repost on freeipa-devel:
Hi folks,
its always worth reading the code.
ipa-client-install of freeipa 3.0.2 uses
wget http://ipa1.example.de/ipa/config/ca.crt
to grab the CA certificate. It seems that ipa-cacert-manage (CentOS 7.3) did not upgrade /usr/share/ipa/html/ca.crt on the servers when I migrated to the new root CA. Would anybody mind to fix?
Thanx very much Harri
On 11/16/17 9:28 AM, Harald Dunkel via FreeIPA-users wrote:
Hi folks,
a few months ago I had replaced the externally signed root certificate on my servers (CentOS 7.3) using ipa-cacert-manage. Problem:
ipa-client-install on a freshly bootstrapped Debian 7 (Wheezy, freeipa 3.0.2) fails. Apparently it stumbles over the old root certificate:
# ipa-client-install --domain=example.de --realm=EXAMPLE.DE --no-ssh --no-sshd --no-ntp Discovery was successful! Hostname: pobde7i001.vs.example.de Realm: EXAMPLE.DE DNS Domain: example.de IPA Server: ipa1.example.de BaseDN: dc=example,dc=de
Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin Synchronizing time with KDC... Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened. Password for admin@EXAMPLE.DE: Enrolled in IPA realm EXAMPLE.DE Created /etc/ipa/default.conf Domain example.de is already configured in existing SSSD config, creating a new one. The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm EXAMPLE.DE trying https://ipa1.example.de/ipa/xml cert validation failed for "CN=ipa1.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) trying https://ipa2.example.de/ipa/xml cert validation failed for "CN=ipa2.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) Cannot connect to the server due to generic error: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None): https://ipa1.example.de/ipa/xml, https://ipa2.example.de/ipa/xml Installation failed. Rolling back changes.
/etc/ipa/ca.crt on the client shows it somehow picked up the old certificate. On the servers /etc/ipa/ca.crt is the new root cert. "getcert list" on the servers shows only certificates based upon the new root ca, too. I wonder where ipa-client-install picked up the unwanted certificate?
Of course I tried putting the new ca.crt into place before running ipa-client-install, but it was overwritten.
Of course there is no such problem for ipa 4.4.4 on Stretch.
Every heplful hint is highly appreciated Harri _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Harald Dunkel via FreeIPA-devel wrote:
repost on freeipa-devel:
Hi folks,
its always worth reading the code.
ipa-client-install of freeipa 3.0.2 uses
wget http://ipa1.example.de/ipa/config/ca.crtto grab the CA certificate. It seems that ipa-cacert-manage (CentOS 7.3) did not upgrade /usr/share/ipa/html/ca.crt on the servers when I migrated to the new root CA. Would anybody mind to fix?
I opened https://pagure.io/freeipa/issue/7286 to track this.
rob
Thanx very much Harri
On 11/16/17 9:28 AM, Harald Dunkel via FreeIPA-users wrote:
Hi folks,
a few months ago I had replaced the externally signed root certificate on my servers (CentOS 7.3) using ipa-cacert-manage. Problem: ipa-client-install on a freshly bootstrapped Debian 7 (Wheezy, freeipa 3.0.2) fails. Apparently it stumbles over the old root certificate:
# ipa-client-install --domain=example.de --realm=EXAMPLE.DE --no-ssh --no-sshd --no-ntp Discovery was successful! Hostname: pobde7i001.vs.example.de Realm: EXAMPLE.DE DNS Domain: example.de IPA Server: ipa1.example.de BaseDN: dc=example,dc=de
Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin Synchronizing time with KDC... Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened. Password for admin@EXAMPLE.DE: Enrolled in IPA realm EXAMPLE.DE Created /etc/ipa/default.conf Domain example.de is already configured in existing SSSD config, creating a new one. The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm EXAMPLE.DE trying https://ipa1.example.de/ipa/xml cert validation failed for "CN=ipa1.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) trying https://ipa2.example.de/ipa/xml cert validation failed for "CN=ipa2.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) Cannot connect to the server due to generic error: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None): https://ipa1.example.de/ipa/xml, https://ipa2.example.de/ipa/xml Installation failed. Rolling back changes.
