freeipa

#8924 ipa-client-install fails to install on Ubuntu 20.04 LTS due to incorrect cert name
Closed: fixed by rcritten. Opened by michal.mrozowski.

Closed: fixed
Reopen Issue

Hello, I'm trying to install the IPA client on Ubuntu 20.04 with no luck so far. What I found is that this issue occurs on Ubuntu but not on the Centos.

Issue

This issue is about the way in which ipa-client-install on debian/ubuntu platform. I've checked the source code of ipaplatform/debian/tasks.py. Where you can find this comment: 

# Construct the certificate filename using the Subject DN so that
# the user can see which CA a particular file is for, and include
# the serial number to disambiguate clashes where a subordinate CA
# had a new certificate issued.
#
# Strictly speaking, certificates are uniquely idenified by (Issuer
# DN, Serial Number). Do we care about the possibility of a clash
# where a subordinate CA had two certificates issued by different
# CAs who used the same serial number?)
filename = f'{subject.ldap_text()} {cert.serial_number}.crt'

In my situation the Subject of the problematic cert is: "CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US" and serial number is "7". Which I suppose is the root cause of errors because ipa cannot create file with such name in Ubuntu (see Actual behavior).

Steps to Reproduce

  1. Install ipa-client and dependencies on Ubuntu 20.04
  2. Run the following command:
    ipa-client-install \
    --no-ntp \
    --mkhomedir \
    --enable-dns-updates \
    --hostname=app-preprod-1.example.com \
    --domain= ipa.example.com \
    --server=ipa.example.com \
    --principal="principal" \
    --password="password" \
    --fixed-primary \
    --unattended

Actual behavior

Even though I get "The ipa-client-install command was successful" message at the end of the installation process. IPA users are not able to ssh to the system.

This is the output with the error:

  This program will set up FreeIPA client.
  Version 4.8.6
  Client hostname: app-preprod-12.ipa.example.com
  Realm: IPA.EXAMPLE.COM
  DNS Domain: ipa.example.com
  IPA Server: ipa.example.com
  BaseDN: dc=ipa,dc=example,dc=com
  Skipping chrony configuration
  Successfully retrieved CA cert
      Subject:     CN=Certificate Authority,O=IPA.EXAMPLE.COM
      Issuer:      CN=Certificate Authority,O=IPA.EXAMPLE.COM
      Valid From:  2020-01-20 11:41:44
      Valid Until: 2040-01-20 11:41:44
      Subject:     OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US
      Issuer:      OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US
      Valid From:  2004-06-29 17:06:20
      Valid Until: 2034-06-29 17:06:20
      Subject:     CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
      Issuer:      CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
      Valid From:  2011-05-03 07:00:00
      Valid Until: 2031-05-03 07:00:00
      Subject:     CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
      Issuer:      OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US
      Valid From:  2014-01-01 07:00:00
      Valid Until: 2031-05-30 07:00:00
  Enrolled in IPA realm IPA.EXAMPLE.COM
  Created /etc/ipa/default.conf
  Configured sudoers in /etc/nsswitch.conf
  Configured /etc/sssd/sssd.conf
  Configured /etc/krb5.conf for IPA realm IPA.EXAMPLE.COM
  Could not create /usr/local/share/ca-certificates/ipa-ca/CN=Go Daddy Secure Certificate Authority - G2,OU=http:/certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US 7.crt
  Could not populate systemwide CA store
  Traceback (most recent call last):
    File "/usr/lib/python3/dist-packages/ipaplatform/base/tasks.py", line 75, in insert_ca_certs_into_systemwide_ca_store
      if self.platform_insert_ca_certs(ca_certs):
    File "/usr/lib/python3/dist-packages/ipaplatform/debian/tasks.py", line 108, in platform_insert_ca_certs
      self.write_ca_certificates_dir(
    File "/usr/lib/python3/dist-packages/ipaplatform/debian/tasks.py", line 152, in write_ca_certificates_dir
      f = open(cert_path, 'w')
  FileNotFoundError: [Errno 2] No such file or directory: '/usr/local/share/ca-certificates/ipa-ca/CN=Go Daddy Secure Certificate Authority - G2,OU=http:/certs.godaddy.com/repository/,O=GoDaddy.com\\, Inc.,L=Scottsdale,ST=Arizona,C=US 7.crt'
  Failed to update DNS records.
  Extra A/AAAA record(s) for host app-preprod-12.ipa.example.com: fe80::892:96ff:fe18:996a.
  Incorrect reverse record(s):
  172.31.47.215 is pointing to ip-172-31-47-215.us-east-2.compute.internal. instead of app-preprod-12.ipa.example.com.

Expected behavior

ipa-client-install finishes without any errors and the client system is properly provisioned, users can ssh using ipa accounts.

Version/Release/Distribution

Client:
Ubuntu 20.04.2 LTS (Focal Fossa)
freeipa-client: 4.8.6
Server:
CentOS 7
freeipa-server: 4.6.6

Additional info:

I would like to mention that on Ubuntu current version of ipa-client is 4.8.6 and on Centos is 4.9.2 but I have not found any change in git log related to this issue.

@tjaalton FYI

OpenSSL uses hashed file names for a reason. Perhaps we can use a similar approach here?

A simple fix that replaces \n (and \0) characters with - is here: https://github.com/freeipa/freeipa/pull/7900

We could run openssl x509 -in foo.crt -subject_hash and use the output filename for each one... but there's a tiny chance of collisions, and dealing with that will complicate the code.

master:

  • 64809910912237ff40a18eeda9ed1c9e2e21dfaa Fix ipa-client-install failure when a trusted CA's distinguished name contains slash characters

ipa-4-12:

  • 09acc861692d265b72d058192f9dd6f07581839c Fix ipa-client-install failure when a trusted CA's distinguished name contains slash characters

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.