freeipa

#9671 ACME directory reports invalid URLs
Opened by rcritten. Modified

Open
Close Issue

Issue

$ curl https://hostname/acme/directory
{"newNonce":"https://ipa.example.test/acme/new-nonce","newAccount":"https://ipa.example.test/acme/new-account","newOrder":"https://ipa.example.test/acme/new-order","revokeCert":"https://ipa.example.test/acme/revoke-cert","meta":{"termsOfService":"https://www.example.com/acme/tos.pdf","website":"https://www.example.com","caaIdentities":["example.com"],"externalAccountRequired":false}}

Also seen with:
$ pki acme-info

There should be no references to example.com.

Version/Release/Distribution

freeipa-server-4.13.0.dev202409181703+git4bfbf0ba9-0.fc40.x86_64
dogtag-pki-ca-11.5.0-3.fc40.noarch

Alexander pointed out that this can be managed using: pki-server acme-metadata-mod

It is an unauthenticated (other than root) command and updates as far as I can tell updates /etc/pki/pki-tomcat/acme/metadata.conf

Which means it needs to be set on every host!? So making this an exercise for the end user doesn't seem like a good thing to do.

Yes, it is written on disk on each system. We'd have to add an oddjob helper to handle it.
See https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring-ACME-Metadata.adoc for details (not much, really). pki-server acme-metadata-mod is asking interactively and really does only read and write the file.

On IPA side we have ed001c97eec092d814ff9ecc57fafffe2d03657e as a nice example of adding a command (in this case it is a set of options to ipa config-mod: --enable-sid --add-sids) executed through the oddjob mechanism. It also handled authorization via IPA privileges.

I would love to see ACME enablement moved to a similar command. We also have trust_enable_agent command (not exposed to CLI) which is done similarly to allow remote replica configuration.

--enable-sid --add-sids was added in ticket https://pagure.io/freeipa/issue/8995

There is already a tool for configuring ACME: ipa-acme-manage.

The hardest part I think will be code that detects a change and applies it on all servers. I don't believe we have anything comparable now.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.