The PKIConnection class uses python-requests for HTTPS. The library picks up several settings from environment variables, e.g. HTTP proxy server, certificate bundle with trust anchors and authentication. A proxy can interfere with the Dogtag installer and cause some operations to fail. With session.trust_env = False python-requests no longer inspects the environment and Dogtag has full controll over its connection settings. https://requests.readthedocs.org/en/latest/api/?highlight=trust_env#reque... https://fedorahosted.org/pki/ticket/1733 https://fedorahosted.org/freeipa/ticket/5555

On Tue, Jan 19, 2016 at 11:26:12AM +0100, Christian Heimes wrote: > On 2016-01-14 13:34, Christian Heimes wrote: >> The PKIConnection class uses python-requests for HTTPS. The library >> picks up several settings from environment variables, e.g. HTTP proxy >> server, certificate bundle with trust anchors and authentication. A >> proxy can interfere with the Dogtag installer and cause some operations >> to fail. >> >> With session.trust_env = False python-requests no longer inspects the >> environment and Dogtag has full controll over its connection settings. >> >> https://requests.readthedocs.org/en/latest/api/?highlight=trust_env#reque... >> >> https://fedorahosted.org/pki/ticket/1733 >> https://fedorahosted.org/freeipa/ticket/5555 > > Endi suggested to keep the default and only disable trust_env in the > installer. Here is an updated patch. > > Christian ACK on updated patch