On 11/28/17 4:48 PM, Rob Crittenden wrote:
Did you run ipa-certupdate after ipa-cacert-manage per the man page?
I am not 100% sure, but I tried now. See below. There are some "CA
certificate not found" errors.
This is CentOS 7.4. There is no ipa-certupdate on the Wheezy clients.
Regards
Harri
--
[root@ipabak ~]# kinit admin
Password for admin(a)EXAMPLE.DE:
[root@ipabak ~]# ipa-certupdate -v
ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: Not logging to a file
ipa: DEBUG: Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: failed to find session_cookie in
persistent storage for principal 'admin(a)EXAMPLE.DE'
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: trying
https://ipabak.ac.example.de/ipa/json
ipa: DEBUG: NSSConnection init ipabak.ac.example.de
ipa: DEBUG: Connecting: 172.19.96.214:0
ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server
ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE"
ipa: DEBUG: handshake complete, peer = 172.19.96.214:443
ipa: DEBUG: Protocol: TLS1.2
ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
ipa: DEBUG: received Set-Cookie 'ipa_session=de2be6f6c1e6f43c0f4d613b29d1c4db;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:03 GMT; Secure;
HttpOnly'
ipa: DEBUG: storing cookie 'ipa_session=de2be6f6c1e6f43c0f4d613b29d1c4db;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:03 GMT; Secure;
HttpOnly' for principal admin(a)EXAMPLE.DE
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl padd user ipa_session_cookie:admin@EXAMPLE.DE @s
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=504268914
ipa: DEBUG: stderr=
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Created connection
context.rpcclient_37581136
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: Forwarding 'schema' to json
server 'https://ipabak.ac.example.de/ipa/json'
ipa: DEBUG: NSSConnection init ipabak.ac.example.de
ipa: DEBUG: Connecting: 172.19.96.214:0
ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server
ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE"
ipa: DEBUG: handshake complete, peer = 172.19.96.214:443
ipa: DEBUG: Protocol: TLS1.2
ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
ipa: DEBUG: received Set-Cookie 'ipa_session=c2bfa1f59b5cd7fa366a6db4737637c5;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:03 GMT; Secure;
HttpOnly'
ipa: DEBUG: storing cookie 'ipa_session=c2bfa1f59b5cd7fa366a6db4737637c5;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:03 GMT; Secure;
HttpOnly' for principal admin(a)EXAMPLE.DE
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=504268914
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=504268914
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl pupdate 504268914
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Destroyed connection
context.rpcclient_37581136
ipa: DEBUG: importing all plugin modules in ipaclient.remote_plugins.schema$ed0ad850...
ipa: DEBUG: importing plugin module ipaclient.remote_plugins.schema$ed0ad850.plugins
ipa: DEBUG: importing all plugin modules in ipaclient.plugins...
ipa: DEBUG: importing plugin module ipaclient.plugins.automember
ipa: DEBUG: importing plugin module ipaclient.plugins.automount
ipa: DEBUG: importing plugin module ipaclient.plugins.cert
ipa: DEBUG: importing plugin module ipaclient.plugins.certprofile
ipa: DEBUG: importing plugin module ipaclient.plugins.dns
ipa: DEBUG: importing plugin module ipaclient.plugins.hbacrule
ipa: DEBUG: importing plugin module ipaclient.plugins.hbactest
ipa: DEBUG: importing plugin module ipaclient.plugins.host
ipa: DEBUG: importing plugin module ipaclient.plugins.idrange
ipa: DEBUG: importing plugin module ipaclient.plugins.internal
ipa: DEBUG: importing plugin module ipaclient.plugins.location
ipa: DEBUG: importing plugin module ipaclient.plugins.migration
ipa: DEBUG: importing plugin module ipaclient.plugins.misc
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey
ipa: DEBUG: importing plugin module ipaclient.plugins.passwd
ipa: DEBUG: importing plugin module ipaclient.plugins.permission
ipa: DEBUG: importing plugin module ipaclient.plugins.rpcclient
ipa: DEBUG: importing plugin module ipaclient.plugins.server
ipa: DEBUG: importing plugin module ipaclient.plugins.service
ipa: DEBUG: importing plugin module ipaclient.plugins.sudorule
ipa: DEBUG: importing plugin module ipaclient.plugins.topology
ipa: DEBUG: importing plugin module ipaclient.plugins.trust
ipa: DEBUG: importing plugin module ipaclient.plugins.user
ipa: DEBUG: importing plugin module ipaclient.plugins.vault
ipa: DEBUG: Initializing principal host/ipabak.ac.example.de(a)EXAMPLE.DE using keytab
/etc/krb5.keytab
ipa: DEBUG: using ccache /tmp/tmp-ztRZmV/ccache
ipa: DEBUG: Attempt 1/1: success
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: failed to find session_cookie in
persistent storage for principal 'host/ipabak.ac.example.de(a)EXAMPLE.DE'
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: trying
https://ipabak.ac.example.de/ipa/json
ipa: DEBUG: NSSConnection init ipabak.ac.example.de
ipa: DEBUG: Connecting: 172.19.96.214:0
ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server
ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE"
ipa: DEBUG: handshake complete, peer = 172.19.96.214:443
ipa: DEBUG: Protocol: TLS1.2
ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
ipa: DEBUG: received Set-Cookie 'ipa_session=68842b001da98e7c8840596d52ad551a;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:10 GMT; Secure;
HttpOnly'
ipa: DEBUG: storing cookie 'ipa_session=68842b001da98e7c8840596d52ad551a;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:10 GMT; Secure;
HttpOnly' for principal host/ipabak.ac.example.de(a)EXAMPLE.DE
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl padd user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE
@s
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr=
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Created connection
