Hello,
Am trying to enable SSL on my 389 lab instance but having real issues.
I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log:
[12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL.
When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work. Yet if I use certutil that all looks good:
[root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert
Version:
[root@lab389 slapd-lab389]# rpm -qa | grep 389 389-ds-base-1.3.3.1-23.el7_1.x86_64 389-admin-1.1.38-1.el7.x86_64 389-ds-base-libs-1.3.3.1-23.el7_1.x86_64 389-adminutil-1.1.21-2.el7.x86_64
Any ideas please ? Thanks. Phil
On 12/14/2015 10:23 AM, Phil Daws wrote:
Hello,
Am trying to enable SSL on my 389 lab instance but having real issues.
I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log:
[12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL.
When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work.
Are you sure the password is correct? Can the DS user read the pin file? Where did you put the pin file? What is the content of the pin file(excluding password)?
My pin file looks like:
Internal (Software) Token:<PASSWORD>
Yet if I use certutil that all looks good:
[root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert
Version:
[root@lab389 slapd-lab389]# rpm -qa | grep 389 389-ds-base-1.3.3.1-23.el7_1.x86_64 389-admin-1.1.38-1.el7.x86_64 389-ds-base-libs-1.3.3.1-23.el7_1.x86_64 389-adminutil-1.1.21-2.el7.x86_64
Any ideas please ? Thanks. Phil
-- 389 users mailing list 389-users@%(host_name)s http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org
----- On 14 Dec, 2015, at 15:38, Mark Reynolds mareynol@redhat.com wrote:
On 12/14/2015 10:23 AM, Phil Daws wrote:
Hello,
Am trying to enable SSL on my 389 lab instance but having real issues.
I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log:
[12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL.
When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work.
Are you sure the password is correct? Can the DS user read the pin file? Where did you put the pin file? What is the content of the pin file(excluding password)?
My pin file looks like:
Yep, I tried with a pin.txt file and still the same. What is more bizarre in that once I have imported the cert and CA chain, then enable SSL via the console, if I go back to Manage Certificates it throws an error that it cannot open file (null) ?!?
Internal (Software) Token:<PASSWORD>
Yet if I use certutil that all looks good:
[root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert
Version:
[root@lab389 slapd-lab389]# rpm -qa | grep 389 389-ds-base-1.3.3.1-23.el7_1.x86_64 389-admin-1.1.38-1.el7.x86_64 389-ds-base-libs-1.3.3.1-23.el7_1.x86_64 389-adminutil-1.1.21-2.el7.x86_64
Any ideas please ? Thanks. Phil
-- 389 users mailing list 389-users@%(host_name)s http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org
On 12/14/2015 10:55 AM, Phil Daws wrote:
----- On 14 Dec, 2015, at 15:38, Mark Reynolds mareynol@redhat.com wrote:
On 12/14/2015 10:23 AM, Phil Daws wrote:
Hello,
Am trying to enable SSL on my 389 lab instance but having real issues.
I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log:
[12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL.
When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work.
Are you sure the password is correct? Can the DS user read the pin file? Where did you put the pin file? What is the content of the pin file(excluding password)?
My pin file looks like:
Yep, I tried with a pin.txt file and still the same.
Where did you place the pin.txt file? What does your pin file look like? What are the permissions/ownership of pin.txt and DS user?
What is more bizarre in that once I have imported the cert and CA chain, then enable SSL via the console, if I go back to Manage Certificates it throws an error that it cannot open file (null) ?!?
Run the console using "-D 9" it might give more info
Internal (Software) Token:<PASSWORD>
Yet if I use certutil that all looks good:
[root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert
Version:
[root@lab389 slapd-lab389]# rpm -qa | grep 389 389-ds-base-1.3.3.1-23.el7_1.x86_64 389-admin-1.1.38-1.el7.x86_64 389-ds-base-libs-1.3.3.1-23.el7_1.x86_64 389-adminutil-1.1.21-2.el7.x86_64
Any ideas please ? Thanks. Phil
-- 389 users mailing list 389-users@%(host_name)s http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org
----- On 14 Dec, 2015, at 17:16, Mark Reynolds mareynol@redhat.com wrote:
On 12/14/2015 10:55 AM, Phil Daws wrote:
----- On 14 Dec, 2015, at 15:38, Mark Reynolds mareynol@redhat.com wrote:
On 12/14/2015 10:23 AM, Phil Daws wrote:
Hello,
Am trying to enable SSL on my 389 lab instance but having real issues.
I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log:
[12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL.
When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work.
Are you sure the password is correct? Can the DS user read the pin file? Where did you put the pin file? What is the content of the pin file(excluding password)?
My pin file looks like:
Yep, I tried with a pin.txt file and still the same.
Where did you place the pin.txt file? What does your pin file look like? What are the permissions/ownership of pin.txt and DS user?
Without a pin.txt should the system not prompt for the password ? though for reference I placed it under /etc/dirsrv/slapd-{instance}/pin.txt with 0640 perms.
What is more bizarre in that once I have imported the cert and CA chain, then enable SSL via the console, if I go back to Manage Certificates it throws an error that it cannot open file (null) ?!?
