freeipa

Clone
Source Code
GIT

#6869 CA-less pkinit not installable with --pkinit-cert-file option
Closed: fixed 7 years ago Opened 7 years ago by stlaz.

Closed: fixed
Reopen Issue

When installing PKINIT cert in CA-less installation and using the --pkinit-cert-file option, the installation always fails.

The reason the installation fails is that we require full chain in the .p12 file that's fed to the above option. The file gets correctly exported to a PEM bundle in '/var/kerberos/krb5kdc/kdc.crt' but it will contain multiple certificates. OpenSSL does not know how to deal with this, it assumes there's only one certificate in the PEM file. If the first certificate is a CA cert, that will cause the installation to crash as it will be unable to test anonymous pkinit.

Indeed, kinit -n gives:

...
[48537] 1492084647.997132: Preauth module pkinit (147) (info) returned: 0/Success
[48537] 1492084647.997365: PKINIT OpenSSL error: Failed to verify CMS message
[48537] 1492084647.997387: PKINIT OpenSSL error: error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01
[48537] 1492084647.997394: PKINIT OpenSSL error: error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed
[48537] 1492084647.997403: PKINIT OpenSSL error: error:2E09809E:CMS routines:CMS_SignerInfo_verify:verification failure
[48537] 1492084647.997427: PKINIT client could not verify DH reply
[48537] 1492084647.997437: Preauth module pkinit (17) (real) returned: -1765328320/Failed to verify CMS message: block type is not 01
kinit: Invalid signature while getting initial credentials

Metadata Update from @stlaz:
- Issue tagged with: bug
7 years ago

Metadata Update from @jcholast:
- Issue assigned to jcholast
7 years ago

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1444432
7 years ago

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1444432
7 years ago

Issue linked to bug 1444432

Metadata Update from @pvoborni:
- Issue priority set to: blocker
- Issue set to the milestone: FreeIPA 4.5.1
7 years ago

master:

  • 235265a certdb: add named trust flag constants
  • f0442a2 certdb, certs: make trust flags argument mandatory
  • 52730c7 certdb: use custom object for trust flags
  • 01a7416 install: trust IPA CA for PKINIT
  • 11b8a34 client install: fix client PKINIT configuration
  • 4d36cbf install: introduce generic Kerberos Augeas lens
  • f769045 server install: fix KDC PKINIT configuration
  • b9fd123 ipapython.ipautil.run: Add option to set umask before executing command
  • 0c5b2c4 certs: do not export keys world-readable in install_key_from_p12
  • cc57237 certs: do not export CA certs in install_pem_from_p12
  • 3b5dbf7 server install: fix KDC certificate validation in CA-less
  • b385570 replica install: respect --pkinit-cert-file
  • 9ea764e cacert manage: support PKINIT
  • 96ca62f server certinstall: support PKINIT

ipa-4-5:

  • 6338dbe certdb: add named trust flag constants
  • 749d504 certdb, certs: make trust flags argument mandatory
  • e688123 certdb: use custom object for trust flags
  • 16b295c install: trust IPA CA for PKINIT
  • 63c4cbd client install: fix client PKINIT configuration
  • 523a826 install: introduce generic Kerberos Augeas lens
  • b83ebe0 server install: fix KDC PKINIT configuration
  • 5cf5395 ipapython.ipautil.run: Add option to set umask before executing command
  • e6497f0 certs: do not export keys world-readable in install_key_from_p12
  • bc8deb1 certs: do not export CA certs in install_pem_from_p12
  • cbdf669 server install: fix KDC certificate validation in CA-less
  • 77ef29e replica install: respect --pkinit-cert-file
  • 6f900ec cacert manage: support PKINIT
  • e27b3e1 server certinstall: support PKINIT

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
7 years ago

Log in to comment on this ticket.

Metadata

bug

None
None
critical
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
None
Powered by Pagure 5.14.1
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.