ipa-server-install reporting "missing basic constraints" for ipa cert while it has X509v3 Basic Constraints:CA:TRUE
by Amit
Hello,
This is process i followed:
# ipa-server-install --external-ca
/root/ipa.csr.
# openssl req -text -noout -verify -in /root/ipa.csr
verify OK
Certificate Request:
Data:
Version: 0 (0x0)
Subject: O=GSSLAB.PNQ2.REDHAT.COM, CN=Certificate Authority
Subject Public Key Info:......
Attributes:
Requested Extensions:
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Key Usage: critical
Digital Signature, Non Repudiation, Certificate Sign,
CRL Sign
//root CA
# openssl x509 -noout -text -in MyRootCA.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
89:aa:02:78:65:ae:47:fa
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IN, O=RH, OU=IDM, CN=CN=rootCA
Validity
Not Before: Feb 15 08:35:15 2018 GMT
Not After : Dec 5 08:35:15 2020 GMT
Subject: C=IN, O=RH, OU=IDM, CN=CN=rootCA
X509v3 extensions:
X509v3 Basic Constraints:
CA:TRUE
*//Intermidiate CA*
openssl x509 -noout -text -in intermidiateCA.crt
Certificate:
Data:
Version: 1 (0x0)
Serial Number:
dc:95:74:7a:9b:7e:b2:17
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IN, O=RH, OU=IDM, CN=CN=rootCA
Validity
Not Before: Feb 15 08:36:32 2018 GMT
Not After : Mar 17 08:36:32 2018 GMT
Subject: C=IN, O=RH, OU=IDM, CN=CN=interCA
*IPA Cert*
# openssl x509 -noout -text -in user.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
8e:35:5a:00:e9:82:af:2b
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IN, O=RH, OU=IDM, CN=CN=interCA
Validity
Not Before: Feb 15 08:37:36 2018 GMT
Not After : Mar 17 08:37:36 2018 GMT
Subject: O=GSSLAB.PNQ2.REDHAT.COM, CN=Certificate Authority
X509v3 extensions:
X509v3 Basic Constraints:
CA:TRUE
*C**reating CA Chain*:
cat rootCA.crt intermidiateCA.crt > ca-chain.pem
*And When I try install**ing ipa*:
# ipa-server-install
--external-cert-file=/root/ca-hierarchy/ca-chain.pem
--external-cert-file=/root/ca-hierarchy/user.pem
The log file for this installation can be found in
/var/log/ipaserver-install.log
Directory Manager password:
==============================================================================
This program will set up the IPA Server.
This includes:
* Configure a stand-alone CA (dogtag) for certificate management
* Configure the Network Time Daemon (ntpd)
* Create and configure an instance of Directory Server
* Create and configure a Kerberos Key Distribution Center (KDC)
* Configure Apache (httpd)
* Configure the KDC to enable PKINIT
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall):
ERROR CA certificate CN=CN\=rootCA,OU=IDM,O=RH,C=IN in
/root/ca-hierarchy/ca-chain.pem, /root/ca-hierarchy/user.pem is not
valid: missing basic constraints
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall):
ERROR The ipa-server-install command failed. See
/var/log/ipaserver-install.log for more information
6 years, 2 months