mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-10-26 07:00:07 -05:00
Florence Blanc-Renaud
c0994948b5
When a client or server is configured with DoT, the installer
creates /etc/unbound/conf.d/zzz-ipa.conf with
tls-cert-bundle: /etc/pki/tls/certs/ca-bundle.crt
This certificate bundle does not exist any more in fedora 43+
(https://fedoraproject.org/wiki/Changes/droppingOfCertPemFile)
and the missing file prevents unbound service from starting.
The configuration should rather set
tls-system-cert: yes
in order to rely on the systemwide trust store.
The upgrade is also handled by this change.
Fixes: https://pagure.io/freeipa/issue/9838
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>