#7354 Fedora 28: Support NSSDB SQL format
Closed: fixed 5 years ago Opened 6 years ago by cheimes.

Issue

NSS has changed its default database format from DBM to SQL. mod_nss does not support auto-detection and has a hard-coded default to DBM. The NSSDB in /etc/httpd/alias must be converted to SQL format andNSSCertificateDatabase /etc/httpd/alias in /etc/httpd/conf.d/nss.conf must be changed to ``NSSCertificateDatabase sql:/etc/httpd/alias.

Upgrade of NSSDB can be performed by ipapython.certdb.NSSDatabase.convert_db() while httpd is stopped.

Steps to Reproduce

  1. Install latest ipa-4-6 RPMS
  2. ipa-server-install

Actual behavior

During installation HTTPd fails to start with error message Server user apache lacks read access to NSS key database /etc/httpd/alias/key3.db

Expected behavior

server installs correctly

Version/Release/Distribution

  • freeipa-server-4.6.2.dev201801080853+git1dc74f0e9-0.fc28.x86_64
  • freeipa-client-4.6.2.dev201801080853+git1dc74f0e9-0.fc28.x86_64
  • 389-ds-base-1.4.0.3-1.fc28.1.x86_64
  • pki-ca-10.5.3-1.fc28.noarch
  • krb5-server-1.16-2.x86_64

Metadata Update from @cheimes:
- Issue assigned to cheimes

6 years ago

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1458

6 years ago

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1491419

6 years ago

Metadata Update from @rcritten:
- Issue priority set to: normal
- Issue set to the milestone: FreeIPA 4.7

6 years ago

master:

  • 88fd3f9 certmonger: Use explicit storage format
  • c5fb6c8 Prepare migration of mod_nss NSSDB to sql format
  • 492e3c9 NSSDB: Let certutil decide its default db type
  • 66a32d8 NSS: Force restore of SELinux context
  • a8555d4 Update /etc/ipa/nssdb in client scripts
  • df99af4 Remove unused modutils wrappers from NSS/CertDB

Metadata Update from @cheimes:
- Issue priority set to: critical (was: normal)

6 years ago

Note: Bump requirements for NSS and certmonger to versions that default to SQL NSSDB.

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

5 years ago

Login to comment on this ticket.

Metadata