freeipa

#9258 Do not add TLS CA configuration to ldap.conf anymore
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

OpenLDAP made it explicit to use default CA store as provided by OpenSSL in 2016:

branches 2.5 and later:
commit 4962dd6083ae0fe722eb23a618ad39e47611429b
Author: Howard Guo <hguo@suse.com>
Date:   Thu Nov 10 15:39:03 2016 +0100
branch 2.4:
commit e3affc71e05b33bfac43833c7b95fd7b7c3188f8
Author: Howard Guo <hguo@suse.com>
Date:   Thu Nov 10 15:39:03 2016 +0100

This means starting with OpenLDAP 2.4.45 we can drop the explicit CA configuration in dap.conf.

There are several use cases where an explicit IPA CA should be specified in the configuration. These mostly concern situations where a higher security level must be maintained. For these configurations an administrator would need to add an explicit CA configuration to ldap.conf if we wouldn't add it during the ipa-client-install setup. This is worth a release note.

Metadata Update from @abbra:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6496
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2094673

master:

  • 22022ae2ff8d1767bd50eec098eddb02573ea1ae ipaclient: do not set TLS CA options in ldap.conf anymore

ipa-4-10:

  • 93b0e6a96a1aea45adc0d4c8bb26b226ce683573 ipaclient: do not set TLS CA options in ldap.conf anymore

ipa-4-9:

  • d9a56b51bbb350219d0f5cb0ea6b3cc00230d437 ipaclient: do not set TLS CA options in ldap.conf anymore

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.