freeipa

#8986 ipa cert-request replaces user certificate instead of adding
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 1999893

Description of problem:
Requesting multiple certificates for IPA users results in only the last one in
the userCertificate for the user.
Version-Release number of selected component (if applicable):
ipa-client-4.9.6-4.module+el8.5.0+11912+1b4496cf.x86_64
How reproducible:
Seems easy from my test env.  Maybe consistent.
Steps to Reproduce:
1. Install IPA server and kinit admin
2. Add user:
ipa user-add testuser1 --first=test --last=user
3. Request 1st Certificate:
ID=1
openssl req -new -newkey rsa:2048 -keyout test${ID}.key -nodes -out
test${ID}.csr -subj '/CN=testuser1'
ipa cert-request test${ID}.csr --principal=testuser1
--certificate-out=test${ID}.crt
4. Display user info including certificate(s):
ipa user-show testuser1
5. Request 2nd Certificate:
ID=2
openssl req -new -newkey rsa:2048 -keyout test${ID}.key -nodes -out
test${ID}.csr -subj '/CN=testuser1'
ipa cert-request test${ID}.csr --principal=testuser1
--certificate-out=test${ID}.crt
6. Display user info including certificate(s):
ipa user-show testuser1
Actual results:
Shows only the 2nd certificate for testuser1
Expected results:
Shos both certificates for testuser1
Additional info:
Example:
# ID=1
# openssl req -new -newkey rsa:2048 -keyout test${ID}.key -nodes -out
test${ID}.csr -subj '/CN=testuser1'
Generating a RSA private key
......................................+++++
......+++++
writing new private key to 'test1.key'
-----
# ipa cert-request test${ID}.csr --principal=testuser1
--certificate-out=test${ID}.crt
  Issuing CA: ipa
  Certificate: MIIEkzCCAvugAwIBAgIBFTANBgkqhkiG9w0BAQsFADA5MRcwFQYDVQQKDA5TTUFS
VENBUkQuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIxMDgzMTIzMDQzOVo
XDTIzMDkwMTIzMDQzOVowLTEXMBUGA1UECgwOU01BUlRDQVJELlRFU1QxEjAQBgNVBAMMCXRlc3R1c2
VyMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMnaTKQ6nBe2cCEmq9oNTM2/oQSq1HmgF
fwS/aPkpe+Y0wkbll8SnPpWe4rhme5oWgC5Ojwivcnjds3446R1sPrVMpE+IVyWBawOCXc3Hx4/G0rr
Nndlmbllmv7VmvBpwhUZSWRV6M2WXw9eIJTBDMH+4WyRdPt8L/FnqDu5d+0UO5SouKlYO0mosvqA6Tp
MHua8hCwsR43kzCjcjU1Aqy1QYp68A16vRrKeKmQMYKvp3OQXLcA5Q0N417yBJCfmLW1DTvh6NkJDV8
03cpo601A0XR2aYzO5VJaXER8YYbDuzTquMjoyK2cQXPFAhv/aVafbMw+6bcBz1aGSuXDHb0MCAwEAA
aOCATAwggEsMB8GA1UdIwQYMBaAFCRE6MZj9AKVp5UdMNJiR9WJy6SuMEAGCCsGAQUFBwEBBDQwMjAw
BggrBgEFBQcwAYYkaHR0cDovL2lwYS1jYS5zbWFydGNhcmQudGVzdC9jYS9vY3NwMA4GA1UdDwEB/wQ
EAwIE8DAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIweQYDVR0fBHIwcDBuoDagNIYyaHR0cD
ovL2lwYS1jYS5zbWFydGNhcmQudGVzdC9pcGEvY3JsL01hc3RlckNSTC5iaW6iNKQyMDAxDjAMBgNVB
AoMBWlwYWNhMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHQYDVR0OBBYEFG2Aa1naPFsK
