freeipa

#9763 KRA install failure if /root/.dogtag/pki-tomcat/ca_admin.cert is expired
Opened by frenaud. Modified

Open
Close Issue

The nightly test test_integration/test_installation.py::TestKRAinstallAfterCertRenew::test_KRA_install_after_cert_renew is failing with the pki version in updates-testing: dogtag-pki-acme-11.6.0-1.fc41.2.noarch

Test scenario:
- install the server with embedded CA
- note the expiration date for the admin cert in /root/.dogtag/pki-tomcat/ca_admin.cert
- move date to expiration date - 10 days
- restart IPA services
- wait for certmonger to renew all the certificates
- move date to expiration date + 3 days
- restart IPA services
- install KRA service on the master

Logs are available on our artifacts server in idm-ci/freeipa_upstream_nightly/Nightly-latest-testing-repo/master/2025-03-12_09-50/latest-testing-repo/test_installation_TestKRAinstallAfterCertRenew

The call to ipa-kra-install fails in the step calling pkispawn:

RUN ['ipa-kra-install', '-p', 'Secret.123', '-U']
===================================================================
This program will setup Dogtag KRA for the IPA Server.
Configuring KRA server (pki-tomcatd). Estimated time: 2 minutes
  [1/9]: configuring KRA instance
Failed to configure KRA instance
See the installation logs and the following files/directories for more information:
  /var/log/pki/pki-tomcat
Your system may be partly configured.
If you run into issues, you may have to re-install IPA on this server.
KRA configuration failed.
The ipa-kra-install command failed. See /var/log/ipaserver-kra-install.log for more information
  [error] RuntimeError: KRA configuration failed.

The pki-kra-spawn.$date.log file shows the following error message:

2027-03-05 16:39:19 INFO: Checking admin cert in /root/.dogtag/pki-tomcat/ca_admin.cert
2027-03-05 16:39:19 INFO: Loading admin cert from /root/.dogtag/pki-tomcat/ca_admin.cert
2027-03-05 16:39:19 DEBUG: Admin cert:
-----BEGIN CERTIFICATE-----
MIIEBzCCAm+gAwIBAgIRALLudCDzR/0bRqTlJ/3p0pcwDQYJKoZIhvcNAQELBQAw
ODEWMBQGA1UECgwNVUZSRUVJUEEuVEVTVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUg
QXV0aG9yaXR5MB4XDTI1MDMxMjE2Mzc0NloXDTI3MDMwMjE2Mzc0NlowLzEWMBQG
A1UECgwNVUZSRUVJUEEuVEVTVDEVMBMGA1UEAwwMaXBhLWNhLWFnZW50MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvDB8x8m+fW5LVVO1Y/4ZZSkvF8bl
gvUAKUfdOL71aAcN93qfzg6M2KoNkES54tnA7c0JyBUhEHy7jrdnLk06iH0BkNx4
cQkd++p2WqN2wcpcKncAqrqPtpj+53LSxG5I6bs3v4WGq8r9w7HddCYEwxx3iVmT
OxV34YPBuQyyY9stuh/cQnmxjCHgem/t9s3hvXLZ2xUBzT9Dg19TFXl/OQN68EhB
4iGyk93ocpcyMtqL7dHnufqAXynDghrm2EesW7P8bjBadKxZZlz3IvCSMDi3yMiQ
B5JQgthE9vSnTB/qa9BJz7GmArjf/boHiMdmHdE2Q9PeoqJEfaiBHvv8GQIDAQAB
o4GUMIGRMB8GA1UdIwQYMBaAFE4A+U25zj6kZbWzpVXGBuTI3KgWMD8GCCsGAQUF
BwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jYS51ZnJlZWlwYS50ZXN0
L2NhL29jc3AwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggr
BgEFBQcDBDANBgkqhkiG9w0BAQsFAAOCAYEAmx3XOUgd6xdZdqbUBTAX59EKIX15
PTp5ktQaNnDCgkQ4NfJm4susWvzNyJVcxMvIM9E9nL+48ut1BHdqIn5YA06hBXoa
4ymewY7J4Lc2qqf2KUQ1yKob3cSAnw46rGEtkPTnWiyg4/riYFkN8ylQe0pAZ2KA
bBGn08ns/NgU65DLLf7ekLKcrMUrfn6Uulf8rxa3jkZHmLHRzJVjYSSuef7BNPFg
PZUH5UhBbzBEnWhu8POoQ4Dx8xMlLyaWUlGpJ4QNeu8Cjgvxh/8KQNo2q1tHZSHn
p/5KAJVQQBSYhaUJiSsHXcL0f70NjNLKoi62kCQmy+YeOqpde4LKXaV07eX7rMVR
NrRGW9iPfgv4y1c8Pl/1stq0ZMQgNhCCV8taDXNil0wf1I9RWedhxLDymg4AbD5s
dFLjY5x8CWUWQmdwM1hkkPLl+5dgrtIg3qk7snXviEnzVETFF5messXwPi06s2br
q759ospxigJrosesiXKkqwb5wWLMHOzmfxxI
-----END CERTIFICATE-----
2027-03-05 16:39:19 INFO: Verifying admin cert in /root/.dogtag/pki-tomcat/ca_admin.cert
2027-03-05 16:39:19 DEBUG: Command: pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf nss-cert-verify --debug

