Kerberos on version 0.35

[netaengel]

Hi, we are experiencing some trouble while trying to use kerberos, we get the error: KDC_ERR_S_PRINCIPAL_UNKNOWN(server not found in kerberos database). we tried creating our own keytab and connecting to our CA with it - it was successful - however, we cannot find a way to make it work within the code itself, and we keep getting the same error.
Without kerberos, we manage to enroll certificates successfully.
Do you have an idea on how to make the kerberos work?

Additionally, we want to configure a defualt template, so that when the acme.sh command does not include the --useragent flag, the certificate will be enrolled by the template in the acme_srv.cfg. we see that if we remove the flag, the certificate is being enrolled by the last used template. is there a way to change it?

thanks in advance.

[grindsa]

Can you please describe your deplyoment mode (rpm, deb, container) and share your

• acme_srv.cfg
• krb5.conf
• log of the failed enrollment with debug: True flag in acme_srv.cfg

You can also share the files via email to [email protected]

Kerberos authentication works fine for both mscertsrv and mswcce hanlder during my regular regression, so I suspect a configuration issue combined with lack of proper error logging.

[netaengel]

We run the program on openshift,
acme_srv.cfg:
[DEFAULT]
debug: False

[Nonce]

disable nonce check. THIS IS A SEVERE SECURTIY ISSUE! Please do only for testing/debugging purposes

nonce_check_disable: False

[CAhandler]

CA specific options

...
template: (specific template)
use_kerberos: True

[DBhandler]
#dbfile: /var/lib/acme/db.sqlite3

[Certificate]
revocation_reason_check_disable: False

[Challenge]

when true disable challenge validation. Challenge will be set to 'valid' without further checking

THIS IS A SEVERE SECURTIY ISSUE! Please do only for testing/debugging purposes

challenge_validation_disable: False

[Order]
tnauthlist_support: False
header_info_list: ["HTTP_USER_AGENT"]

krb5.conf:
we changed the default realm to be our own, and added the kdc IP to the realms section in kdc and admin_server.

Trying to connect to endpoint: ncacn_np:IP
CCache file is not found. Skipping...
The specified path in not correct or the KRB5CCNAME environment variable is not defined
Trying to connect to KDC at IP:PORT
Server time (UTC): time (identical to pod time)
Failed ncacn_np:IP : Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in kerberos database)
Trying to resolve dynamic endpoint '

'
Resolved dynamic endpoint '' to ncacn_ip_tcp:IP
Trying to connect to endpoint: ncacn_ip_tcp:IP
....
Order.parse() returns: {... "Retry-After": 600, "status": processing, ...... "code": 200}
IP /acme/order/.../finalize {... "Retry-After": 600, "status": processing, ...... "code": 200}

About the templates, when we use the --useragent flag but we execute a command to enroll without the flag, we would like the certificate to be enrolled by the default option written in acme_srv.cfg. however the mswcce_ca_handler.py script gets the header_info and takes the last used template there. a command without the --useragent flag does not add a request to the header_info dictionary, so the template that is used eventually is the last enrolled certificate's template. we want the certificate without the --useragent flag to be enrolled using the template in acme_srv.cfg. Can you think of the right way to do that?

[grindsa]

Hi,

What means "running on Openshift"? Are you running one of the prepared containers or do you build your own container?

I see that you are using the mswcce_ca_handler handler.

do you have

target_domain: <domain name>
domain_controller: <ip address of domain controller>

parameters configured in your acme_srv.cfg?

The template issue is interesting. It should work as you expected. Can you please share a complete log from an enrollment attempt using the wrong template via email?

[grindsa]

I tried to replicate issue you reported in multiple environments without success. Nevertheless, it sounds serious, hence we should not ignore it. I extended the wcce_ca_handler.py by an option to log the enrollment parameters. When using it you would see something like this

Enrollment configuration: ['host: notademo.`foo.local', 'user: grindsa', 'template: WebServe', 'proxy: None', 'target_domain: notademo.foo.local', 'domain_controller: 192.168.14.131', 'ca_name: GrindsaCA', 'ca_bundle: /var/www/acme2certifier/volume/msca/msca.pem', 'use_kerberos: False', 'allowed_domainlist: []', 'header_info_field: HTTP_USER_AGENT', 'timeout: 20', 'eab_handler: None', 'eab_profiling: False', 'enrollment_config_log: True']

A new image is already avaialble at dockerhub

docker pull grindsa/acme2certifier:devel

Logging of the enrollment parameters must be enablabled in acme_srv.cfg

[CAhandler]
enrollment_config_log: True

Can you please try the replicate the issue by using this image and share logs?

Thx
/GrindSa