freeipa

#9872 ipa_cacert_manage.py: Allow deleting duplicate (self-signed) CA
Opened by fkszczot. Modified

Open
Close Issue

Request for enhancement

As an admin , I want to be able to delete duplicate CA so that I can switch from self-signed to externally-signed CA.

Issue

ipa-cacert-manage delete "IPA.XYZ.EU IPA CA" -s 1 fails with The IPA CA cannot be removed with this tool even where there's another IPA CA (for example when the CA was renew-ed by an external-ca when switching from self-signed to external-ca-signed [https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/managing_certificates_in_idm/managing-externally-signed-ca-certificates#switching-from-a-self-signed-to-an-externally-signed-ca-in-idm])

Steps to Reproduce

  1. ipa-cacert-manage renew --external-ca - to initate the process
  2. Sign the CSR, move it to FreeIPA server
  3. ipa-cacert-manage renew --external-cert-file=/root/PKI/ipa.crt --external-cert-file=/root/PKI/root.crt - finish the process
  4. Try to ipa-cacert-manage delete "IPA.XYZ.EU IPA CA" -s 1 delete the old self-signed CA

Actual behavior

It fails with The IPA CA cannot be removed with this tool

Expected behavior

It should allow it, when there's a duplicate CA for IPA

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.12.5-2.1.fc41.x86_64
freeipa-client-4.12.5-2.1.fc41.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-3.1.3-3.fc41.x86_64
package pki-ca is not installed
krb5-server-1.21.3-5.fc41.x86_64

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

This is so existing certificates issued by the original self-signed CA will still be valid and trusted. It would be very easy to get over ones ski's and discover that half the infra using older certificates is no longer trusted.

If admin wants to remove the CA certificate, they should have the right to do so. Right now we are not allowing it because:
- we filter out certificates by nickname and serial
- we do not remember a serial of 'the IPA CA'
- we do not compare the serial when identifying whether this CA is 'the IPA CA'

We are not allowing removing the IPA CA because of https://github.com/freeipa/freeipa/blob/master/ipaserver/install/ipa_cacert_manage.py#L521

Remove that block and the IPA CA can be removed.

I'm normally in favor of giving maximum flexibility but this can brick an installation.

@rcritten this was an actual use case discussed on #freeipa on Libera.Chat - I've switched my IPA CA to an externally signed one, but it was in a weird state, because it still had the self-signed one. I had to remove that block with abbra's help, which helped.
I'm not suggesting it should change by default, but it should be able to support that use case, maybe behind some --i-know-what-i-am-doing-and-i-read-the-manpage type of argument.
Edited by fkszczot

@rcritten I think that block needs to be expanded by comparing not just the nickname but also the serial number.

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.