freeipa

#9886 Nightly test failure in TestACME::test_mod_md
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

The nightly test test_integration/test_acme.py::TestACME::test_mod_md is failing with the code from master branch after commit ffb8fe35414bd6d24f56be841e44364b14efad31

Steps to Reproduce

  1. Enable the copr repo on master and client: dnf copr enable -y @freeipa/freeipa-master-nightly
  2. Install the server packages on master: dnf update -y && dnf install -y freeipa-server-dns
  3. Install the client packages on client + certbot and mod_md: dnf update -y && dnf install -y freeipa-client certbot mod_md httpd
  4. Configure the server: ipa-server-install --domain ipa.test --realm ipa.test --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 -U
  5. Enable acme on the master: echo Secret123 | kinit admin; ipa-acme-manage enable
  6. Configure the client: ipa-client-install --domain ipa.test --realm IPA.TEST --server server.ipa.test --principal admin --password Secret123 -U
  7. Configure ACME on the client: certbot --server https://ipa-ca.ipa.test/acme/directory register -m nobody@example.test --agree-tos --no-eff-email
  8. Configure the client for mod_md: mkdir -p /etc/httpd/conf.d; mkdir -p /etc/httpd/md
  9. Create /etc/httpd/conf.d/md.conf on the client:
MDCertificateAuthority https://ipa-ca.ipa.test/acme/directory
MDCertificateAgreement accepted
MDStoreDir  /etc/httpd/md
MDomain client.ipa.test
<VirtualHost *:443>
    ServerName client.ipa.test
    SSLEngine on
</VirtualHost>
  1. Restart httpd on the client: systemctl restart httpd

Actual behavior

The restart command fails with:

Job for httpd.service failed because the control process exited with error code.
See "systemctl status httpd.service" and "journalctl -xeu httpd.service" for details.

The journal shows:

Nov 27 12:54:41 client.ufreeipa.test systemd[1]: Starting httpd-init.service - One-time temporary TLS key generation for httpd.service...
Nov 27 12:54:42 client.ufreeipa.test systemd[1]: httpd-init.service: Main process exited, code=exited, status=17/n/a
Nov 27 12:54:42 client.ufreeipa.test systemd[1]: httpd-init.service: Failed with result 'exit-code'.
Nov 27 12:54:42 client.ufreeipa.test systemd[1]: Failed to start httpd-init.service - One-time temporary TLS key generation for httpd.service.
Nov 27 12:54:42 client.ufreeipa.test audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=httpd-init comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
Nov 27 12:54:42 client.ufreeipa.test audit: BPF prog-id=382 op=LOAD
Nov 27 12:54:42 client.ufreeipa.test systemd[1]: Starting httpd.service - The Apache HTTP Server...
Nov 27 12:54:42 client.ufreeipa.test (httpd)[35575]: httpd.service: Referenced but unset environment variable evaluates to an empty string: OPTIONS
Nov 27 12:54:42 client.ufreeipa.test httpd[35575]: AH00526: Syntax error on line 101 of /etc/httpd/conf.d/ssl.conf:
Nov 27 12:54:42 client.ufreeipa.test httpd[35575]: SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty
Nov 27 12:54:42 client.ufreeipa.test systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE
Nov 27 12:54:42 client.ufreeipa.test systemd[1]: httpd.service: Failed with result 'exit-code'.
Nov 27 12:54:42 client.ufreeipa.test systemd[1]: Failed to start httpd.service - The Apache HTTP Server.

Expected behavior

The restart should succeed, mod_md should get an ACME certificate.

Version/Release/Distribution

freeipa-client-4.13.0.dev202511261919+gitffb8fe354-0.fc43.x86_64
certbot-4.1.1-4.fc43.noarch
mod_md-2.4.26-5.fc43.x86_64

Metadata Update from @frenaud:
- Issue tagged with: test-failure

Update: it seems the issue is related to the update of sscg.
Mod_ssl is launching the service httpd-init (Unit file stored in /usr/lib/systemd/system/httpd-init.service) which calls /usr/libexec/httpd-ssl-gencerts. This command in turn calls sscg with the following arguments:

sscg -q \
     --cert-file           /etc/pki/tls/certs/localhost.crt         \
     --cert-key-file       /etc/pki/tls/private/localhost.key       \
     --ca-file             /etc/pki/tls/certs/localhost.crt         \
     --no-dhparams-file                                             \
     --lifetime            365                                      \
     --hostname            $FQDN                                    \
     --email               root@$FQDN

With sscg-4.0.0-1.fc43.x86_64, there is no issue. With sscg-4.0.1-1.fc43, the command fails, likely because we provide the same file for the cert and the CA.

Tracker in https://github.com/sgallagher/sscg/issues/99

Metadata Update from @frenaud:
- Issue tagged with: tracker

The sscg fix will be available in sscg-4.0.3-1:

  • fedora 44/rawhide: https://bodhi.fedoraproject.org/updates/FEDORA-2025-838e003ddc
  • fedora 43: https://bodhi.fedoraproject.org/updates/FEDORA-2025-04d5ecc26b
  • fedora 42: https://bodhi.fedoraproject.org/updates/FEDORA-2025-43c20e79ac
  • fedora 41: https://bodhi.fedoraproject.org/updates/FEDORA-2025-318db93cb1

The updated packages are still in testing, keeping this tracker open until they reach the stable repository.

Closing, sscg-4.0.3-2.fc43 has reached stable repo

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

test-failure tracker

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.