CJ7vHM5ZJxbMM2l5MA0GCSqGSIb3DQEBCwUAA4IBgQA/mwyKBLtJk6M7Pc7jUZKPzHz4pbVDz7mhqlT
yJoF7jg5E4j36aC8lUUOg7w7fqID+w/Po1Bcc4nkssWc1ZuwLr0pu0k9F9IagcN3vCXbmno6S/3en+Z
f8FD4vkfrQymU0QwUx9mof0d0CpeIlElrWjuOCCmMik1BPDR7S1ZW/Yy7zDKEtaStjyk10Lw5yEikS+
u3RDb18qu1YRukE1z7PvRQmQWN1eTCKQ52g4iywuRXeYlRvB7+bMLxGYB0yLE9AMeg7hzLfm9FuVSZf
GbJADYxSXyJe7TmLGD/WUAlCmDiM5xcV8IgWgXN/PZZtYbRylDMSv7yt4TL98eomU/QuRh7akoRp3HK
zE2heyZpjQKXyOA6S/FlVRGx0R+0OdqkKJE0sI8OcuNQ4b1LSFhAZ//mPOLJ9QmCu4UNE/QIU5xeUCl
KLDBT2vguZ7kk3Q+fMfNuUYv1xyrJNZtNvCb9FEDnXkcD2u2tNzEtG1Vsbr/dwLfCLWUArx6kGKj6Bz
RY=
  Subject: CN=testuser1,O=SMARTCARD.TEST
  Issuer: CN=Certificate Authority,O=SMARTCARD.TEST
  Not Before: Tue Aug 31 23:04:39 2021 UTC
  Not After: Fri Sep 01 23:04:39 2023 UTC
  Serial number: 21
  Serial number (hex): 0x15
# ipa user-show testuser1
  User login: testuser1
  First name: test
  Last name: user1
  Home directory: /home/testuser1
  Login shell: /bin/sh
  Principal name: testuser1@SMARTCARD.TEST
  Principal alias: testuser1@SMARTCARD.TEST
  Email address: testuser1@smartcard.test
  UID: 249200014
  GID: 249200014
  Certificate: MIIEkzCCAvugAwIBAgIBFTANBgkqhkiG9w0BAQsFADA5MRcwFQYDVQQKDA5TTUFS
VENBUkQuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIxMDgzMTIzMDQzOVo
XDTIzMDkwMTIzMDQzOVowLTEXMBUGA1UECgwOU01BUlRDQVJELlRFU1QxEjAQBgNVBAMMCXRlc3R1c2
VyMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMnaTKQ6nBe2cCEmq9oNTM2/oQSq1HmgF
fwS/aPkpe+Y0wkbll8SnPpWe4rhme5oWgC5Ojwivcnjds3446R1sPrVMpE+IVyWBawOCXc3Hx4/G0rr
Nndlmbllmv7VmvBpwhUZSWRV6M2WXw9eIJTBDMH+4WyRdPt8L/FnqDu5d+0UO5SouKlYO0mosvqA6Tp
MHua8hCwsR43kzCjcjU1Aqy1QYp68A16vRrKeKmQMYKvp3OQXLcA5Q0N417yBJCfmLW1DTvh6NkJDV8
03cpo601A0XR2aYzO5VJaXER8YYbDuzTquMjoyK2cQXPFAhv/aVafbMw+6bcBz1aGSuXDHb0MCAwEAA
aOCATAwggEsMB8GA1UdIwQYMBaAFCRE6MZj9AKVp5UdMNJiR9WJy6SuMEAGCCsGAQUFBwEBBDQwMjAw
BggrBgEFBQcwAYYkaHR0cDovL2lwYS1jYS5zbWFydGNhcmQudGVzdC9jYS9vY3NwMA4GA1UdDwEB/wQ
EAwIE8DAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIweQYDVR0fBHIwcDBuoDagNIYyaHR0cD
ovL2lwYS1jYS5zbWFydGNhcmQudGVzdC9pcGEvY3JsL01hc3RlckNSTC5iaW6iNKQyMDAxDjAMBgNVB
AoMBWlwYWNhMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHQYDVR0OBBYEFG2Aa1naPFsK
CJ7vHM5ZJxbMM2l5MA0GCSqGSIb3DQEBCwUAA4IBgQA/mwyKBLtJk6M7Pc7jUZKPzHz4pbVDz7mhqlT
yJoF7jg5E4j36aC8lUUOg7w7fqID+w/Po1Bcc4nkssWc1ZuwLr0pu0k9F9IagcN3vCXbmno6S/3en+Z
f8FD4vkfrQymU0QwUx9mof0d0CpeIlElrWjuOCCmMik1BPDR7S1ZW/Yy7zDKEtaStjyk10Lw5yEikS+
u3RDb18qu1YRukE1z7PvRQmQWN1eTCKQ52g4iywuRXeYlRvB7+bMLxGYB0yLE9AMeg7hzLfm9FuVSZf
GbJADYxSXyJe7TmLGD/WUAlCmDiM5xcV8IgWgXN/PZZtYbRylDMSv7yt4TL98eomU/QuRh7akoRp3HK
zE2heyZpjQKXyOA6S/FlVRGx0R+0OdqkKJE0sI8OcuNQ4b1LSFhAZ//mPOLJ9QmCu4UNE/QIU5xeUCl
KLDBT2vguZ7kk3Q+fMfNuUYv1xyrJNZtNvCb9FEDnXkcD2u2tNzEtG1Vsbr/dwLfCLWUArx6kGKj6Bz
