Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-113778

[RFE] Command that retrieve and install new CA certificates

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • ipa-4.13.1-1.el10
    • Low
    • rhel-idm-ipa
    • ssg_idm
    • 22
    • 24
    • 0
    • QE ack, Dev ack
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • None
    • Enhancement
    • Hide
      Feature, enhancement: the tool ipa-certupdate now accepts an additional option --force-server SERVER.FQDN.
      Reason: A client connects to its default server (specified in /etc/ipa/ca.crt) when it retrieves the Certificate Authorities. If this default server is down or unreachable, the command ipa-certupdate fails.
      Result: The client can now connect to the server defined in the option --force-server SERVER.FQDN instead of using the default server when it retrieves the Certificate Authorities using ipa-certupdate.
      Show
      Feature, enhancement: the tool ipa-certupdate now accepts an additional option --force-server SERVER.FQDN. Reason: A client connects to its default server (specified in /etc/ipa/ca.crt) when it retrieves the Certificate Authorities. If this default server is down or unreachable, the command ipa-certupdate fails. Result: The client can now connect to the server defined in the option --force-server SERVER.FQDN instead of using the default server when it retrieves the Certificate Authorities using ipa-certupdate.
    • Proposed
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      As a system administrator, I would like a command to retrieve CA certificates from a working IPA server, so I don't need to manually installing CA certificates.

      So far, ipa-certupdate queries the CA using https like:

       # ipa-certupdate -v
...
ipalib.rpc: DEBUG: trying https://server0.example.com/ipa/json
ipalib.rpc: DEBUG: New HTTP connection (server0.example.com)
...
ipalib.rpc: DEBUG: [try 1]: Forwarding 'ca_find/1' to json server 'https://server0.example.com/ipa/session/json'

      However, when local CA certificates expired, the validation failed

      Connection to https://server0.example.com/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)
Connection to https://server1.example.com/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)

      Thus we need a command or ipa-certupdate option to retrieve the CA certificates similar to

      kinit -k
ldapsearch -Y gssapi -H ldap://server0.example.com -b 'cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com'

              frenaud@redhat.com Florence Renaud
              rhn-support-dchen Ding Yi Chen
              Florence Renaud Florence Renaud
              PRANAV THUBE PRANAV THUBE
              Filip Hanzelka Filip Hanzelka
              Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

                Created:
                Updated: