freeipa

#9364 DNS: TLSA record added with nsupdate not shown in CLI or web
Opened by jjakob. Modified

Open
Close Issue

Issue

TLSA records added with nsupdate are not shown in cli or web.

Steps to Reproduce

1.
edit zone BIND update policy, add grant EXAMPLE.COM krb5-self . TLSA;
2.
on host my.example.com:

# kinit -k host/my.example.com@EXAMPLE.COM
# nsupdate -g
update add my.example.com 1200 IN TLSA 3 1 1 f00d34db33f00000000000000000000000000000000000000000000000000000
send
> > ^C

3.
check record works

dig +short @ipaserver my.example.com TLSA
3 1 1 f00d34db33f00000000000000000000000000000000000000000000000000000

4.
try to find it in ipa cli or web

cli shows an emtpy TLSA record

# ipa dnsrecord-show example.com my
  Record name: my
  A record: 192.0.2.2
  TLSA record:

web shows no TLSA record at all

Version/Release/Distribution

 # rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.9.10-9.module+el8.7.0+1119+c1de6b59.x86_64
ipa-client-4.9.10-9.module+el8.7.0+1119+c1de6b59.x86_64
389-ds-base-1.4.3.30-6.module+el8.7.0+1060+852806e7.x86_64
package pki-ca is not installed
krb5-server-1.18.2-22.el8_7.x86_64

Can you show an ldap record for this one?

 
# ldapsearch -Q -LLL -o ldif_wrap=no -b 'idnsname=my,idnsname=example.com.,cn=dns,dc=example,dc=com'
dn: idnsname=my,idnsname=example.com.,cn=dns,dc=example,dc=com
dNSTTL: 1200
TLSARecord: 3 1 1 F00D34DB33F000000000000000000000000000000000000000000000 00000000
aRecord: 192.0.2.2
objectClass: top
objectClass: idnsrecord
idnsName: my

The space after character 56 of the data field is actually present in the dig output as well (I mistakenly didn't include it when redacting the actual record, which contains an actual public key hash and not this made up value)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.