/etc/ipa/ca.crt on the client shows it somehow picked up the old certificate. On the servers /etc/ipa/ca.crt is the new root cert. "getcert list" on the servers shows only certificates based upon the new root ca, too. I wonder where ipa-client-install picked up the unwanted certificate?
Of course I tried putting the new ca.crt into place before running ipa-client-install, but it was overwritten.
Of course there is no such problem for ipa 4.4.4 on Stretch.
Every heplful hint is highly appreciated Harri _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-leave@lists.fedorahosted.org
Rob Crittenden via FreeIPA-devel wrote:
Harald Dunkel via FreeIPA-devel wrote:
repost on freeipa-devel:
Hi folks,
its always worth reading the code.
ipa-client-install of freeipa 3.0.2 uses
wget http://ipa1.example.de/ipa/config/ca.crtto grab the CA certificate. It seems that ipa-cacert-manage (CentOS 7.3) did not upgrade /usr/share/ipa/html/ca.crt on the servers when I migrated to the new root CA. Would anybody mind to fix?
I opened https://pagure.io/freeipa/issue/7286 to track this.
Did you run ipa-certupdate after ipa-cacert-manage per the man page?
rob
rob
Thanx very much Harri
On 11/16/17 9:28 AM, Harald Dunkel via FreeIPA-users wrote:
Hi folks,
a few months ago I had replaced the externally signed root certificate on my servers (CentOS 7.3) using ipa-cacert-manage. Problem: ipa-client-install on a freshly bootstrapped Debian 7 (Wheezy, freeipa 3.0.2) fails. Apparently it stumbles over the old root certificate:
# ipa-client-install --domain=example.de --realm=EXAMPLE.DE --no-ssh --no-sshd --no-ntp Discovery was successful! Hostname: pobde7i001.vs.example.de Realm: EXAMPLE.DE DNS Domain: example.de IPA Server: ipa1.example.de BaseDN: dc=example,dc=de
Continue to configure the system with these values? [no]: yes User authorized to enroll computers: admin Synchronizing time with KDC... Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened. Password for admin@EXAMPLE.DE: Enrolled in IPA realm EXAMPLE.DE Created /etc/ipa/default.conf Domain example.de is already configured in existing SSSD config, creating a new one. The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm EXAMPLE.DE trying https://ipa1.example.de/ipa/xml cert validation failed for "CN=ipa1.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) trying https://ipa2.example.de/ipa/xml cert validation failed for "CN=ipa2.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) Cannot connect to the server due to generic error: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None): https://ipa1.example.de/ipa/xml, https://ipa2.example.de/ipa/xml Installation failed. Rolling back changes.
/etc/ipa/ca.crt on the client shows it somehow picked up the old certificate. On the servers /etc/ipa/ca.crt is the new root cert. "getcert list" on the servers shows only certificates based upon the new root ca, too. I wonder where ipa-client-install picked up the unwanted certificate?
Of course I tried putting the new ca.crt into place before running ipa-client-install, but it was overwritten.
Of course there is no such problem for ipa 4.4.4 on Stretch.
Every heplful hint is highly appreciated Harri _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-leave@lists.fedorahosted.org
FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-leave@lists.fedorahosted.org
On 11/28/17 4:48 PM, Rob Crittenden wrote:
Did you run ipa-certupdate after ipa-cacert-manage per the man page?
I am not 100% sure, but I tried now. See below. There are some "CA certificate not found" errors.
This is CentOS 7.4. There is no ipa-certupdate on the Wheezy clients.
