freeipa

#8618 ipa-cert-fix tool fails when the Dogtag CA SSL CSR is missing from CS.cfg
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 1780782

Description of problem:
The ipa-cert-fix tool fails with the error "Unable to find CSR for sslserver
cert" when the Dogtag CA SSL CSR is missing from /etc/pki/pki-tomcat/ca/CS.cfg.
Actual results:
[Debug output from ipa-cert-fix when the error is triggered]
INFO: Fixing the following system certs: ['sslserver', 'subsystem',
'ca_ocsp_signing', 'ca_audit_signing']
INFO: Renewing the following additional certs: ['7', '268369922']
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
INFO: Stopping the instance to proceed with system cert renewal
INFO: Configuring LDAP password authentication
INFO: Setting pkidbuser password via ldappasswd
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
INFO: Selftests disabled for subsystems: ca
INFO: Resetting password for uid=ipara,ou=people,o=ipaca
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
INFO: Creating a temporary sslserver cert
INFO: Getting sslserver cert info for ca
INFO: Trying to create a new temp cert for sslserver.
INFO: Generate temp SSL certificate
INFO: Getting sslserver cert info for ca
INFO: Selftests enabled for subsystems: ca
INFO: Restoring previous LDAP configuration
ERROR: Unable to find CSR for sslserver cert
Expected results:
The ipa-cert-fix tool completes successfully.
Additional info:
The error can be bypassed if the related certmonger tracking file is stored in
/var/lib/certmonger/requests AND contains a copy of the PKCS#10 request, which
can be converted into a sigle line string and added to CS.cfg
(ca.sslserver.certreq=MIIDQTCCAik...).

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1780782

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5338

master:

  • b8ece644e849f8341544bcadba8b19fd888dd90d ipatests: add a test for ipa-cert-fix
  • 1a988ba96d7563d66e47db0d6bcc13cad7a85149 ipa-cert-fix: do not fail when CSR is missing from CS.cfg
  • 98711e8edf052211e5ccc3c1ac3c2367c6f23aff ipatests: add test_ipa_cert_fix to the nightly definitions

ipa-4-9:

  • f36e518b5704b02b81a4b80a1b84c429594cf5ce ipatests: add a test for ipa-cert-fix
  • eb711f781322657b0b3d77332f2462ecfb27db95 ipa-cert-fix: do not fail when CSR is missing from CS.cfg
  • 7f2be8a45a1d4baff0074cf4d8c446e3d08db795 ipatests: add test_ipa_cert_fix to the nightly definitions

ipa-4-8:

  • c9e0aa31cbd614ef7da5e94aeca3c292219d364a ipatests: add a test for ipa-cert-fix
  • 8f53cc36723e5ef84fc2c3cc143d8e0f2c7f283b ipa-cert-fix: do not fail when CSR is missing from CS.cfg
  • c1207c34a768ed5eb11a161c989484183281892b ipatests: add test_ipa_cert_fix to the nightly definitions

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to ipa-cert-fix tool now handles situations when a CSR is missing from Dogtag's CA/KRA CS.cfg configuration files. Configuration file is updated with a CSR tracked by Certmonger.
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/5338
ipa-cert-fix tool now handles situations when a CSR is missing from Dogtag's CA/KRA CS.cfg configuration files. Configuration file is updated with a CSR tracked by Certmonger.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.