Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1356101 - Lightweight sub-CA certs are not tracked by certmonger after `ipa-replica-install`
Summary: Lightweight sub-CA certs are not tracked by certmonger after `ipa-replica-ins...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Kaleem
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-07-13 12:08 UTC by Petr Vobornik
Modified: 2016-11-04 05:57 UTC (History)
6 users (show)

Fixed In Version: ipa-4.4.0-10.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-04 05:57:59 UTC


Attachments (Terms of Use)
console.log (deleted)
2016-09-20 13:17 UTC, Abhijeet Kasurde
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2404 normal SHIPPED_LIVE ipa bug fix and enhancement update 2016-11-03 13:56:18 UTC

Description Petr Vobornik 2016-07-13 12:08:52 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/6019

After installing a replica, only the main CA cert is tracked by certmonger:
{{{
# getcert list | grep 'certificate:.*caSigningCert'
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
}}}

One has to run `ipa-certupdate` for lightweight sub-CA certs to be tracked by certmonger as well:
{{{
# getcert list | grep 'certificate:.*caSigningCert'
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
	certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca fb8eb99f-5a29-4e57-9de0-4027b65a5dcb',token='NSS Certificate DB'
}}}

Fix `ipa-replica-install` to do this automatically.

Comment 1 Fraser Tweedale 2016-09-05 16:40:02 UTC
Current behaviour: admins must manually run `ipa-certupdate' command
to add Certmonger tracking requests for lightweight CAs after deploying
a replica.

This ticket means they don't have to do that extra manual step.

Note that this ticket only applies to replica install.  Even if this
ticket is implemented, it will still be necessary for admins to
run `ipa-certupdate' to add tracking request after creating a new
lightweight CA.

Comment 5 Abhijeet Kasurde 2016-09-20 13:17:11 UTC
Verified using IPA version ::
ipa-server-4.4.0-12.el7.x86_64

Please find the attachment for verification steps. Marking BZ as verified.

Comment 6 Abhijeet Kasurde 2016-09-20 13:17:36 UTC
Created attachment 1202888 [details]
console.log

Comment 8 errata-xmlrpc 2016-11-04 05:57:59 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html


Note You need to log in before you can comment on or make changes to this bug.