freeipa

#9602 CA Certificate created with serial 1
Closed: worksforme by frenaud. Opened by pgreening.

Closed: worksforme
Reopen Issue

Request for enhancement

Create an SSL CA Certificate with a unique serial number during IPA server installation

Issue

During the default install of IPA-4.11.0-10 on Alma 9.4, the IPA installer creates a CA Certificate for use signing everything. This CA has a serial of "1", which is not unique. Certificate serial numbers should be unique

Steps to Reproduce

  1. pretty much any standard IPA server install
  2. openssl x509 -noout -text -in /etc/ipa/ca.crt |grep -i serial
  3. see the serial number is 1.

Actual behavior

the serial number of the CA Cert will always be 1

Expected behavior

the serial number of the CA Cert should never be 1.

Version/Release/Distribution

ipa-server-4.11.0-10.el9_4.x86_64
AlmaLinux release 9.4 (Seafoam Ocelot)
kernel: 5.14.0-427.18.1.el9_4.x86_64

Additional info:

This causes any sane browser to throw an error: https://support.mozilla.org/en-US/kb/Certificate-contains-the-same-serial-number-as-another-certificate#firefox:win10:fx126

This is kinda basic stuff. just use the date as the serial number. Unix time, or concatenate YYYYMMDDhhmmss, or something similar.

Hi @pgreening
According to RFC 5280, the serial number MUST be unique for each certificate issued by a given CA, but it doesn't means that it must be unique overall.

The firefox issue you mention would happen if you see 2 certificates issued by the same CA and with the same serial number, but that are different. In your case, maybe you did a first installation of IPA with self-signed CA, imported the CA, then uninstalled and re-installed with the same parameters, which would result in the creation of another CA with the same subject and same serial 1 but a different key.

If you really want to avoid serial number = 1 you can install IPA with random serial numbers: ipa-server-install --random-serial-numbers

Metadata Update from @frenaud:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.