freeipa

#9787 Rawhide: test failure when installing a replica in CA less mode
Closed: fixed by sumenon. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

Multiple tests are failing in rawhide, when the test installs a replica in CA less mode.
- test_integration/test_caless.py::TestPKINIT::test_server_replica_install_pkinit
- test_integration/test_caless.py::TestReplicaCALessToCAFull::test_install_caless_server_replica
- test_integration/test_caless.py::TestReplicaInstall::test_valid_certs
- test_integration/test_caless.py::TestServerReplicaCALessToCAFull::test_install_caless_server_replica
- test_integration/test_hsm.py::TestHSMCALessToExternalToSelfSignedCA::test_hsm_caless_replica0_with_ca_install

Steps to Reproduce

Test scenario:
1. install the master CA-less
2. Install the replica CA-less

Actual behavior

ipa-replica-install fails:

...
  [9/10]: restoring configuration
  [10/10]: starting directory server
Done.
Finalize replication settings
Restarting the KDC
Your system may be partly configured.
HTTPSConnectionPool(host='master.ufreeipa.test', port=443): Max retries exceeded with url: /ipa/keys/dm/DMHash?type=kem&value=eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOm51bGx9.EdPGn76Z-N8AsDrid8Y4k3QfgvscOuPjG8_mV2SneVhlwIGkMmdV3GmmUQUdh2999cqilynBlmuIt24j0K1cjXguGcudo0rljhn1hJoSAFaTphpEVirGF9P0YhtMPl0ufQj2bvIRzU27S934a6ngbJMm21ue9R_nhg3keZ78h-7Ji05PyjDSUlGKQ6TRvNr7bh9tipOiTb7BdlhRd1bOXuaPPhi10Ik2cfjSZwYYpMIU9PKHOG4nEanqkENUsARvjjEAt_sUIPq6nZ8f9KsrURyK8l0xu669epKfcxl16lL28UBWJ-Puido28PJ5d43cjoqhKgFvsaMNYKyUUSLJ-g.vEIHpPomvp7axqpUY6LI0w.NknnastLlGAX5mRJ8FmvTrfpuRsbUpkv96cDrro3BtSOqPjLXK3aWFtlNKKpyQt0tynQ94ALpLAawJMMY3MnWrdlN8sYA4AixkU2Uj8nDN2pEeBqZDt5i8cQJrxd527n8nLpeA_auI0bRKa_8JAr_3BAVKa8PKhZ0tr3xtKRf-TWeYTJgucCjG1OC_jgO_dh-8_rCKVX3FJHOk55Mpy64xr3Ak8Hk7hAOGW8WJiU3ggP6BmGLjhch8V6WAbf-UJAvWWE8peZmxyKt1imnwdxj_VgKsSMcaRqi1j1gNB0vlZFS6BfYcEwEWZcXxOEadnlMouQqeLZeEsv8TTMrNWGpO-QlMVx1S0ad_4wpMw_rLkAGWioVp_zxVQlavC58Kx8xwHSM883b5qBgIyuRrjdv7kQZvjIbbG0lfLw5ZJIIDNIkDAZU4-JHgsTAVWVhZDuVEk8MU8CIOdhDSD1ARv8uTkctatzVBEOPuORaQtNUiopFGktz25yn4qpo8y5tEV8lpjL-TdUGN_SHGbpBIHG6UpQpGctvg6KPJcfHtrtq-KM4PLtwJPjkG3rBoFF7JSNtgvnf9AGrwyBPzLZ0HbgPNrBMnxEJyCBFQXvlbDwkeDH5Sixy4WhhbVtoWz3gXEk.PSwRhYQBmU8ECnIIUVEqEmBANXkRCHpzNoh47N4CrA4 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1028)')))
Run /usr/sbin/ipa-server-install --uninstall to clean up.
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Expected behavior

ipa-replica-install should succeed

Version/Release/Distribution

freeipa-server-4.13.0.dev202505121115+git-0.fc43.x86_64

Additional info:

ipa-replica-install.log:

2025-05-12T16:53:26Z DEBUG Restart of krb5kdc.service complete
2025-05-12T16:53:26Z DEBUG Waiting up to 300 seconds to see our keys appear on host ldap://master.ufreeipa.test
2025-05-12T16:53:28Z DEBUG Starting new HTTPS connection (1): master.ufreeipa.test:443
2025-05-12T16:53:28Z DEBUG   File "/usr/lib/python3.13/site-packages/ipapython/admintool.py", line 219, in execute
    return_value = self.run()
  File "/usr/lib/python3.13/site-packages/ipapython/install/cli.py", line 343, in run
    return cfgr.run()
           ~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 360, in run
    return self.execute()
           ~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 386, in execute
    for rval in self._executor():
                ~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 435, in __runner
    exc_handler(exc_info)
    ~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception
    self._handle_exception(exc_info)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 458, in _handle_exception
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 425, in __runner
    step()
    ~~~~^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 419, in step_next
    return next(self.__gen)
  File "/usr/lib/python3.13/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.13/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 663, in _configure
    next(executor)
    ~~~~^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 435, in __runner
    exc_handler(exc_info)
    ~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception
    self._handle_exception(exc_info)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 526, in _handle_exception
    self.__parent._handle_exception(exc_info)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 458, in _handle_exception
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 523, in _handle_exception
    super(ComponentBase, self)._handle_exception(exc_info)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 458, in _handle_exception
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 425, in __runner
    step()
    ~~~~^^
  File "/usr/lib/python3.13/site-packages/ipapython/install/core.py", line 419, in step_next
    return next(self.__gen)
  File "/usr/lib/python3.13/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
    six.reraise(*exc_info)
    ~~~~~~~~~~~^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/six.py", line 724, in reraise
    raise value
  File "/usr/lib/python3.13/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
    value = gen.send(prev_value)
  File "/usr/lib/python3.13/site-packages/ipapython/install/common.py", line 65, in _install
    for unused in self._installer(self.parent):
                  ~~~~~~~~~~~~~~~^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipaserver/install/server/__init__.py", line 687, in main
    replica_install(self)
    ~~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib/python3.13/site-packages/ipaserver/install/server/replicainstall.py", line 386, in decorated
    func(installer)
    ~~~~^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipaserver/install/server/replicainstall.py", line 1450, in install
    custodia.import_dm_password()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3.13/site-packages/ipaserver/install/custodiainstance.py", line 203, in import_dm_password
    cli.fetch_key('dm/DMHash')