RY=
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False
# ID=2
# openssl req -new -newkey rsa:2048 -keyout test${ID}.key -nodes -out
test${ID}.csr -subj '/CN=testuser1'
Generating a RSA private key
............................................+++++
.....+++++
writing new private key to 'test2.key'
-----
# ipa cert-request test${ID}.csr --principal=testuser1
--certificate-out=test${ID}.crt
  Issuing CA: ipa
  Certificate: MIIEkzCCAvugAwIBAgIBFjANBgkqhkiG9w0BAQsFADA5MRcwFQYDVQQKDA5TTUFS
VENBUkQuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIxMDgzMTIzMDUyOVo
XDTIzMDkwMTIzMDUyOVowLTEXMBUGA1UECgwOU01BUlRDQVJELlRFU1QxEjAQBgNVBAMMCXRlc3R1c2
VyMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMhdEPugyLvpN2skO+jwhjb+069HOh/+b
hkDOoY6EVSCzuqYhmYkOyM4DCk/Gp3GBelMqSxEf7nYdtNYEnhraQxKK/sN9EeLPpIvftxyxFz7via+
x3eQuxUi3mtfDKWYntnBlB1wIXIFthZjH1KdAhcwEsrYL4rPTjPG7laGKh0LBNkvSLt/tNeydbd+Atn
Ea3Yw7WQn8N4vdykWEC+c+bVEfpDK1XxKSRf84PyP/evPf+pxJuNk/LfwHgi7Gav1J6xZH3VSsGxEn2
hk9qFiuOY66s3FbPtbfpxWN6rRH5NwCL+BhNtgLPXpH8BmSbkqfVUdPDRHZSGJyCfS7H2Av6sCAwEAA
aOCATAwggEsMB8GA1UdIwQYMBaAFCRE6MZj9AKVp5UdMNJiR9WJy6SuMEAGCCsGAQUFBwEBBDQwMjAw
BggrBgEFBQcwAYYkaHR0cDovL2lwYS1jYS5zbWFydGNhcmQudGVzdC9jYS9vY3NwMA4GA1UdDwEB/wQ
EAwIE8DAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIweQYDVR0fBHIwcDBuoDagNIYyaHR0cD
ovL2lwYS1jYS5zbWFydGNhcmQudGVzdC9pcGEvY3JsL01hc3RlckNSTC5iaW6iNKQyMDAxDjAMBgNVB
AoMBWlwYWNhMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHQYDVR0OBBYEFBnsZhPkfuzJ
ryoAPY1h5g/walNPMA0GCSqGSIb3DQEBCwUAA4IBgQCYDi3nTXwOe2/4rOu+Magl8DKurZI4KB3zrHC
x9OdEYW6ayopYDT8ZRGh47R4XDENhoexAYrr2uwVeXycyHpGcXTV7121Jst/X3nE9shZhrHGJQZtQkC
aLwRM4l4tSf8tfRWuFuMTOUeIFWD9+jXeDnDefbYrjRuWm56F9guUjqlK5fHBpC/CCdDxbPi50EnwWQ
yumPxXycr3CF3rJyGtRIMrOPOs3AJx2PvXtDclVDjxiwGZq5lf8v+iR/FuBzGJJdJFT/r+6JU4dHm+J
AQdlQFLa87qiclGAcBFqbAOE5ZRlJq6PPz0nEl7NN0mf44VTYlYdTzTifGpHAsO9vYfQFvg6jTxSrdU
162qCRAJlDDftpaFRJJWIu8flqPwoGGCuUbciTXVImd46wW7VXpLe734xTThnx6wcmdQJr/WI9Qazl0
fhncNDDFKRvDsUOrj6cDPzkOFKinyHBDsnyTTlr5zZ3CDYq+TY2zrAViYAjqmU/z8FrrGR4ddtnzoQj
7U=
  Subject: CN=testuser1,O=SMARTCARD.TEST
  Issuer: CN=Certificate Authority,O=SMARTCARD.TEST
  Not Before: Tue Aug 31 23:05:29 2021 UTC
  Not After: Fri Sep 01 23:05:29 2023 UTC
  Serial number: 22
  Serial number (hex): 0x16
# ipa user-show testuser1
  User login: testuser1
  First name: test
  Last name: user1
  Home directory: /home/testuser1
  Login shell: /bin/sh
  Principal name: testuser1@SMARTCARD.TEST
  Principal alias: testuser1@SMARTCARD.TEST
  Email address: testuser1@smartcard.test
  UID: 249200014
  GID: 249200014
  Certificate: MIIEkzCCAvugAwIBAgIBFjANBgkqhkiG9w0BAQsFADA5MRcwFQYDVQQKDA5TTUFS
VENBUkQuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIxMDgzMTIzMDUyOVo
XDTIzMDkwMTIzMDUyOVowLTEXMBUGA1UECgwOU01BUlRDQVJELlRFU1QxEjAQBgNVBAMMCXRlc3R1c2
VyMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMhdEPugyLvpN2skO+jwhjb+069HOh/+b
hkDOoY6EVSCzuqYhmYkOyM4DCk/Gp3GBelMqSxEf7nYdtNYEnhraQxKK/sN9EeLPpIvftxyxFz7via+
x3eQuxUi3mtfDKWYntnBlB1wIXIFthZjH1KdAhcwEsrYL4rPTjPG7laGKh0LBNkvSLt/tNeydbd+Atn
Ea3Yw7WQn8N4vdykWEC+c+bVEfpDK1XxKSRf84PyP/evPf+pxJuNk/LfwHgi7Gav1J6xZH3VSsGxEn2
hk9qFiuOY66s3FbPtbfpxWN6rRH5NwCL+BhNtgLPXpH8BmSbkqfVUdPDRHZSGJyCfS7H2Av6sCAwEAA
aOCATAwggEsMB8GA1UdIwQYMBaAFCRE6MZj9AKVp5UdMNJiR9WJy6SuMEAGCCsGAQUFBwEBBDQwMjAw
BggrBgEFBQcwAYYkaHR0cDovL2lwYS1jYS5zbWFydGNhcmQudGVzdC9jYS9vY3NwMA4GA1UdDwEB/wQ
EAwIE8DAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIweQYDVR0fBHIwcDBuoDagNIYyaHR0cD
ovL2lwYS1jYS5zbWFydGNhcmQudGVzdC9pcGEvY3JsL01hc3RlckNSTC5iaW6iNKQyMDAxDjAMBgNVB
AoMBWlwYWNhMR4wHAYDVQQDDBVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHQYDVR0OBBYEFBnsZhPkfuzJ
ryoAPY1h5g/walNPMA0GCSqGSIb3DQEBCwUAA4IBgQCYDi3nTXwOe2/4rOu+Magl8DKurZI4KB3zrHC
x9OdEYW6ayopYDT8ZRGh47R4XDENhoexAYrr2uwVeXycyHpGcXTV7121Jst/X3nE9shZhrHGJQZtQkC
aLwRM4l4tSf8tfRWuFuMTOUeIFWD9+jXeDnDefbYrjRuWm56F9guUjqlK5fHBpC/CCdDxbPi50EnwWQ
yumPxXycr3CF3rJyGtRIMrOPOs3AJx2PvXtDclVDjxiwGZq5lf8v+iR/FuBzGJJdJFT/r+6JU4dHm+J
AQdlQFLa87qiclGAcBFqbAOE5ZRlJq6PPz0nEl7NN0mf44VTYlYdTzTifGpHAsO9vYfQFvg6jTxSrdU
162qCRAJlDDftpaFRJJWIu8flqPwoGGCuUbciTXVImd46wW7VXpLe734xTThnx6wcmdQJr/WI9Qazl0
fhncNDDFKRvDsUOrj6cDPzkOFKinyHBDsnyTTlr5zZ3CDYq+TY2zrAViYAjqmU/z8FrrGR4ddtnzoQj
7U=
  Account disabled: False
  Password: False
  Member of groups: ipausers
  Kerberos keys available: False

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1999893

https://github.com/freeipa/freeipa/pull/6015

Metadata Update from @rcritten:
- Issue assigned to rcritten

master:

  • ba526c5cb030ce7b90f0223b7e9b598b14166ca6 Don't store entries with a usercertificate in the LDAP cache
  • 540b01bc6ea17453d9ed91822c9ed208e443e5c9 ipatests: Test that a user can be issued multiple certificates

ipa-4-9:

  • be1e3bbfc13aff9a583108376f245b81cc3666fb Don't store entries with a usercertificate in the LDAP cache
  • 86588640137562b2016fdb0f91142d00bc38e54a ipatests: Test that a user can be issued multiple certificates

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @rcritten:
- Custom field changelog adjusted to By default IPA caches LDAP entries within a given request. Entries with a userCertificate value are not cached because the attribute may be represented with or without a ;binary tag and this confuses the cache. This will be revisted in the future but for now we are favoring correctness over speed.
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.