freeipa

#9738 During server installation don't use the PKI API directly to issue certificates
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Request for enhancement

There is a general goal to reduce reliance on a specific PKI API. This gives flexibility to the PKI team to change their API without breaking us and breaks us free from supporting both the XML and JSON APIs.

This specific request will not solve all uses of the API.

In https://pagure.io/freeipa/issue/9704 we add a cert_approve workflow so certmonger can renew CA subsystem certificates using IPA directly.

Currently the RA, DS, HTTP and KDC certificates are requested directly from the PKI XML API by certmonger during installation.

Use the PKI-provided cli tool pki instead to do these requests instead of certmonger.

The CA generates an admin certificate in /root/ca-admin.p12. We basically don't use this post-installation. This can be used to authenticate to the PKI API to issue the IPA RA certificate. Then we can use that to obtain the DS, HTTP and KDC certificates.

We will need an openssl configuration file to generate the same type of CSR that certmonger currently does, which includes a UPN, encodes the profile, etc.

Once a single CA server is available then we no longer need the admin certificate. We'll need to test and verify that going from CA-less to CA-ful is still possible, particuarly if the ca-admin.p12 cert has expired.

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/FREEIPA-11726

master:

  • 56be7b460e7fc070847e589435c951dfba84c13d Drop python v2 in ipaserver/install/certs.py for lint errors
  • 4a9c1dde579bb048e3d90cfafa93dfd8eef359c2 Drop python 2 support in installutils.py
  • 6d7f51c115e255873f09fc73d5246b2745016a76 Drop python 2 support in ipaserver/install/ca.py

master:

  • 46b7c16be13c755ccbf87ab4252fe511f68dfd3a Don't let lack of subca in PKI prevent LDAP deletion

ipa-4-12:

  • 1db66d23c79f9d8f53ad4ad6febd25e54f9f6da0 Catch decoding errors in CertificateSigningRequest parameters

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Issue status updated to: Open (was: Closed)

ipa-4-12:

  • 272ed4d9f54cc38eeece4314c76775fd95a7e667 Don't let lack of subca in PKI prevent LDAP deletion

master:

  • cdc8054453cb83c9b7fa9628c86f4566a91815f8 Use the pki tool to bootstrap certificates during installation
  • 5d55b4efb24f042142b4c25e72b7c5f6ed1fe305 Add config option for RSA key size for HTTP, DS, PKINIT, RA certs
  • 8aea0fd90018c5f55c9b2ed1a6ef055205752789 Refactor installer cert issuance to use pki python lib
  • 43f0284080b9ed51d929ce41bc3bc2e891ffecb5 Replace REST with PKI python API for cert and LWCA
  • 191aec5a5278368a4af1836178442f08dfc791b2 Use the APIClient instead of direct REST calls for ACME
  • f5fc5e0fdf87c7b8e23e0289f0b6d810d9335aad Remove the RestClient class
  • 7a33bccabd11875d5da16680c1f4213c2c12af13 Use PKIClient instead of deprecated PKIConnection
  • e8425bd88dfe10e0cb4901ac93b87a3110247097 Configure renewals to use the IPA JSON API
  • 1c107542cf1113079c5562b490c2520663153f0f Retrieve all cert profiles from the CA with --all
  • 1729aa4e66fbd2ec38e51a90699f1d481cb55995 Reduce the log level before calling PKI functions
  • 372468511d18e8b609d7724670713373f01defa1 Set minimum version of certmonger and PKI for PKI-API
  • 56620f400adb183ebd9c37ee69876bc108913f30 Sort when comparing tuples in the xmlrpc tests
  • f74ff2136488be7fae4c3f99c5f25e0ccd18a3b8 Refine restricting CA profiles to known subjects
  • d322bbfb3fd745733ae3ecf245f099f1c3ede9a7 Detect the highest API version the remote server supports
  • d424dc6dd2b23b485f15c7159090fda391ad78fc Move some functions to installutils to be more independent
  • 0b521f7d19cb1682b67287a7c9f754f5b92b8868 PR-CI: Run test_installation_TestInstallKeySizes in the nightlies

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.