freeipa

#9391 ipa-client-samba on Ubuntu 22.04 throws ssl error when IPA Server uses Let's Encrypt certificate
Closed: fixed by kimdre. Opened by kimdre.

Closed: fixed
Reopen Issue

Request for enhancement

As a admin , I want to configure a samba/cifs share on a ipa client on Ubuntu 22.04 using the ipa-client-samba command with a IPA Server that uses Let's Encrypt for it's webserver ssl certificate.

Issue

I use Let's Encrypt to issue certificates for the IPA Webserver, which works fine for all my clients.

However when I try to configure a samba server with ipa-client-samba, it exits with an error that the ssl certificate couldn't be verified because it is self-signed (which is not true).

See the log output below.

Running on the same host for example curl against the, in the debug log shown, api endpoint works just fine (no ssl errors).

Steps to Reproduce

  1. Run IPA Webserver with Let's Encrypt ssl certificate
  2. Verifiy, that IPA Webserver with API Endpoint is indeed secured by Let's Encrypt: curl -vvI https://<IPA SERVER>/ipa/json 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }'
  3. On Ubuntu 22.04 System, that will be a samba server, install freeipa-client-samba:
    apt install freeipa-client-samba
  4. Run ipa-client-samba and let it handle IPA Server autodiscovery, validation and samba server configuration

Actual behavior

  1. Find IPA server with dns discovery
  2. Try to connect to it
  3. Exit with ssl error 
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:997)

Expected behavior

From ipa-client-samba manpage:

During the configuration process, the tool will perform following steps:
1. Discover details of IPA domain: realm, domain SID, domain ID range
2.  Discover details of trusted Actvide Directory domains: domain name, domain SID, domain ID range
3. Create Samba configuration file using the details discovered above.
4. Create Samba Kerberos service using host credentials and fetch its  keytab  into /etc/samba/samba.keytab.  The  Kerberos  service  key  is  pre-set  to  a  randomly generated value that is shared with Samba.
5. Populate Samba  databases  by  setting  the  domain  details  and  the  randomly generated machine account password from the previous step.
6.  Create  a  default  [homes]  share  to  allow  users  to  log  in to their home directories unless --no-homes option was specified.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.10.1-6.el9.aarch64
ipa-client-4.10.1-6.el9.aarch64
389-ds-base-2.2.4-3.el9.aarch64
package pki-ca is not installed
krb5-server-1.20.1-8.el9.aarch64

Additional info:

SSL Certificate on IPA Server:

# curl -vvI https://infra1.prod.maki-it.de/ipa/json 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }'
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=infra1.prod.maki-it.de
*  start date: Jun  7 04:31:38 2023 GMT
*  expire date: Sep  5 04:31:37 2023 GMT
*  subjectAltName: host "infra1.prod.maki-it.de" matched cert's "infra1.prod.maki-it.de"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
* Connection #0 to host infra1.prod.maki-it.de left intact

Full log from ipa-client-samba --debug:

