freeipa

#9184 Error when upgrading to from Fedora 35 to Fedora 36
Closed: duplicate by jsf9k. Opened by jsf9k.

Closed: duplicate
Reopen Issue

Request for enhancement

As the administrator of a FreeIPA cluster, I want to seamlessly upgrade my FreeIPA cluster from Fedora 35 to Fedora 36.

Issue

I have a FreeIPA cluster running in AWS. I upgrade the cluster by removing one server instance from the cluster, re-launching that instance using an updated AMI, and then installing FreeIPA on that instance as a replica. This procedure has worked many times in the past.

When I attempted to upgrade my cluster from Fedora 35 to Fedora 36, I immediately hit a roadblock:

Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
  [1/30]: creating certificate server db
  [2/30]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 12 seconds elapsed
Update succeeded
  [3/30]: creating ACIs for admin
  [4/30]: creating installation admin user
  [5/30]: configuring certificate server instance
  [6/30]: stopping certificate server instance to update CS.cfg
  [7/30]: backing up CS.cfg
  [8/30]: Add ipa-pki-wait-running
  [9/30]: secure AJP connector
  [10/30]: reindex attributes
  [11/30]: exporting Dogtag certificate store pin
  [12/30]: disabling nonces
  [13/30]: set up CRL publishing
  [14/30]: enable PKIX certificate path discovery and validation
  [15/30]: authorizing RA to modify profiles
  [16/30]: authorizing RA to manage lightweight CAs
  [17/30]: Ensure lightweight CAs container exists
  [18/30]: Ensuring backward compatibility
  [19/30]: destroying installation admin user
  [20/30]: starting certificate server instance
  [21/30]: Finalize replication settings
  [22/30]: configure certmonger for renewals
  [23/30]: Importing RA key
Error storing key "keys/ra/ipaCert": CalledProcessError(Command ['/usr/libexec/ipa/custodia/ipa-custodia-ra-agent', '--import', '-'] returned non-zero exit status 1: 'Traceback (most recent call last):\n  File "/usr/libexec/ipa/custodia/ipa-custodia-ra-agent", line 8, in <module>\n    main(ra_agent_parser())\n  File "/usr/lib/python3.10/site-packages/ipaserver/secrets/handlers/pemfile.py", line 117, in main\n    common.main(parser, export_key, import_key)\n  File "/usr/lib/python3.10/site-packages/ipaserver/secrets/handlers/common.py", line 73, in main\n    func(args, tmpdir, **kwargs)\n  File "/usr/lib/python3.10/site-packages/ipaserver/secrets/handlers/pemfile.py", line 72, in import_key\n    ipautil.run(cmd, umask=0o027)\n  File "/usr/lib/python3.10/site-packages/ipapython/ipautil.py", line 598, in run\n    raise CalledProcessError(\nipapython.ipautil.CalledProcessError: CalledProcessError(Command [\'/usr/bin/openssl\', \'pkcs12\', \'-in\', \'/tmp/tmpnf76wr7r/import.p12\', \'-clcerts\', \'-nokeys\', \'-out\', \'/var/lib/ipa/ra-agent.pem\', \'-password\', \'file:/tmp/tmpnf76wr7r/passwd\'] returned non-zero exit status 1: \'Error outputting keys and certificates\\nC0F168AECF7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()\\n\')\n')
  [error] FileNotFoundError: [Errno 2] No such file or directory: '/var/lib/ipa/ra-agent.key'
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
[Errno 2] No such file or directory: '/var/lib/ipa/ra-agent.key'
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

The root issue appears to be that the RC2-40-CBC algorithm being used by the RA key is no longer supported by the version of OpenSSL on Fedora 36. Is there any way to work around this issue, perhaps by safely update the RA key in place before attempting the upgrade?

Steps to Reproduce

  1. Create a Fedora 35 FreeIPA cluster.
  2. Attempt to add a Fedora 36 FreeIPA server as a replica.

Actual behavior

The failure as described above.

Expected behavior

No failure.

Version/Release/Distribution

Fedora 35:

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.9.8-1.fc35.x86_64
freeipa-client-4.9.8-1.fc35.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-2.0.15-1.fc35.x86_64
package pki-ca is not installed
krb5-server-1.19.2-2.fc35.x86_64

Fedora 36:

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.9.9-1.fc36.x86_64
freeipa-client-4.9.9-1.fc36.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-2.1.1-2.fc36.x86_64
package pki-ca is not installed
krb5-server-1.19.2-9.fc36.x86_64

Hi,
the issue looks similar to https://pagure.io/freeipa/issue/9101, that was fixed in 4.9.9.

The fedora 35 server needs to be updated to 4.9.9 before the replica installation happens, and I believe it will solve the issue. Can you try and let us know?

You are correct @frenaud! Thank you!

Metadata Update from @jsf9k:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.