From 7b278b63b417edea74ca9344688e02b70e64b8bf Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Wed, 9 Jun 2021 19:03:53 +0200 Subject: [PATCH] CA-less install: non-ASCII chars in CA cert subject In a CA-less install, if the CA cert subject contains non-ascii characters, ipa-server-install fails when configuring SSL for httpd. The issue happens when calling ipautil.run to extract the keys from a p12file. The code is using the raw output of the command and doesn't need to specify capture_output=True, as this option breaks if the output contains non-ascii characters. The raw_output contains bytes, the output is a str built by decoding the raw_output and may fail if non-ascii characters are present. Fixes: https://pagure.io/freeipa/issue/8880 Signed-off-by: Florence Blanc-Renaud Reviewed-By: Rob Crittenden Reviewed-By: Francois Cami --- ipaserver/install/certs.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py index 171476c18..0acab92b0 100644 --- a/ipaserver/install/certs.py +++ b/ipaserver/install/certs.py @@ -103,7 +103,7 @@ def pkcs12_to_certkeys(p12_fname, p12_passwd=None): else: args.extend(["-passin", "pass:"]) - pems = ipautil.run(args, capture_output=True).raw_output + pems = ipautil.run(args).raw_output certs = x509.load_certificate_list(pems) priv_keys = x509.load_private_key_list(pems)