# ipa-client-samba --debug
Searching for IPA server...
[IPA Discovery]
Starting IPA discovery with domain=, servers=, hostname=None
Hostname: admin1.prod.maki-it.de
Start searching for LDAP SRV record in "prod.maki-it.de" (domain of the hostname) and its sub-domains
Search DNS for SRV record of _ldap._tcp.prod.maki-it.de
DNS record found: 0 100 389 infra1.prod.maki-it.de.
[Kerberos realm search]
Search DNS for TXT record of _kerberos.prod.maki-it.de
DNS record found: "PROD.MAKI-IT.DE"
Search DNS for SRV record of _kerberos._udp.prod.maki-it.de
DNS record found: 0 100 88 infra1.prod.maki-it.de.
[LDAP server check]
Verifying that infra1.prod.maki-it.de (realm PROD.MAKI-IT.DE) is an IPA server
Init LDAP connection to: ldap://infra1.prod.maki-it.de:389
Search LDAP server for IPA base DN
Check if naming context 'dc=prod,dc=maki-it,dc=de' is for IPA
Naming context 'dc=prod,dc=maki-it,dc=de' is a valid IPA context
Search for (objectClass=krbRealmContainer) in dc=prod,dc=maki-it,dc=de (sub)
Found: cn=PROD.MAKI-IT.DE,cn=kerberos,dc=prod,dc=maki-it,dc=de
Discovery result: Success; server=infra1.prod.maki-it.de, domain=prod.maki-it.de, kdc=infra1.prod.maki-it.de, basedn=dc=prod,dc=maki-it,dc=de
Validated servers: infra1.prod.maki-it.de
Executing DNS discovery
Autodiscovery success, possible servers infra1.prod.maki-it.de
IPA server: DNS discovery
Configured to use DNS discovery
failed to find session_cookie in persistent storage for principal 'host/admin1.prod.maki-it.de@PROD.MAKI-IT.DE'
trying https://infra1.prod.maki-it.de/ipa/json
Created connection context.rpcclient_140597151525392
[try 1]: Forwarding 'schema' to json server 'https://infra1.prod.maki-it.de/ipa/json'
HTTP connection destroyed (infra1.prod.maki-it.de)
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/ipaclient/remote_plugins/__init__.py", line 125, in get_package
    plugins = api._remote_plugins
AttributeError: 'API' object has no attribute '_remote_plugins'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 693, in single_request
    h = self.make_connection(host)
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 569, in make_connection
    conn.connect()
  File "/usr/lib/python3.10/http/client.py", line 1454, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1071, in _create
    self.do_handshake()
  File "/usr/lib/python3.10/ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:997)
Destroyed connection context.rpcclient_140597151525392
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/ipaclient/remote_plugins/__init__.py", line 125, in get_package
    plugins = api._remote_plugins
AttributeError: 'API' object has no attribute '_remote_plugins'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 1151, in forward
    return self._call_command(command, params)
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 1127, in _call_command
    return command(*params)
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 1281, in _call
    return self.__request(name, args)
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 1244, in __request
    response = self.__transport.request(
  File "/usr/lib/python3.10/xmlrpc/client.py", line 1166, in request
    return self.single_request(host, handler, request_body, verbose)
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 693, in single_request
    h = self.make_connection(host)
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 569, in make_connection
    conn.connect()
  File "/usr/lib/python3.10/http/client.py", line 1454, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1071, in _create
    self.do_handshake()
  File "/usr/lib/python3.10/ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:997)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/ipaclient/install/ipa_client_samba.py", line 48, in use_api_as_principal
    api.finalize()
  File "/usr/lib/python3/dist-packages/ipalib/plugable.py", line 759, in finalize
    self.__do_if_not_done('load_plugins')
  File "/usr/lib/python3/dist-packages/ipalib/plugable.py", line 438, in __do_if_not_done
    getattr(self, name)()
  File "/usr/lib/python3/dist-packages/ipalib/plugable.py", line 638, in load_plugins
    for package in self.packages:
  File "/usr/lib/python3/dist-packages/ipalib/__init__.py", line 949, in packages
    ipaclient.remote_plugins.get_package(self),
  File "/usr/lib/python3/dist-packages/ipaclient/remote_plugins/__init__.py", line 133, in get_package
    plugins = schema.get_package(server_info, client)
  File "/usr/lib/python3/dist-packages/ipaclient/remote_plugins/schema.py", line 552, in get_package
    schema = Schema(client)
  File "/usr/lib/python3/dist-packages/ipaclient/remote_plugins/schema.py", line 401, in __init__
    fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
  File "/usr/lib/python3/dist-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch
    schema = client.forward(u'schema', **kwargs)['result']
  File "/usr/lib/python3/dist-packages/ipalib/rpc.py", line 1192, in forward
    raise NetworkError(uri=server, error=str(e))
ipalib.errors.NetworkError: cannot connect to 'https://infra1.prod.maki-it.de/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:997)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/sbin/ipa-client-samba", line 15, in <module>
    sys.exit(ipa_client_samba.run())
  File "/usr/lib/python3/dist-packages/ipaclient/install/ipa_client_samba.py", line 631, in run
    with use_api_as_principal(api.env.host_princ, paths.KRB5_KEYTAB):
  File "/usr/lib/python3.10/contextlib.py", line 135, in __enter__
    return next(self.gen)
  File "/usr/lib/python3/dist-packages/ipaclient/install/ipa_client_samba.py", line 63, in use_api_as_principal
    if api.Backend.rpcclient.isconnected():
AttributeError: 'API' object has no attribute 'Backend'

How did you install the LE certificate on the IPA server? Did you use ipa-server-certinstall and/or ipa-cacert-manage?

Did you run ipa-certupdate on all enrolled machines after that?

I use this script from your Github repository, which also installs the cert into the IPA cert store: https://github.com/freeipa/freeipa-letsencrypt
I just tried to run ipa-certupdate and I have the problem only on this specific host, all others work fine.
Getting a kerberos ticket worked fine aswell, but trying to obtain the certificates from the IPA server also resulted in this ssl error.
I guess the host is somewhat out of sync or so. Is there a manual method to fix this and update the ipa certs on the client? OR do I need to reinstall the ipa-client?

This looks like a more general issue unrelated to ipa-client-samba.

I'd suggest you to investigate and fix let's encrypt related issues first by going to freeipa-users@ mailing list for help.

ipa-client-samba operation on Ubuntu/Debian systems is not tested and not guaranteed at all. In general, it is problematic because everything in IPA is built against MIT Kerberos while Debian builds Samba packages against Heimdal library.

I just reinstalled and reprovisioned the ipa client and now it works. 👍

Metadata Update from @kimdre:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.