Don't error in DogtagCertsConnectivityCheck with external CAs #286
Conversation
There was a problem hiding this comment.
Hi @rcritten
if IPA is installed with embedded CA, the connectivity check can use the RA cert in all the cases (self-signed or externally signed CA), as this cert always exists and can be found with PKI API.
|
Excellent observation! Implemented. |
There was a problem hiding this comment.
Hi @rcritten
thanks for the update. Minor nitpicks, not related to this patch but that could be fixed with it:
- line 141, the message is missing a closing }
- lines 126, 132 and 138, we could replace the key 'cert_show_1' with 'cert_show_ra'
I tested the following scenarios with an externally-signed CA:
- missing RA cert file
- RA cert file contains a cert inconsistent with what is stored in LDAP
- pki stopped
All the above issues were properly reported.
The purpose of the check is to validate that communication with the CA works. In the past we looked up serial number 1 for this check. The problem is that if the server was installed with RSNv3 so had no predictable CA serial number. It also was broken with externally-issued CA certificate which cannot be looked up in IPA. Instead use the IPA RA agent certificate which should definitely have a serial number in the IPA CA if one is configured. Fixes: freeipa#285 Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Fixed.
Done. I modified the test expectations as well, including the typical serial number for the RA (it doesn't really matter in the end but non-zero is more obvious) |
There was a problem hiding this comment.
@rcritten
thanks for the update, works for me. I tested the following scenarios with an externally-signed CA:
- missing RA cert file
- RA cert file contains a cert inconsistent with what is stored in LDAP
- pki stopped
All the above issues were properly reported.
The serial number of externally-signed CA's were being checked using ipa-cert-find which invariably would return a not found error.
Instead return SUCCESS to effectively skip the check.
Fixes: #285