freeipa team mailing list archive

[Jimothy <1987276@xxxxxxxxxxxxxxxxxx>]

I have managed to install the proposed version on this link:
https://launchpad.net/ubuntu/jammy/amd64/certmonger/0.79.14+git20211010-2ubuntu1.1

Unfortunately, this is still suffering some issues when creating certs:

Mar  7 15:27:07 lnx-test-3 certmonger[35411]: 2024-03-07 15:27:07 [35411] Error: failed to verify signature on server response. error:10800075:PKCS7 routines::certificate verify error
Mar  7 15:27:15 lnx-test-3 kernel: [ 6712.749399] audit: type=1400 audit(1709825235.952:3267): apparmor="ALLOWED" operation="open" class="file" profile="/usr/sbin/sssd" name="/proc/35585/cmdline" pid=32369 comm="sssd_nss" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Mar  7 15:28:01 lnx-test-3 scep-submit: Message failed verification.
Mar  7 15:28:01 lnx-test-3 scep-submit: Error: failed to verify signature on server response.#012
....
# Cert info
....
Mar  7 15:28:01 lnx-test-3 scep-submit: error:10800075:PKCS7 routines::certificate verify error
....
# More cert info
....
Mar  7 15:28:01 lnx-test-3 certmonger[35411]: 2024-03-07 15:28:01 [35411] Error: failed to verify signature on server response. error:10800075:PKCS7 routines::certificate verify error

-- 
You received this bug notification because you are a member of FreeIPA,
which is subscribed to certmonger in Ubuntu.
https://bugs.launchpad.net/bugs/1987276

Title:
  certmonger - libcrypto issues with openssl3

Status in certmonger package in Ubuntu:
  Fix Released
Status in certmonger source package in Jammy:
  Fix Committed

Bug description:
  [Impact]

  Requesting SCEP certificates crashes certmonger when it's built with
  OpenSSL 3, and it needs a patch backported to fix this.

  [Test case]

  Check that the SCEP requests succeed without the daemon crashing.

  
  [Where things could go wrong]

  This patch has been upstream for several months now, and this part of
  certmonger hasn't seen any additional commits since, so it's safe to
  say that adding this shouldn't regress things.

  
  --

  I just want to let you know that this bug is still present from 22.04
  onwards (anything that uses libssl3 as default) - bug is being tracked
  in https://pagure.io/certmonger/issue/244 - I already tested the patch
  provided and it works, but I would love to see an updated package on
  the official repository.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/certmonger/+bug/1987276/+subscriptions