freeipa

Clone
Source Code
GIT

#4480 Make external CA chain installer options more usable
Closed: Fixed None Opened 9 years ago by jcholast.

Closed: Fixed
Reopen Issue

CA installation should be as straightforward as possible, many users stump on that.

Make the options more usable, at least:

  • Currently we support only PEM certificate files. PKCS#7 is a common format for certificate chains, we should support it as well.
  • Improve validator to catch certificate without an extension (details in comment:2).

We also need to beef up our validation.

When I made a mistake signing the request, and didn't add any extensions to it, the installation crashed with IndexError as in #4397.

Reproducer for comment 2 (If necessary, adjust the IP addresses, hostnames, etc. to fit your environment.)
index-error-reproducer.sh

This a stretch goal for 4.1.

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=886645 (Red Hat Enterprise Linux 7)

master:

  • 60ecba7 Add NSSDatabase.import_files method for importing files in various formats
  • 3aa0731 External CA installer options usability fixes
  • 8808388 CA-less installer options usability fixes
  • 3cde7e9 Allow choosing CA-less server certificates by name
  • 83cbfa8 Do stricter validation of CA certificates

ipa-4-1:

  • b93bdb7 Add NSSDatabase.import_files method for importing files in various formats
  • 6136a3e External CA installer options usability fixes
  • a29ee45 CA-less installer options usability fixes
  • 01623f7 Allow choosing CA-less server certificates by name
  • 0c4d7da Do stricter validation of CA certificates

master:

  • 2421b13 Fix ImportError in ipa-ca-install

Metadata Update from @jcholast:
- Issue assigned to jcholast
- Issue set to the milestone: FreeIPA 4.1
6 years ago

Login to comment on this ticket.

Metadata
None
None
None
normal
None
None
None
None
defect
None
None
Installation
None
1
None
None
pviktori
None
https://bugzilla.redhat.com/show_bug.cgi?id=886645
None
None
http://www.freeipa.org/page/V4/Installer_CA_options_usability_improvements
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.