    ~~~~~~~~~~~~~^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/ipaserver/secrets/client.py", line 118, in fetch_key
    r = requests.get(
        url, headers=headers,
        verify=paths.IPA_CA_CRT,
        params={'type': 'kem', 'value': request}
    )
  File "/usr/lib/python3.13/site-packages/requests/api.py", line 73, in get
    return request("get", url, params=params, **kwargs)
  File "/usr/lib/python3.13/site-packages/requests/api.py", line 59, in request
    return session.request(method=method, url=url, **kwargs)
           ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/site-packages/requests/sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3.13/site-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3.13/site-packages/requests/adapters.py", line 699, in send
    raise SSLError(e, request=request)
2025-05-12T16:53:28Z DEBUG The ipa-replica-install command failed, exception: SSLError: HTTPSConnectionPool(host='master.ufreeipa.test', port=443): Max retries exceeded with url: /ipa/keys/dm/DMHash?type=kem&value=eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOm51bGx9.EdPGn76Z-N8AsDrid8Y4k3QfgvscOuPjG8_mV2SneVhlwIGkMmdV3GmmUQUdh2999cqilynBlmuIt24j0K1cjXguGcudo0rljhn1hJoSAFaTphpEVirGF9P0YhtMPl0ufQj2bvIRzU27S934a6ngbJMm21ue9R_nhg3keZ78h-7Ji05PyjDSUlGKQ6TRvNr7bh9tipOiTb7BdlhRd1bOXuaPPhi10Ik2cfjSZwYYpMIU9PKHOG4nEanqkENUsARvjjEAt_sUIPq6nZ8f9KsrURyK8l0xu669epKfcxl16lL28UBWJ-Puido28PJ5d43cjoqhKgFvsaMNYKyUUSLJ-g.vEIHpPomvp7axqpUY6LI0w.NknnastLlGAX5mRJ8FmvTrfpuRsbUpkv96cDrro3BtSOqPjLXK3aWFtlNKKpyQt0tynQ94ALpLAawJMMY3MnWrdlN8sYA4AixkU2Uj8nDN2pEeBqZDt5i8cQJrxd527n8nLpeA_auI0bRKa_8JAr_3BAVKa8PKhZ0tr3xtKRf-TWeYTJgucCjG1OC_jgO_dh-8_rCKVX3FJHOk55Mpy64xr3Ak8Hk7hAOGW8WJiU3ggP6BmGLjhch8V6WAbf-UJAvWWE8peZmxyKt1imnwdxj_VgKsSMcaRqi1j1gNB0vlZFS6BfYcEwEWZcXxOEadnlMouQqeLZeEsv8TTMrNWGpO-QlMVx1S0ad_4wpMw_rLkAGWioVp_zxVQlavC58Kx8xwHSM883b5qBgIyuRrjdv7kQZvjIbbG0lfLw5ZJIIDNIkDAZU4-JHgsTAVWVhZDuVEk8MU8CIOdhDSD1ARv8uTkctatzVBEOPuORaQtNUiopFGktz25yn4qpo8y5tEV8lpjL-TdUGN_SHGbpBIHG6UpQpGctvg6KPJcfHtrtq-KM4PLtwJPjkG3rBoFF7JSNtgvnf9AGrwyBPzLZ0HbgPNrBMnxEJyCBFQXvlbDwkeDH5Sixy4WhhbVtoWz3gXEk.PSwRhYQBmU8ECnIIUVEqEmBANXkRCHpzNoh47N4CrA4 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1028)')))
2025-05-12T16:53:28Z ERROR HTTPSConnectionPool(host='master.ufreeipa.test', port=443): Max retries exceeded with url: /ipa/keys/dm/DMHash?type=kem&value=eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOm51bGx9.EdPGn76Z-N8AsDrid8Y4k3QfgvscOuPjG8_mV2SneVhlwIGkMmdV3GmmUQUdh2999cqilynBlmuIt24j0K1cjXguGcudo0rljhn1hJoSAFaTphpEVirGF9P0YhtMPl0ufQj2bvIRzU27S934a6ngbJMm21ue9R_nhg3keZ78h-7Ji05PyjDSUlGKQ6TRvNr7bh9tipOiTb7BdlhRd1bOXuaPPhi10Ik2cfjSZwYYpMIU9PKHOG4nEanqkENUsARvjjEAt_sUIPq6nZ8f9KsrURyK8l0xu669epKfcxl16lL28UBWJ-Puido28PJ5d43cjoqhKgFvsaMNYKyUUSLJ-g.vEIHpPomvp7axqpUY6LI0w.NknnastLlGAX5mRJ8FmvTrfpuRsbUpkv96cDrro3BtSOqPjLXK3aWFtlNKKpyQt0tynQ94ALpLAawJMMY3MnWrdlN8sYA4AixkU2Uj8nDN2pEeBqZDt5i8cQJrxd527n8nLpeA_auI0bRKa_8JAr_3BAVKa8PKhZ0tr3xtKRf-TWeYTJgucCjG1OC_jgO_dh-8_rCKVX3FJHOk55Mpy64xr3Ak8Hk7hAOGW8WJiU3ggP6BmGLjhch8V6WAbf-UJAvWWE8peZmxyKt1imnwdxj_VgKsSMcaRqi1j1gNB0vlZFS6BfYcEwEWZcXxOEadnlMouQqeLZeEsv8TTMrNWGpO-QlMVx1S0ad_4wpMw_rLkAGWioVp_zxVQlavC58Kx8xwHSM883b5qBgIyuRrjdv7kQZvjIbbG0lfLw5ZJIIDNIkDAZU4-JHgsTAVWVhZDuVEk8MU8CIOdhDSD1ARv8uTkctatzVBEOPuORaQtNUiopFGktz25yn4qpo8y5tEV8lpjL-TdUGN_SHGbpBIHG6UpQpGctvg6KPJcfHtrtq-KM4PLtwJPjkG3rBoFF7JSNtgvnf9AGrwyBPzLZ0HbgPNrBMnxEJyCBFQXvlbDwkeDH5Sixy4WhhbVtoWz3gXEk.PSwRhYQBmU8ECnIIUVEqEmBANXkRCHpzNoh47N4CrA4 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1028)')))
