search

freeipa / freeipa-healthcheck

Check the health of a freeIPA installation
GNU General Public License v3.0
50 stars 28 forks source link

error when the IPA is intialised with an extern CA #285

Closed m3xiz closed 1 year ago

m3xiz commented 1 year ago

At installation time, IPA provided a certificate request and this one is signed by an external CA. The heakthcheck is producing this output: ra.get_certificate(): Request failed with status 404: Non-2xx response from CA REST API: 404. Certificate ID 0x6596a821b68c5857 not found (404) [ { "source": "ipahealthcheck.dogtag.ca", "check": "DogtagCertsConnectivityCheck", "result": "ERROR", "uuid": "68600eea-1f78-4628-95f2-b3a5a8a4f8db", "when": "20230308105921Z", "duration": "0.165748", "kw": { "key": "cert_show_1", "error": "Certificate operation cannot be completed: Request failed with status 404: Non-2xx response from CA REST API: 404. Certificate ID 0x6596a821b68c5857 not found (404)", "serial": "7320223107087358039", "msg": "Serial number not found: {error}" } } ]

The missing certificate is the sub CA signed by the external CA. I believe this is not an error and this message should not be raised. The error is reproducable.

flo-renaud commented 1 year ago

Hi @m3xiz I was also able to reproduce the issue with the following packages: dogtag-pki-base-11.2.0-2.fc37.noarch freeipa-server-4.10.1-1.fc37.x86_64 freeipa-healthcheck-0.12-1.fc37.noarch

The code is internally calling a command equivalent to ipa cert-show <serial for IPA CA>, which ends up calling PKI rest API (GET /ca/rest/certs/<serial>) and PKI returns an error Certificate ID <serial> not found. We would need to check with PKI team if IPA CA should be visible through this call even when it's an externally-signed CA.

rcritten commented 1 year ago

It pulls the serial number of the root CA and tries to do a cert-show which will likely fail, or worse be a false positive, as the certificate doesn't exist in the local CA because it was issued externally.

I think we should just skip this check when the CA issuer doesn't match the subject, as suggested.

rcritten commented 1 year ago

https://github.com/freeipa/freeipa-healthcheck/pull/286