#3594 Changing Directory Manager password on IPA server and replica-info
Closed: Fixed None Opened 8 years ago by rcritten.

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 6): Bug 957244

Description of problem:
Replica-info contains files, like cacert.p12 which are protected by Directory
Manager password of initial installation. If the password is changed, the
replication information still contains the old password and the installation of
CA replica fails.

Version-Release number of selected component (if applicable):
ipa-server 3.0.0-26.el6_4.2
pki-ca 9.0.3-30.el6

How reproducible:
Every time.

Steps to Reproduce:
1. Install ipa-server
2. Change Directory Manager password
3. Install CA replica with a new password

Actual results:

ipa-replica-manage --setup-ca /replica-info-[fqdn].gpg
[3/17]: configuring certificate server instance
ipa         : CRITICAL failed to configure ca instance Command '/usr/bin/perl
/usr/bin/pkisilent ConfigureCA -cs_hostname XXXXXXXX -cs_port 9445
-client_certdb_dir /tmp/tmp-lhZ4xM -client_certdb_pwd XXXXXXXX -preop_pin XXXXX
-domain_name IPA -admin_user admin -admin_email root@localhost -admin_password
XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa
-agent_cert_subject CN=ipa-ca-agent,O=XXXXXX -ldap_host XXXXXX -ldap_port 7389
-bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name
ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true
-backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal
-ca_subsystem_cert_subject_name CN=CA Subsystem,O=XXXXXXX
-ca_subsystem_cert_subject_name CN=CA Subsystem,O=XXXXX
-ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=XXXXX
-ca_server_cert_subject_name CN=fqdn,O=XXXXXXX
-ca_audit_signing_cert_subject_name CN=CA Audit,O=XXXXXX
-ca_sign_cert_subject_name CN=Certificate Authority,O=XXXX -external false
-clone true -clone_p12_file ca.p12 -clone_p12_password XXXXXXXX -sd_hostname
XXXXXX -sd_admin_port 443 -sd_admin_name admin -sd_admin_password XXXXXXXX
-clone_start_tls true -clone_uri https://XXXXXXX:443' returned non-zero exit
status 255

Expected results:
[3/17]: configuring certificate server instance
-> Success

Additional info:

Moving to next month bucket.

Committed to master:

master: c1e9b6f

ipa-3-2 version needs additional rebase.

ipa-3-2 version has been re-based and committed as 7b402b3

Metadata Update from @rcritten:
- Issue assigned to akrivoka
- Issue set to the milestone: FreeIPA 3.2.x - 2013/06 (bug fixing)

4 years ago

Login to comment on this ticket.