freeipa

#9760 ipa-cert-fix proceeds with the externally signed CA signing cert being expired
Closed: fixed by frenaud. Opened by kororland.

Closed: fixed
Reopen Issue

Description of problem:

If externally signed CA cert is expired (or really close to expiry), the ipa-cert-fix will proceed with issuing new service and shared certificates using it, that produces certificates with very short validity periods. If that's the case, the situation gets worse than before ipa-cert-fix - we can't return in time to operate normally in this case.

Version-Release number of selected component (if applicable):

VERSION: 4.12.2, API_VERSION: 2.254

How reproducible:

always, if you have expired externally signed CA

Steps to Reproduce:

  1. expire your externally-signed CA cert
  2. run ipa-cert-fix

Actual results:

system is broken and requires manual search for previous certs in LDAP repository in order to get operational again

Expected results:

check is run if CA is externally signed and if it is expired, and if that's the case - ipa-cert-fix doesn't perform any action (renewal not possible until new CA cert is signed and installed)

Additional info:

copy of https://issues.redhat.com/browse/RHEL-4941

PR opened: https://github.com/freeipa/freeipa/pull/7723

master:

  • ac6eee670d8a753e66ba69a65eff55447fff2822 Add a check into ipa-cert-fix tool to avoid updating certs if CA is close to being expired.
  • 23bfcdd4e22013552e8d95ed5d150c580201bdc9 Test fix for the update

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-4941

ipa-4-12:

  • 3f7d84677775bd9e237b28b08fe961a157b8b14e Add a check into ipa-cert-fix tool to avoid updating certs if CA is close to being expired.
  • cdc03d7b6233f736c51c10aa07225aac9715e4c0 Test fix for the update

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-9:

  • 4ee6abfcd903b30ee304a582f9b4fde10b2d267a Add a check into ipa-cert-fix tool to avoid updating certs if CA is close to being expired.
  • b5b737dd38c00d9b4d5192af1d27f3e89f8c76fd Test fix for the update
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.