freeipa

#8614 Remove ca.crt from the system-wide store on uninstall
Opened by abbra. Modified

Open
Close Issue

On Fedora 34 and any earlier version with systemd-wide certificate store, when uninstalling IPA server, /etc/ipa/ca.crt is still left intact. It is also left intact in the system-wide store.

This makes reinstalling on the same machine impossible because directory server configuration will fail:

....
  [24/28]: importing IPA certificate profiles
  [25/28]: adding default CA ACL
  [26/28]: adding 'ipa' CA entry
  [27/28]: configuring certmonger renewal for lightweight CAs
  [28/28]: deploying ACME service
Done configuring certificate server (pki-tomcatd).
Configuring directory server (dirsrv)
  [1/3]: configuring TLS for DS instance
  [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-IPA2-TEST/', '-A', '-n', 'IPA2.TEST IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-IPA2-TEST/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n')
CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-IPA2-TEST/', '-A', '-n', 'IPA2.TEST IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-IPA2-TEST/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n')
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information

The reason for that is the fact that NSS database automatically imports system-wide store which still has old IPA CA certificate in it. Removing /etc/ipa/ca.crt and re-running update-ca-trust is enough to get rid of it.

I think we should add this step for uninstaller on the platforms where update-ca-trust does exist.

Hi, I've tried to reproduce this in Fedora 33 and 34 and the uninstaller seems to remove the cert just fine. Could you please add more info on how to reproduce the bug? This task: https://github.com/freeipa/freeipa/blob/master/ipaplatform/redhat/tasks.py#L289 seems to run during the uninstall process.

Try to install/reinstall several times. I can see that we call tasks.platform_remove_ca_certs in the client uninstall code unconditionally but it looks like there are situations when this code is not really updating the system-wide CA store because I got this reproduced in F33/34 and RHEL 8. Not on every reinstall but often enough.

master:

  • 6f830ae1ad1ee62a597bcfad81c9d6a4784c24ee Test that IPA certs are removed on server uninstall
  • 79d9790c9954ec6ab97e8285074f6cf41e346879 Check that IPA cert is added to trust store after server install

ipa-4-9:

  • 2a86a93e560e1d9ade2f78b0cf82d93b8833eb39 Test that IPA certs are removed on server uninstall
  • 2715fbd4a73115949264298858ed0835fe982164 Check that IPA cert is added to trust store after server install

ipa-4-8:

  • 2dfc8741648f908d80ce4f888a99e0ff53466fa7 Test that IPA certs are removed on server uninstall
  • 902be98a80f73b13009199357244a2bc732a37f0 Check that IPA cert is added to trust store after server install

Metadata Update from @rcritten:
- Issue assigned to antorres
- Issue priority set to: normal

I see the PRs have merged, can we close this?

Not sure we can close this. The commits added tests to check that the server creates/deletes cert on install/uninstall, but I wasn't able to reproduce the bug itself.

The CA cert is removed as one of the very last things in the client uninstaller. If the client has no remaining state but that file exists then it won't be removed no matter how many times you re-run --uninstall. A couple of random ideas, all of which could be terrible:

  • move the removal of the three certificates earlier in the uninstaller. I haven't deeply thought about whether the cert would be used at all but it seems unlikely once the client is unregistered. I guess it depends on how early it is moved.
  • create a state that the certificate was created which will allow it to be removed with another ipa-server-install --uninstall (or client uninstall). This would be for new installs only.
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.