On a freshly installed ipa configured to be dnssec-master:
ipa-dns-install --dnssec-master
When I create a dnssec-signed root zone with one record in it
ipa dnszone-add --dnssec true . ipa dnsrecord-add "." rhts.englab.brq.redhat.com. --ns-rec=dell-pe1950-06.rhts.englab.brq.redhat.com
And then query dnssec info for this zone:
dig +dnssec @localhost "." SOA
The response does NOT contain the key. After I restart named-pkcs11.service the key starts to be shown
This is not happening always.
Issue is caused by a bug somewhere between BIND and Softhsm storage, we have not find where exactly this happens yet.
Symptoms are that named cannot read the private keys, following entry is listed in named log
dns_dnssec_findmatchingkeys: error reading key file Kexample.test.+008+51274.private: not found
Restart of named-pkcs11 service fixes it.
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1272869
FreeIPA 4.2.3 was released, moving to next bug fixing milestone.
Some patches were posted for review but IMHO it is not a complete fix yet.
Improvements of debugging has been pushed together within ticket #5334
The issue is not resolved yet.
Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1296214 (Red Hat Enterprise Linux 7)
I do not have to investigate it right now.
I do not have time to investigate it right now.
AFAIK workaround exists so it should not be a test blocker.
Test workarounds
ipa-4-3:
master:
It seems that it works now. Hopefully some underlying component was fixed.
Metadata Update from @ofayans: - Issue assigned to pspacek - Issue set to the milestone: FreeIPA 4.5
It is happening again :-(
Metadata Update from @mbasti: - Custom field blocking reset (from ipa-tests) - Issue status updated to: Open (was: Closed)
Metadata Update from @mbasti: - Issue assigned to tkrizek (was: pspacek) - Issue set to the milestone: None (was: FreeIPA 4.5)
The issue is easily reproducible running "test_dnssec" test suite.
Metadata Update from @pvoborni: - Issue priority set to: important (was: normal) - Issue set to the milestone: FreeIPA 4.7 - Issue tagged with: test-failure
Metadata Update from @pvoborni: - Issue assigned to cheimes (was: tkrizek)
Metadata Update from @rcritten: - Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)
FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone
ipa-4-5:
Metadata Update from @tdudlak: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
Log in to comment on this ticket.