<div dir="ltr">Finally I decided to fall back to pulp-generated CA cert and key. I invoked pulp-gen-ca-certificate and got the following:<div><br></div><div><div><font face="monospace, monospace">[root@nms ~]# ls -lZ /etc/pki/pulp/</font></div><div><font face="monospace, monospace">-rw-r-----. root apache unconfined_u:object_r:pulp_cert_t:s0 ca.crt</font></div><div><font face="monospace, monospace">-rw-r-----. root apache unconfined_u:object_r:pulp_cert_t:s0 ca.key</font></div></div><div><br></div><div>To achieve this, I had to hard-code CA_CRT variable in pulp-gen-ca-certificate since the script was setting this variable to '#', though I have the following in /etc/pulp/server.conf:</div><div><div><font face="monospace, monospace">[security]</font></div><div><font face="monospace, monospace">cacert: /etc/pki/pulp/ca.crt # Deprecated! See above description for details.</font></div><div><font face="monospace, monospace">cakey: /etc/pki/pulp/ca.key # Deprecated! See above description for details.</font></div></div><div><br></div><div>CA_KEY variable was set up correctly</div><div><br></div><div>But even after I got new CA key and cert at correct paths, I still get the following error:</div><div><br></div><div><div><font face="monospace, monospace">RequestException: POST request</font></div><div><font face="monospace, monospace">on /pulp/api/v2/actions/login/ failed with 500 - error signing cert request:</font></div><div><font face="monospace, monospace">Signature ok</font></div><div><font face="monospace, monospace">subject=/CN=admin:admin:5571b5b4cfbac030922d8c3d</font></div><div><font face="monospace, monospace">Getting CA Private</font></div><div><font face="monospace, monospace">Key</font></div><div><font face="monospace, monospace">unable to load CA Private Key</font></div><div><font face="monospace, monospace">139766116218784:error:0906D06C:PEM</font></div><div><font face="monospace, monospace">routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE</font></div><div><font face="monospace, monospace">KEY</font></div><div><font face="monospace, monospace">unable to write 'random state'</font></div></div><div><br></div><div>I even tried to remove comment lines after settings values in server.conf - no better</div><div><br></div><div>Does anybody have any idea why this may be happening?</div><div><br></div><div>Thanks!</div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-04-15 23:27 GMT+03:00 Konstantin M. Khankin <span dir="ltr"><<a href="mailto:khankin.konstantin@gmail.com" target="_blank">khankin.konstantin@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">So just for test purposes I extracted CA key from FreeIPA and installed it to pulp server. This is what I have in /etc/pulp/server.conf:<div><div><font face="monospace, monospace">[security]</font></div><div><font face="monospace, monospace">cacert: /etc/pki/tls/certs/ca.crt # Deprecated! See above description for details.</font></div><div><font face="monospace, monospace">cakey: /etc/pki/pulp/ca.key # Deprecated! See above description for details.</font></div></div><div><br></div><div>I looked into pulp sources and found how it generates client certificates:</div><div><div><font face="monospace, monospace"> cmd = 'openssl x509 -req -sha1 -CA %s -CAkey %s -set_serial %s -days %d' % \</font></div><div><font face="monospace, monospace"> (ca_cert, ca_key, serial, expiration)</font></div><div><font face="monospace, monospace"> p = subprocess.Popen(cmd, shell=True, stdin=subprocess.PIPE,</font></div><div><font face="monospace, monospace"> stdout=subprocess.PIPE, stderr=subprocess.STDOUT)</font></div><div><font face="monospace, monospace"> output = p.communicate(input=req.as_pem())[0]</font></div></div><div><br></div><div>So I decided to test that command manually to see if it works with exported CA key and cert:</div><div><div><font face="monospace, monospace">[root@nms ~]# sudo -u apache openssl x509 -req -sha1 -CA /etc/pki/tls/certs/ca.crt -CAkey /etc/pki/pulp/ca.key -set_serial 36 -days 10 < csr</font></div><div><font face="monospace, monospace">Signature ok</font></div><div><font face="monospace, monospace">subject=/C=US/ST=Utah/L=Lindon/O=DigiCert Inc./OU=DigiCert/CN=<a href="http://example.digicert.com" target="_blank">example.digicert.com</a></font></div><div><font face="monospace, monospace">Getting CA Private Key</font></div><div><font face="monospace, monospace">-----BEGIN CERTIFICATE-----</font></div><div><font face="monospace, monospace">MIIDHTCCAgUCASQwDQYJKoZIhvcNAQEFBQAwMjEQMA4GA1UEChMHR1NLLkxPQzEe</font></div><div><font face="monospace, monospace">MBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTE2MDQxNTIwMjIwMFoX</font></div><div><font face="monospace, monospace">DTE2MDQyNTIwMjIwMFowdzELMAkGA1UEBhMCVVMxDTALBgNVBAgMBFV0YWgxDzAN</font></div><div><font face="monospace, monospace">BgNVBAcMBkxpbmRvbjEWMBQGA1UECgwNRGlnaUNlcnQgSW5jLjERMA8GA1UECwwI</font></div><div><font face="monospace, monospace">RGlnaUNlcnQxHTAbBgNVBAMMFGV4YW1wbGUuZGlnaWNlcnQuY29tMIIBIjANBgkq</font></div><div><font face="monospace, monospace">hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8+To7d+2kPWeBv/orU3LVbJwDrSQbeKa</font></div><div><font face="monospace, monospace">mCmowp5bqDxIwV20zqRb7APUOKYoVEFFOEQs6T6gImnIolhbiH6m4zgZ/CPvWBOk</font></div><div><font face="monospace, monospace">Zc+c1Po2EmvBz+AD5sBdT5kzGQA6NbWyZGldxRthNLOs1efOhdnWFuhI162qmcfl</font></div><div><font face="monospace, monospace">gpiIWDuwq4C9f+YkeJhNn9dF5+owm8cOQmDrV8NNdiTqin8q3qYAHHJRW28glJUC</font></div><div><font face="monospace, monospace">ZkTZwIaSR6crBQ8TbYNE0dc+Caa3DOIkz1EOsHWzTx+n0zKfqcbgXi4DJx+C1bjp</font></div><div><font face="monospace, monospace">tYPRBPZL8DAeWuA8ebudVT44yEp82G96/Ggcf7F33xMxe0yc+Xa6owIDAQABMA0G</font></div><div><font face="monospace, monospace">CSqGSIb3DQEBBQUAA4IBAQDA3jQfQKmdKU9C+ltGmQmIGq0AL50+xllWvkcR6IpK</font></div><div><font face="monospace, monospace">zSSUcLz9CBBJkSOMBQoCDgr8VVB6L4V1h+2YfCGOlkuee5hTpXs11CDrcAYAM6oT</font></div><div><font face="monospace, monospace">nhkIlFPuNw04q44cievpryGV+ZU5etIQXuLYNajNbb1v5s4z6buaviaxd0gcT8OU</font></div><div><font face="monospace, monospace">/ta00GAUv8TTj+6Q/gZ7CvUO0rDJE5z6PSJ+yCkjX8ZlVyX9UFy4q6K3f+AIVW7l</font></div><div><font face="monospace, monospace">svTf3TwNKcSbn2DpfyKKnTvcxDeDRVK+SmZcXxcwNmXV1UclrtjnxBqzkPcchFHT</font></div><div><font face="monospace, monospace">7X0EK5+5YoPSP0JMm7oCaO1JANyk4DStioaDpc5EpwnC</font></div><div><font face="monospace, monospace">-----END CERTIFICATE-----</font></div><div><font face="monospace, monospace">unable to write 'random state'</font></div></div><div><br></div><div>The last error happens (probably) because apache user's home directory is not writable, but it's clear that apache user can access CA cert and key and use them together. But this is what I get when I try to log into pulp server:</div><div><div><font face="monospace, monospace">[root@nms ~]# pulp-admin -v login -u admin</font></div><div><font face="monospace, monospace">Enter password: </font></div><div><font face="monospace, monospace">2016-04-16 01:23:49,780 - ERROR - Exception occurred:</font></div><div><font face="monospace, monospace"> href: /pulp/api/v2/actions/login/</font></div><div><font face="monospace, monospace"> method: POST</font></div><div><font face="monospace, monospace"> status: 500</font></div><div><font face="monospace, monospace"> error: error signing cert request: Signature ok</font></div><div><font face="monospace, monospace">subject=/CN=admin:admin:5571b5b4cfbac030922d8c3d</font></div><div><font face="monospace, monospace">Getting CA Private Key</font></div><div><font face="monospace, monospace">unable to load CA Private Key</font></div><div><font face="monospace, monospace">140076687837088:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE KEY</font></div><div><font face="monospace, monospace">unable to write 'random state'</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> traceback: [u' File "/usr/lib/python2.7/site-packages/django/core/handlers/base.py", line 112, in get_response\n