freeipa

#9674 Handle PKI 11.6.0 uninstallation
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

PKI 11.6.0 pkidestroy no longer destroys the entire instance. Run alone it will stop the service but leave the configuration, certificates and keys along with the subsystem directory (e.g. /etc/pki/pki-tomcat/ca).

There is an additional flag to remove logs but up until now we have always left the existing logs in place.

To remove nearly everything:

pkidestroy -s CA --remove-conf --remove-logs

Note that in my testing this does not leave the system in a state where it can be re-installed.

We are going to need to remove a lot more information, including the older NSS database, password file and more manually.

Does this needs to be done separately for each subsystem? E.g. KRA and ACME?

Yes. Fortunately this code is centralized in the DogtagInstance class so this will be a do-once change to come extent.
I have identified other files that aren't removed and we may be able to cover that with broad shutil.rmtree calls. The complete set of directories to recursively remove is TBD.

Metadata Update from @rcritten:
- Issue assigned to rcritten

So apparently pkidestroy was crashing while uninstalling the CA because ACME was still configured, see https://pagure.io/freeipa/issue/9673

Unconfiguring ACME first resolves the majority of the files issue.

Cleanup of other files is in https://pagure.io/freeipa/c/8293b74eca851981c7b61b6dd6505f4799e3c8ce but is not in Fedora yet.

One additional file, /root/kracert.p12, needs to be removed.

I combined this change and https://pagure.io/freeipa/issue/9673 into one PR for simplicity

https://github.com/freeipa/freeipa/pull/7549

master:

  • 273f68b77b75845cc7194187405d8c8c8203b834 Don't rely on removing the CA to uninstall the ACME depoyment

ipa-4-12:

  • a785d0c561b8e22bd9d56739481095e07e0a7eb7 Don't rely on removing the CA to uninstall the ACME depoyment

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 48479d40b24ac532453ff49d4eb9003c73b9b403 Small fixup to determine which ACME uninstaller to use

ipa-4-12:

  • 9a2de23eb5e00efa72189c4a86d9db1fab52c2ca Small fixup to determine which ACME uninstaller to use

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-61636, https://issues.redhat.com/browse/RHEL-61642
Metadata
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.