Run the console using "-D 9" it might give more info
Internal (Software) Token:<PASSWORD>
Yet if I use certutil that all looks good:
[root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert
Version:
[root@lab389 slapd-lab389]# rpm -qa | grep 389 389-ds-base-1.3.3.1-23.el7_1.x86_64 389-admin-1.1.38-1.el7.x86_64 389-ds-base-libs-1.3.3.1-23.el7_1.x86_64 389-adminutil-1.1.21-2.el7.x86_64
Any ideas please ? Thanks. Phil
-- 389 users mailing list 389-users@%(host_name)s http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org
On 12/14/2015 02:20 PM, Phil Daws wrote:
----- On 14 Dec, 2015, at 17:16, Mark Reynolds mareynol@redhat.com wrote:
On 12/14/2015 10:55 AM, Phil Daws wrote:
----- On 14 Dec, 2015, at 15:38, Mark Reynolds mareynol@redhat.com wrote:
On 12/14/2015 10:23 AM, Phil Daws wrote:
Hello,
Am trying to enable SSL on my 389 lab instance but having real issues.
I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log:
[12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL.
When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work.
Are you sure the password is correct? Can the DS user read the pin file? Where did you put the pin file? What is the content of the pin file(excluding password)?
My pin file looks like:
Yep, I tried with a pin.txt file and still the same.
Where did you place the pin.txt file? What does your pin file look like? What are the permissions/ownership of pin.txt and DS user?
Without a pin.txt should the system not prompt for the password ?
It should, depending on how you start it. Using the start-dirsrv script should prompt you.
though for reference I placed it under /etc/dirsrv/slapd-{instance}/pin.txt with 0640 perms.
Okay
What is more bizarre in that once I have imported the cert and CA chain, then enable SSL via the console, if I go back to Manage Certificates it throws an error that it cannot open file (null) ?!?
Run the console using "-D 9" it might give more info
Internal (Software) Token:<PASSWORD>
Yet if I use certutil that all looks good:
[root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert
Version:
[root@lab389 slapd-lab389]# rpm -qa | grep 389 389-ds-base-1.3.3.1-23.el7_1.x86_64 389-admin-1.1.38-1.el7.x86_64 389-ds-base-libs-1.3.3.1-23.el7_1.x86_64 389-adminutil-1.1.21-2.el7.x86_64
Any ideas please ? Thanks. Phil
-- 389 users mailing list 389-users@%(host_name)s http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org
-- 389 users mailing list 389-users@%(host_name)s http://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject.org
On Mon, 2015-12-14 at 15:23 +0000, Phil Daws wrote:
Hello,
Am trying to enable SSL on my 389 lab instance but having real issues.
I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log:
[12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL.
When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work. Yet if I use certutil that all looks good:
[root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert
Okay, lets go through my standard SSL checklist:
First, check cn=config: nsslapd-certdir Does the value match where you have put your certificates?
Now, check cn=config: nsslapd-security=on
Do a certutil -d /path -L. Write down the alias name of the cert. I call mine Server-Cert
Next, check cn=RSA,cn=encryption,cn=config. My template is:
dn: cn=RSA,cn=encryption,cn=config changetype: add objectclass: top objectclass: nsEncryptionModule nsSSLPersonalitySSL: Server-Cert #Should match your -L output nsSSLActivation: on nsSSLToken: internal (software) # Write this down!!! cn: RSA
Now, check your pin.txt. It should be in the folder listed in nsslapd-certdir, and the line should be title casing of the line nsSSLToken with the word " Token" after it. For example:
from dse.ldif nsSSLToken: internal (software)
pin.txt Internal (Software) Token:<pin>
Finally, make sure the <pin> can be used to look at the certs:
certutil -d /path -K
In my experience I tend to see most mistakes are in cn=RSA, so it's well worth checking this to make sure it all looks correct. There are gaps in the documentation around the ssl section, so I hope this helps.
----- On 14 Dec, 2015, at 22:01, William Brown wibrown@redhat.com wrote:
On Mon, 2015-12-14 at 15:23 +0000, Phil Daws wrote:
Hello,
Am trying to enable SSL on my 389 lab instance but having real issues.
I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log:
[12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL.
When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work. Yet if I use certutil that all looks good:
[root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert
Okay, lets go through my standard SSL checklist:
First, check cn=config: nsslapd-certdir Does the value match where you have put your certificates?
Now, check cn=config: nsslapd-security=on
Do a certutil -d /path -L. Write down the alias name of the cert. I call mine Server-Cert
Next, check cn=RSA,cn=encryption,cn=config. My template is:
dn: cn=RSA,cn=encryption,cn=config changetype: add objectclass: top objectclass: nsEncryptionModule nsSSLPersonalitySSL: Server-Cert #Should match your -L output nsSSLActivation: on nsSSLToken: internal (software) # Write this down!!! cn: RSA
Now, check your pin.txt. It should be in the folder listed in nsslapd-certdir, and the line should be title casing of the line nsSSLToken with the word " Token" after it. For example:
from dse.ldif nsSSLToken: internal (software)
pin.txt Internal (Software) Token:<pin>
Finally, make sure the <pin> can be used to look at the certs:
certutil -d /path -K
In my experience I tend to see most mistakes are in cn=RSA, so it's well worth checking this to make sure it all looks correct. There are gaps in the documentation around the ssl section, so I hope this helps.
-- Sincerely,
William Brown Software Engineer Red Hat, Brisbane
Thank you William this appears to be working now :)
389-users@lists.fedoraproject.org