freeipa

#9761 [RFE] Run pkispawn --precheck if an override file is passed in
Closed: wontfix by rcritten. Opened by rcritten.

Closed: wontfix
Reopen Issue

Request for enhancement

A user can pass in a pki override file to set things that IPA doesn't provide an option for. This gives the user flexibility but also exposes them to potential CA installation failures if the resulting configuration is invalid.

An example is if a user is providing their own keys to an installation they are also required to provide the CSRs for them so they can be imported into PKI later. Not doing so can result in a traceback like:

EBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias -f /tmp/tmprxftouia/password.txt
DEBUG: stdout: -1
DEBUG: NSSDatabase.get_cert_info(caSigningCert cert-pki-ca) ends
INFO: CA subject: CN=Custom CA,O=External
INFO: Creating request ID for ocsp_signing cert
DEBUG: Starting new HTTPS connection (1): vaoplipa101.ot.local:8443
DEBUG: https://vaoplipa101.ot.local:8443 "POST /ca/rest/installer/createRequestID HTTP/1.1" 200 5
DEBUG: Response:
"0x1"
INFO: - request ID: 0x1
INFO: Importing ocsp_signing cert request into CA database
ERROR: AttributeError: 'SystemCertData' object has no attribute 'request'
  File "/usr/lib/python3.9/site-packages/pki/server/pkispawn.py", line 568, in main
    deployer.spawn()
  File "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line 4985, in spawn
    scriptlet.spawn(self)
  File "/usr/lib/python3.9/site-packages/pki/server/deployment/scriptlets/configuration.py", line 170, in spawn
    system_certs = deployer.setup_system_certs(nssdb, subsystem)
  File "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line 3452, in setup_system_certs
    self.setup_system_cert(nssdb, subsystem, tag, system_cert, request)
  File "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line 3294, in setup_system_cert
    self.import_cert_request(subsystem, tag, request)
  File "/usr/lib/python3.9/site-packages/pki/server/deployment/__init__.py", line 2752, in import_cert_request
    request_pem = pki.nssdb.convert_csr(request.systemCert.request, 'base64', 'pem')

pkispawn has an option --precheck to validate the configuration (https://docs.redhat.com/en/documentation/red_hat_certificate_system/10/html-single/planning_installation_and_deployment_guide_common_criteria_edition/index#installation_methods)

pkispawn -s CA -f rootca_inst.cfg --precheck --debug
pkispawn -s CA -f rootca_inst.cfg --debug

We should be able to do something similar in IPA. Better to fail early.

The pre-checks are trivial and only validate the DM and security domain settings. It isn't worth validating these as we already cover it.

Metadata Update from @rcritten:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
High
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.