FWIW I've authored a set of Python utilities to work with pem files for OpenStack. They work just fine with PEM blocks embedded with non-PEM text. I was thinking the utilities would also be useful in FreeIPA (in fact my experience in IPA is what guided the development of these utilities. I'll try to get them up in a git repo shortly and send a pointer.

Our x509.strip_header should handle them as well. I'm worried about Dogtag.

This needs more investigation though.

Not sure whether it needs to be cloned. Marking "todo" first.

Moving stabilization tickets that do not affect FreeIPA 4.0 release usability in any significant way to 4.0.1 stabilization milestone.

FreeIPA 4.0.1 was released, moving to next bugfixing release milestone.

master:

• 93346b1 Normalize external CA cert before passing it to pkispawn

ipa-4-1:

• 451c2e2 Normalize external CA cert before passing it to pkispawn

ipa-4-0:

• b50528a Normalize external CA cert before passing it to pkispawn

The change itself is in the end rather future proofing in our code, I did not see a clear reproducer - so no clone.