freeipa

#8502 Don't create DirSRV SSCA
Closed: fixed by rcritten. Opened by cheimes.

Closed: fixed
Reopen Issue

Issue

By default lib389 installer creates a Self-Signed CA and later a temporary server certificate to bootstrap initial installation. FreeIPA does not need the CA as it uses Unix domain sockets and local connections for initial setup.

Steps to Reproduce

  1. run ipa-server-install

Actual behavior

/etc/dirsrv/ssca exists

Expected behavior

/etc/dirsrv/ssca should not exist

Version/Release/Distribution

freeipa-server-4.8.7-1.fc32.x86_64
389-ds-base-1.4.3.10-1.fc32.x86_64

Additional info:

slapd_options.set('self_sign_cert', False) disables creation of SSCA and self-signed cert.

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5111
- Issue set to the milestone: FreeIPA 4.8

master:

  • 3c86baf0ade9c9045cc0f3b3c7fb0e7c580e29a4 Don't create DS SSCA and self-signed cert

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/5111
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.