context.rpcclient_81599440
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: Forwarding 'ca_is_enabled' to
json server 'https://ipabak.ac.example.de/ipa/json'
ipa: DEBUG: NSSConnection init ipabak.ac.example.de
ipa: DEBUG: Connecting: 172.19.96.214:0
ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server
ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE"
ipa: DEBUG: handshake complete, peer = 172.19.96.214:443
ipa: DEBUG: Protocol: TLS1.2
ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
ipa: DEBUG: received Set-Cookie 'ipa_session=94f9d668772ac36b68ce717d80bb87b0;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:10 GMT; Secure;
HttpOnly'
ipa: DEBUG: storing cookie 'ipa_session=94f9d668772ac36b68ce717d80bb87b0;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:10 GMT; Secure;
HttpOnly' for principal host/ipabak.ac.example.de(a)EXAMPLE.DE
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl pupdate 573622049
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa.ipapython.ipaldap.SchemaCache: DEBUG: flushing ldap://ipabak.ac.example.de:389 from
SchemaCache
ipa.ipapython.ipaldap.SchemaCache: DEBUG: retrieving schema for SchemaCache
url=ldap://ipabak.ac.example.de:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at
0x59dafc8>
ipa.ipaclient.remote_plugins.schema.ca_find: DEBUG: raw: ca_find(None,
version=u'2.213')
ipa.ipaclient.remote_plugins.schema.ca_find: DEBUG: ca_find(None,
version=u'2.213')
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: Forwarding 'ca_find/1' to json
server 'https://ipabak.ac.example.de/ipa/json'
ipa: DEBUG: NSSConnection init ipabak.ac.example.de
ipa: DEBUG: Connecting: 172.19.96.214:0
ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server
ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE"
ipa: DEBUG: handshake complete, peer = 172.19.96.214:443
ipa: DEBUG: Protocol: TLS1.2
ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
ipa: DEBUG: received Set-Cookie 'ipa_session=47d1e62786fa01dc83a49170c91f3837;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:11 GMT; Secure;
HttpOnly'
ipa: DEBUG: storing cookie 'ipa_session=47d1e62786fa01dc83a49170c91f3837;
Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:11 GMT; Secure;
HttpOnly' for principal host/ipabak.ac.example.de(a)EXAMPLE.DE
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user
ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl pupdate 573622049
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Destroyed connection
context.rpcclient_81599440
ipa: DEBUG: Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-EXAMPLE-DE -A -n CN=example Root
CA,OU=example Certificate Authority,O=example AG,C=DE -t CT,C,C
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-EXAMPLE-DE -A -n EXAMPLE.DE IPA CA
-t CT,C,C
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-EXAMPLE-DE -A -n
CN=root-CA,OU=example Certificate Authority,O=example AG,C=DE -t ,,
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active dirsrv(a)EXAMPLE-DE.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl --system daemon-reload
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl restart dirsrv(a)EXAMPLE-DE.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active dirsrv(a)EXAMPLE-DE.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa: DEBUG: wait_for_open_ports: localhost [389] timeout 300
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/httpd/alias -A -n CN=example Root CA,OU=example
Certificate Authority,O=example AG,C=DE -t CT,C,C
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/httpd/alias -A -n EXAMPLE.DE IPA CA -t CT,C,C
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/httpd/alias -A -n CN=root-CA,OU=example
Certificate Authority,O=example AG,C=DE -t ,,
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active httpd.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl restart httpd.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active httpd.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: resubmitting certmonger request
'20170318151943'
ipa: DEBUG: certmonger request is in state dbus.String(u'GENERATING_CSR',
variant_level=1)
ipa: DEBUG: certmonger request is in state dbus.String(u'PRE_SAVE_CERT',
variant_level=1)
ipa: DEBUG: certmonger request is in state dbus.String(u'POST_SAVED_CERT',
variant_level=1)
ipa: DEBUG: certmonger request is in state dbus.String(u'POST_SAVED_CERT',
variant_level=1)
ipa: DEBUG: certmonger request is in state dbus.String(u'POST_SAVED_CERT',
variant_level=1)
ipa: DEBUG: certmonger request is in state dbus.String(u'MONITORING',
variant_level=1)
ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: modifying certmonger request
'20170318151943'
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n IPA CA -a
ipa: DEBUG: Process finished, return code=255
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=certutil: Could not find cert: IPA CA
: PR_FILE_NOT_FOUND_ERROR: File not found
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n External CA cert -a
ipa: DEBUG: Process finished, return code=255
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=certutil: Could not find cert: External CA cert
: PR_FILE_NOT_FOUND_ERROR: File not found
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n CN=example Root CA,OU=example
Certificate Authority,O=example AG,C=DE -t CT,C,C
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n EXAMPLE.DE IPA CA -t CT,C,C
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n CN=root-CA,OU=example
Certificate Authority,O=example AG,C=DE -t ,,
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/update-ca-trust
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: INFO: Systemwide CA database updated.
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/update-ca-trust
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: INFO: Systemwide CA database updated.
ipa.ipaclient.ipa_certupdate.CertUpdate: INFO: The ipa-certupdate command was successful