#6465 ipa-server-certinstall fails to install a valid certificate
Closed: Duplicate Opened by ofayans.

I am unable to install a valid certificate on a ca-less master using ipa-server-certinstall:

# ipa-server-certinstall -p '<dirman_password>', '-w', 'server.p12', '--pin', '<certificate_pin>'
Command '/usr/bin/certutil -d /etc/httpd/alias -D -n 'ca1/server'' returned non-zero exit status 255
The ipa-server-certinstall command failed.

Steps to reproduce:
1. Export the following environmental variables:
- domain - domain name
- server1 - master hostname
- server2 - replica hostname
- client - client hostname
- dbdir - name of the certificate database folder (will be created)
- crl_path - a folder for crl files (will be created)
- dirman_password
2. Run the attached script to generate the set of certificates
3. Export server cert: {{{ pk12util -o "server.p12" -n "ca1/server" -d "" -K "" -W "" }}}
4. export pem file: {{{ certutil -L -d "" -n "ca1" -a > root.pem }}}
5. Install ca-less server with '--http-cert-file=server.p12 --dirsrv-cert-file=server.p12 --ca-cert-file=root.pem'
6. Export ca1/server-altname certificate {{{ pk12util -o "server.p12" -n "ca1/server-altname" -d "" -K "" -W "" }}}
7. Run ipa-server-certinstall with the parameters listed in the description to install the freshly exported certificate[[BR]]
Expected results:[[BR]]
Installation successful[[BR]]

Actual results[[BR]]
Installation fails


Oleg, which test covers this scenario?

test should be: TestCertinstall.test_valid_ds

This ticket is a duplicate of #6460 (NSSNickname enclosed in single quotes causes ipa-server-certinstall failure).

When ipa-server-install is called for a CA-less installation, the directive NSSNickname in /etc/httpd/conf.d/nss.conf looks like the following:

$ grep NSSNickname /etc/httpd/conf.d/nss.conf
NSSNickname 'ca1/server'

The quotes are causing issues when calling certutil.

Metadata Update from @ofayans:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

Metadata