freeipa

#9285 ipa-certupdate restarts HTTPd too early
Closed: fixed by frenaud. Opened by cheimes.

Closed: fixed
Reopen Issue

Issue

The issue is similar to #9269. Apache is configured to use /etc/ipa/ca.crt to provide CA certs for client cert authentication. The ipa-certupdate script restarts Apache HTTPd before it updates /etc/ipa/ca.crt. Therefore Apache does not recognize any new CA cert until it is restarted a second time.

Version/Release/Distribution

ipa-server-4.10.0-6.el9.x86_64
ipa-client-4.10.0-6.el9.x86_64
389-ds-base-2.1.3-4.el9_1.x86_64
package pki-ca is not installed
krb5-server-1.19.1-22.el9.x86_64

Metadata Update from @cheimes:
- Assignee reset

Fix: Move restart after update_client(certs).

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6573
- Issue assigned to cheimes

master:

  • bb74832f3111b8ecdff2f7ad3de8cc92ead3c458 ipa-certupdate: Update client certs before KDC/HTTPd restart

ipa-4-9:

  • f3052c17599c7318c385b27795678b368906fd26 ipa-certupdate: Update client certs before KDC/HTTPd restart

ipa-4-10:

  • 8e7d1ac4e4779cc15b39a9901bb26c5f5997eb5b ipa-certupdate: Update client certs before KDC/HTTPd restart

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/6573
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.