response = wrapped_callback(request, *callback_args, **callback_kwargs)\n', u' File "/usr/lib/python2.7/site-packages/django/views/generic/base.py", line 69, in view\n return self.dispatch(request, *args, **kwargs)\n', u' File "/usr/lib/python2.7/site-packages/django/views/generic/base.py", line 87, in dispatch\n return handler(request, *args, **kwargs)\n', u' File "/usr/lib/python2.7/site-packages/pulp/server/webservices/views/decorators.py", line 241, in _auth_decorator\n return _verify_auth(self, operation, super_user_only, method, *args, **kwargs)\n', u' File "/usr/lib/python2.7/site-packages/pulp/server/webservices/views/decorators.py", line 195, in _verify_auth\n value = method(self, *args, **kwargs)\n', u' File "/usr/lib/python2.7/site-packages/pulp/server/webservices/views/root_actions.py", line 25, in post\n key, certificate = factory.cert_generation_manager().make_admin_user_cert(user)\n', u' File "/usr/lib/python2.7/site-packages/pulp/server/managers/auth/cert/cert_generator.py", line 31, in make_admin_user_cert\n return self.make_cert(self.encode_admin_user(user), expiration)\n', u' File "/usr/lib/python2.7/site-packages/pulp/server/managers/auth/cert/cert_generator.py", line 85, in make_cert\n raise Exception("error signing cert request: %s" % output)\n']</font></div><div><font face="monospace, monospace"> data: {}</font></div><div><font face="monospace, monospace"> </font></div><div><font face="monospace, monospace">An internal error occurred on the Pulp server:</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">RequestException: POST request</font></div><div><font face="monospace, monospace">on /pulp/api/v2/actions/login/ failed with 500 - error signing cert request:</font></div><div><font face="monospace, monospace">Signature ok</font></div><div><font face="monospace, monospace">subject=/CN=admin:admin:5571b5b4cfbac030922d8c3d</font></div><div><font face="monospace, monospace">Getting CA Private</font></div><div><font face="monospace, monospace">Key</font></div><div><font face="monospace, monospace">unable to load CA Private Key</font></div><div><font face="monospace, monospace">140076687837088:error:0906D06C:PEM</font></div><div><font face="monospace, monospace">routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: ANY PRIVATE</font></div><div><font face="monospace, monospace">KEY</font></div><div><font face="monospace, monospace">unable to write 'random state'</font></div></div><div><br></div><div>I have PAM authentication enabled to give an access to IPA users and user 'admin' is configured as pulp admin. But for some reasons pulp is not able to generate a certificate. I've tried to restart all pulp processes and httpd multiple times already. Tried to disable SELinux (and enabled it back since it didn't change anything). Do you have any idea why this error could occur?</div><div><br></div><div>Thanks!</div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">2016-04-15 22:29 GMT+03:00 Konstantin M. Khankin <span dir="ltr"><<a href="mailto:khankin.konstantin@gmail.com" target="_blank">khankin.konstantin@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi!<br clear="all"><div><br></div><div>I'm trying to use FreeIPA PKI for pulp. I successfully installed all certificates/keys on consumers and set up httpd to use correct certificates/keys, but faced a problem - pulp wants to have CA superpowers to sign client certificates, even though config file and documentation both says that this function is deprecated</div><div><br></div><div>Can I somehow disable certificate signing attempts in pulp so that it is able to use existing PKI?</div><div><br></div><div>Thanks!</div><span><font color="#888888"><div><br></div>-- <br><div>Konstantin Khankin<br></div> </font></span></div> </blockquote></div><br><br clear="all"><div><br></div></div></div><span class="HOEnZb"><font color="#888888">-- <br><div>Konstantin Khankin<br></div> </font></span></div></div> </blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Ханкин Константин<br></div> </div>