2025-05-12T16:53:28Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Example of httpd server certificate:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3 (0x3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O=Example Organization España, CN=CA
        Validity
            Not Before: May 12 16:39:13 2025 GMT
            Not After : May 12 16:39:13 2026 GMT
        Subject: O=Example Organization España, CN=master.ufreeipa.test
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d6:cf:62:d7:7b:c0:9b:ac:0b:1a:03:b3:41:30:
                    b3:d9:17:4e:23:e2:f8:87:07:af:64:78:ed:65:b2:
                    09:53:08:08:0a:91:3a:db:b7:4e:d1:bf:fa:2b:4b:
                    fd:43:a8:b8:05:8e:b9:ef:94:ce:82:dd:66:56:07:
                    4a:47:8f:80:16:6b:f8:fb:25:2b:8d:87:00:db:89:
                    d7:47:e5:9a:c8:6c:b1:50:f9:cf:37:6c:ac:16:ff:
                    91:95:49:d0:1a:37:6f:d6:66:ff:cc:29:15:82:74:
                    db:ee:6f:d6:05:27:4f:07:a3:cc:65:ac:72:e5:07:
                    8c:e4:40:f8:5e:41:91:51:29:26:da:f0:55:ca:5e:
                    d4:55:01:0d:60:63:a9:07:71:6a:f2:0a:5c:27:5b:
                    38:e0:ff:d7:b2:d7:42:40:d8:b2:71:d9:17:f6:ba:
                    23:ca:ae:d9:a6:77:2a:3f:7c:0f:5e:9d:fc:d1:e0:
                    53:ce:40:bc:75:fa:6d:61:33:3d:b9:cc:6e:17:c3:
                    fb:cb:46:55:f0:94:74:ff:9c:7f:7d:38:0a:53:69:
                    ca:75:be:29:fb:63:49:92:b0:e8:22:6b:33:5b:46:
                    c9:d2:b7:a5:ff:b5:db:5d:cb:16:8b:96:be:8d:b1:
                    16:11:ce:38:bf:1b:0a:e1:ef:52:86:1b:e8:74:f5:
                    74:7d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:file:///tmp/ipatest-zxjjccbo/ca1.crl
            X509v3 Subject Alternative Name: 
                DNS:master.ufreeipa.test
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        92:e1:19:e1:1e:82:24:ae:69:ef:bb:04:c3:47:3a:f0:23:77:
        96:fe:af:5e:36:50:7d:be:30:8d:19:fe:23:dd:33:32:6d:15:
        3e:a6:c6:5e:13:09:e9:05:4d:c3:df:8a:f9:bd:59:a0:a1:92:
        ec:9a:e6:4a:fa:5e:a6:5f:e8:85:f9:00:13:19:3d:f6:90:86:
        51:59:a5:f0:b0:df:0a:dc:45:1f:29:a0:7f:82:af:e2:dd:6a:
        f4:c4:12:1e:b3:0e:16:2c:e8:03:81:b4:70:f5:33:1e:64:b5:
        df:7f:cd:c2:4e:8a:e2:89:3b:47:f6:dc:80:df:e8:37:b8:56:
        51:bb:af:ba:31:6f:c5:fa:97:16:77:93:c3:8b:8b:87:33:e0:
        82:4f:7c:93:10:6c:2d:9f:42:c0:07:83:b9:bd:8b:3c:7e:a1:
        2c:31:1a:33:ab:8a:34:dc:13:e3:c7:4a:e5:8d:69:e7:bb:ea:
        23:f3:67:1d:c0:be:6f:e1:7e:60:00:87:c0:5b:7b:7b:16:ee:
        28:87:be:b8:8b:02:0b:e4:2b:0d:62:13:8b:e8:a9:cd:15:f4:
        af:6a:49:13:f9:8d:d1:c3:59:94:7f:24:4a:d6:06:8a:88:18:
        af:6d:e4:46:81:41:87:d4:7c:17:25:92:09:8e:77:36:32:0c:
        88:fa:cd:6b

The cert does not contain any Authority Key Identifier.

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7809

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7810 (was: https://github.com/freeipa/freeipa/pull/7809)

master:

  • d1abdca13f26cf3c50c7898eb7d034c7dfc6d392 ipatests: add extensions to server certificates for CAless mode

ipa-4-12:

  • 8cfafeffd1ad5266b35a7eb796976e873278f500 ipatests: add extensions to server certificates for CAless mode

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-107483
Metadata

test-failure tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.