and ipa-server-kra-install.log:

INFO: Verifying admin cert in /root/.dogtag/pki-tomcat/ca_admin.cert
DEBUG: Command: pki -d /var/lib/pki/pki-tomcat/conf/alias -f /var/lib/pki/pki-tomcat/conf/password.conf nss-cert-verify --debug
FINE: Initializing NSS
FINE: Logging into internal token
FINE: Using internal token
FINE: PKITrustManager: getAcceptedIssuers():
FINE: PKITrustManager:  - CN=Certificate Authority,O=UFREEIPA.TEST
FINE: PKITrustManager: checkCert(CN=ipa-ca-agent,O=UFREEIPA.TEST):
FINE: PKITrustManager: cert AKI: null
FINE: PKITrustManager: SKI of CN=Certificate Authority,O=UFREEIPA.TEST: null
FINE: PKITrustManager: cert signed by CN=Certificate Authority,O=UFREEIPA.TEST
FINE: PKITrustManager: checking validity range:
FINE: PKITrustManager:  - not before: Wed Mar 12 16:37:46 UTC 2025
FINE: PKITrustManager:  - not after: Tue Mar 02 16:37:46 UTC 2027
ERROR: Invalid certificate: NotAfter: Tue Mar 02 16:37:46 UTC 2027

The behavior has changed with pki commit cd0daf6 Update pkispawn to verify admin cert.

IPA provides a pkispawn file with the setting pki_admin_cert_file = /root/.dogtag/pki-tomcat/ca_admin.cert and should update this file to make sure the certificate is valid.

The problem is that we don't manage the ca-dmin certificate at all (subject CN=ipa-ca-agent). We don't track or renew it in certmonger.
I did some light testing and was able to install a KRA using the IPA RA certificate. So perhaps we should have a symlink there from /var/lib/ipa/ra-agent.pem and just drop the ca-agent cert use altogether.
The light testing was:
- initial IPA installation
- cp /var/lib/ipa/ra-agent.pem /root/.dogtag/pki-tomcat/ca_admin.cert
- ipa-kra-install
- ipa vault-add, vault-archive, vault-retrieve

master:

  • 92f992a6ec5806676d086c889bc6eca923237a79 ipatests: add xfail for TestKRAinstallAfterCertRenew

ipa-4-12:

  • a23e08286de966aa35071378f9ce27e4fd53993a ipatests: add xfail for TestKRAinstallAfterCertRenew

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Reopening, as the issue is not fixed. The commit only marked the test as xfail.

Metadata Update from @frenaud:
- Issue status updated to: Open (was: Closed)
Metadata
None

test-failure

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.