freeipa

#9878 ipa-server-install fails in FIPS mode
Closed: fixed by rcritten. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The installation of IPA server fails in FIPS mode. Reproduced with the copr repo from @freeipa/freeipa-master-nightly. The issue hasn't reached any official release yet.

Steps to Reproduce

Logs for nightly runs available in https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-testing-repo-selinux/master/2025-11-19_17-10/latest-testing-repo-selinux/test_fips/3/report.html?sort=result

Actual behavior

Server installation fails in the step requesting RA certificate:

DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd48:transport.py:557   [19/33]: configure certmonger for renewals
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd48:transport.py:557   [20/33]: requesting RA certificate from CA
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd48:transport.py:557   [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-in', '/root/ca-agent.p12', '-out', '/tmp/tmpsneierkl', '-nokeys', '-password', 'file:/tmp/tmp7xv4m1n5'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n')
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd48:transport.py:557 CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-in', '/root/ca-agent.p12', '-out', '/tmp/tmpsneierkl', '-nokeys', '-password', 'file:/tmp/tmp7xv4m1n5'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n')
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd48:transport.py:557 The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd48:transport.py:217 Exit code: 1

The code was recently modified (Switch from direct REST/XML calls to use the PKI python API - PR #7781) and a call to openssl pkcs12 fails in FIPS mode:

Command ['/usr/bin/openssl', 'pkcs12', '-in', '/root/ca-agent.p12', '-out', '/tmp/tmpsneierkl', '-nokeys', '-password', 'file:/tmp/tmp7xv4m1n5'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n'

The fix is simple, add -nomacver in FIPS mode.

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8029

master:

  • 3e6b5b954b355df3f4f0859961f1a5ae151d72f5 FIPS mode: openssl pkcs12 command needs -nomacver option
  • ca5510a08dd5e8bdad617589a3acf1aee427373a ipatests: mark test_dnssec as xfail in fips mode
  • bcbc88dc4a77d159ffcfa8ca4d2d98ef90f089d6 temp_commit: revert to the version pre 0b521f7

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.