freeipa

#9808 Replica: Request cert for DoT fails after setting up bind
Closed: fixed by sumenon. Opened by twoerner.

Closed: fixed
Reopen Issue

Issue

Deploying a replica with DNS support using an IPA server DNS with DoT fails while setting up DNS over TLS. The request for the certificate for DoT using IPA CA is done after the DNS server for the replica is configured.
The nameserver in /etc/resolv.conf has been changed to 127.0.0.1, but unbound was not yet configured as a forwarder.

Done configuring DNS (named).
Setting up DNS over TLS
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
Certificate issuance failed (CA_UNREACHABLE: Server at https://ipareplica1.cos10.local/ipa/json failed request, will retry: 907 (cannot connect to 'https://ipaserver.cos10.local:443/ca/rest/account/login': [Errno -2] Name or service not known).)
The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

Steps to Reproduce

ipa-replica-install --unattended --admin-password=SomeADMINpassword --setup-dns --auto-forwarders --auto-reverse --no-dnssec-validation --dns-over-tls --dot-forwarder=192.168.155.2#ipaserver.cos10.local

Version/Release/Distribution

ipa-server-encrypted-dns-4.12.2-17.el10.x86_64
ipa-server-4.12.2-17.el10.x86_64
ipa-server-dns-4.12.2-17.el10.noarch

Fix Proposal

The solution is to move the cert request before the DNS server configuration. The unbound config from the client deployment is still working at that moment.

diff --git a/ipaserver/install/dns.py b/ipaserver/install/dns.py
index 470e19159..a213c8d25 100644
--- a/ipaserver/install/dns.py
+++ b/ipaserver/install/dns.py
@@ -114,7 +114,7 @@ def _disable_dnssec():
             conn.update_entry(entry)
-def _setup_dns_over_tls(options):
+def _request_cert_for_dns_over_tls(options):
     if os.path.isfile(paths.IPA_CA_CRT) and not options.dns_over_tls_cert:
         # request certificate for DNS over TLS, using IPA CA
         cert = paths.BIND_DNS_OVER_TLS_CRT
@@ -128,6 +128,8 @@ def _setup_dns_over_tls(options):
         constants.NAMED_USER.chown(cert, gid=constants.NAMED_GROUP.gid)
         constants.NAMED_USER.chown(key, gid=constants.NAMED_GROUP.gid)
+
+def _setup_dns_over_tls(options):
     # setup and enable Unbound as resolver
     forward_addrs = ["# forward-addr: specify here forwarders"]
     if options.dot_forwarders:
@@ -431,6 +433,10 @@ def install(standalone, replica, options, api=api):
             "and IPA CA is not present."
         )
+    if options.dns_over_tls:
+        print("Request certificate for DNS over TLS, using IPA CA")
+        _request_cert_for_dns_over_tls(options)
+
     bind = bindinstance.BindInstance(fstore, api=api)
     bind.setup(api.env.host, ip_addresses, api.env.realm, api.env.domain,
                options.forwarders, options.forward_policy,

master:

  • 47626a950f343c3ae7c49bc99f4c25d976c0bdb6 Replica: Request cert for DoT before setting up bind

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-95374, https://issues.redhat.com/browse/RHEL-100450

ipa-4-12:

  • f4cbea00fde8dada84bfd1262b5271035d3ca7a4 Replica: Request cert for DoT before setting up bind

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.