freeipa

#8712 Support new baseURL config option for ACME
Closed: fixed by abbra. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

ACME uses nonce values to prevent replay attacks. Since the ipa-ca name can go to any of the IPA servers in order to verify the nonce the servers need to know the value that was set which relies on replication. Sometimes the client is faster than replication so a request can fail.

The PKI team addressed this in upstream PR https://github.com/dogtagpki/pki/pull/3435

A new option was added, baseURL, so that upon discovery the ACME server returns the real hostname to bind the client to it.

We can add support now even prior to the upstream builds being available and the option will be ignored in the config file. Once the updated build is available then it should just work(tm).

https://github.com/freeipa/freeipa/pull/5531

master:

  • d2d487bcccf6365ad4302106e13d9588722f7b33 Set the ACME baseURL in order to pin a client to a single IPA server
  • b1e72cb12e3b0357edfb37652e564529528271a9 Add versions to the ACME config templates and update on upgrade
  • 3d2d06719fccd5d42207acceb686edea392b1899 Add some logging around initial ACME deployment

ipa-4-9:

  • a16dc59447bceab9df7d0597e81af2f1a525ce4c Set the ACME baseURL in order to pin a client to a single IPA server
  • 31061c60af065d7251a7aaf6d5c93e86434d12f2 Add versions to the ACME config templates and update on upgrade
  • 6526ab48a36b068de1970a2685dcedcf4b278bd3 Add some logging around initial ACME deployment

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1928900

Issue linked to Bugzilla: Bug 1928900
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.