freeipa

#9652 IPA requires unique CA certificate subject names
Closed: fixed by sumenon. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

IPA currently requires unique CA certificate subjects and validates that when a new one is loaded the public keys match.

A root CA issued a series of subordinate CA's that meet this criteria so they are unusable within IPA.

Trying to add the second one fails with:

Failed to install the certificate: subject public key info mismatch

Steps to Reproduce

  1. Create a valid self-signed CA
  2. Issue a subordinate CA from it
  3. Jump forward 3 years and Issue a second subordinate CA from it with the same subject
  4. Use ipa-cacert-manage to load the certificates

Actual behavior

In this case all of the certificates are in the same file

ipa-cacert-manage install duplicatesubordinate.pem -t "C,,"

Installing CA certificate, please wait
Verified [root CA subject]
Failed to install the certificate: subject public key info mismatch
The ipa-cacert-manage command failed.

Expected behavior

Let the certificates be loaded.

Version/Release/Distribution

Apparently all versions that provide ipa-cacert-manage up through at least 4.12.2.

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-30658

Upstream PR https://github.com/freeipa/freeipa/pull/7504

FYI, https://public.cyber.mil/pki-pke/interoperability/entrust-ssp/ contains an example of such certificates:

$ tree
.
├── Trust_Chain_1
│   ├── 0-Entrust_Managed_Services_NFI_Root_CA_rekey.cer
│   └── 1-Entrust_NFI_Medium_Assurance_SSP_CA_rekey.cer
└── Trust_Chain_2
    ├── 0-Entrust_Managed_Services_NFI_Root_CA_rekey2.cer
    └── 1-Entrust_NFI_Medium_Assurance_SSP_CA_rekey2.cer

More details:

$ for cert in Trust_Chain_*/0-Entrust_Managed_Services_NFI_Root_CA_rekey*.cer ; do openssl x509 -text -noout -in "$cert" |egrep -A1 'Subject:|Subject Key' ; done
        Subject: C=US, O=Entrust, OU=Certification Authorities, OU=Entrust Managed Services NFI Root CA
        Subject Public Key Info:
--
            X509v3 Subject Key Identifier: 
                FA:DF:23:01:C4:AA:EC:23:E3:AD:6F:0D:34:A5:0D:CF:39:64:65:5E
        Subject: C=US, O=Entrust, OU=Certification Authorities, OU=Entrust Managed Services NFI Root CA
        Subject Public Key Info:
--
            X509v3 Subject Key Identifier: 
                F3:ED:39:B9:DA:1B:4D:03:3C:26:15:39:D8:33:B5:08:EF:38:3E:39

master:

  • f91b677ada376034b25d50e78475237c5976770e Don't require certificates to have unique ipaCertSubject

ipa-4-12:

  • 722a5a4e0f0c6948252d385da4ffef7c03338aec Don't require certificates to have unique ipaCertSubject

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.