
Always
Steps to Reproduce:
1- Install an IPA master + one or more CA replicas, self signed certs.
2- On a non-renewal master resubmit a cert request:
  # getcert resubmit -f /var/lib/ipa/ra-agent.pem
3- while the submission is in "CA_WORKING" state, stop then start certmonger
4- Now we'll get invalid cookie state for "ra-agent.pem"
   # getcert list -f /var/lib/ipa/ra-agent.pem
    [...]
    ca-error: Invalid cookie: u''
    [...]
5- This CA will not pickup any changes to this cert anymore.
Actual results:
Newly generated certs by the renewal master are not picked by affected CAs.
Breaking operations related to certs. For example, ipa host-add/host-del
Expected results:
Certmonger track certs in between reboots/interruptions and while in
"CA_WORKING" state.

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1788907

Metadata Update from @rcritten:
- Issue assigned to rcritten

master:

  • b5b9efeb57c010443c33c6f14f831abdbd804e78 Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit

ipa-4-8:

  • 3d7d58d8214f3c899c0afd1a3a6a6678f38b7b39 Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit

ipa-4-7:

  • e5983600bfc0f143c3a6732be6532e48d9faaf15 Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit

ipa-4-6:

  • 73d415b72da8a57a2369a55b1533b45f36daf544 Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 58ad7b74eb4136ff8cd10ad6caf463df7403f5b3 Test to check if Certmonger tracks certs in between reboots/interruptions and while in "CA_WORKING" state

ipa-4-8:

  • 77409e2be01984ff9bdd61989a94845cf9206116 Test to check if Certmonger tracks certs in between reboots/interruptions and while in "CA_WORKING" state

ipa-4-6:

  • f77c2f122802aad38aa12e5fc6c9cc49aaa49dfa Test to check if Certmonger tracks certs in between reboots/interruptions and while in "CA_WORKING" state
  • 4235ccba769653fc0d906d4c79bdde5dbfcdad74 ipatests: run test_integration/test_cert.py in PR-CI
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.