Regards Harri -- [root@ipabak ~]# kinit admin Password for admin@EXAMPLE.DE: [root@ipabak ~]# ipa-certupdate -v ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: Not logging to a file ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE ipa: DEBUG: Process finished, return code=1 ipa: DEBUG: stdout= ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: failed to find session_cookie in persistent storage for principal 'admin@EXAMPLE.DE' ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: trying https://ipabak.ac.example.de/ipa/json ipa: DEBUG: NSSConnection init ipabak.ac.example.de ipa: DEBUG: Connecting: 172.19.96.214:0 ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE" ipa: DEBUG: handshake complete, peer = 172.19.96.214:443 ipa: DEBUG: Protocol: TLS1.2 ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ipa: DEBUG: received Set-Cookie 'ipa_session=de2be6f6c1e6f43c0f4d613b29d1c4db; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:03 GMT; Secure; HttpOnly' ipa: DEBUG: storing cookie 'ipa_session=de2be6f6c1e6f43c0f4d613b29d1c4db; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:03 GMT; Secure; HttpOnly' for principal admin@EXAMPLE.DE ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE ipa: DEBUG: Process finished, return code=1 ipa: DEBUG: stdout= ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE ipa: DEBUG: Process finished, return code=1 ipa: DEBUG: stdout= ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl padd user ipa_session_cookie:admin@EXAMPLE.DE @s ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=504268914
ipa: DEBUG: stderr= ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Created connection context.rpcclient_37581136 ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: Forwarding 'schema' to json server 'https://ipabak.ac.example.de/ipa/json' ipa: DEBUG: NSSConnection init ipabak.ac.example.de ipa: DEBUG: Connecting: 172.19.96.214:0 ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE" ipa: DEBUG: handshake complete, peer = 172.19.96.214:443 ipa: DEBUG: Protocol: TLS1.2 ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ipa: DEBUG: received Set-Cookie 'ipa_session=c2bfa1f59b5cd7fa366a6db4737637c5; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:03 GMT; Secure; HttpOnly' ipa: DEBUG: storing cookie 'ipa_session=c2bfa1f59b5cd7fa366a6db4737637c5; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:03 GMT; Secure; HttpOnly' for principal admin@EXAMPLE.DE ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=504268914
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@EXAMPLE.DE ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=504268914
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl pupdate 504268914 ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Destroyed connection context.rpcclient_37581136 ipa: DEBUG: importing all plugin modules in ipaclient.remote_plugins.schema$ed0ad850... ipa: DEBUG: importing plugin module ipaclient.remote_plugins.schema$ed0ad850.plugins ipa: DEBUG: importing all plugin modules in ipaclient.plugins... ipa: DEBUG: importing plugin module ipaclient.plugins.automember ipa: DEBUG: importing plugin module ipaclient.plugins.automount ipa: DEBUG: importing plugin module ipaclient.plugins.cert ipa: DEBUG: importing plugin module ipaclient.plugins.certprofile ipa: DEBUG: importing plugin module ipaclient.plugins.dns ipa: DEBUG: importing plugin module ipaclient.plugins.hbacrule ipa: DEBUG: importing plugin module ipaclient.plugins.hbactest ipa: DEBUG: importing plugin module ipaclient.plugins.host ipa: DEBUG: importing plugin module ipaclient.plugins.idrange ipa: DEBUG: importing plugin module ipaclient.plugins.internal ipa: DEBUG: importing plugin module ipaclient.plugins.location ipa: DEBUG: importing plugin module ipaclient.plugins.migration ipa: DEBUG: importing plugin module ipaclient.plugins.misc ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey ipa: DEBUG: importing plugin module ipaclient.plugins.passwd ipa: DEBUG: importing plugin module ipaclient.plugins.permission ipa: DEBUG: importing plugin module ipaclient.plugins.rpcclient ipa: DEBUG: importing plugin module ipaclient.plugins.server ipa: DEBUG: importing plugin module ipaclient.plugins.service ipa: DEBUG: importing plugin module ipaclient.plugins.sudorule ipa: DEBUG: importing plugin module ipaclient.plugins.topology ipa: DEBUG: importing plugin module ipaclient.plugins.trust ipa: DEBUG: importing plugin module ipaclient.plugins.user ipa: DEBUG: importing plugin module ipaclient.plugins.vault ipa: DEBUG: Initializing principal host/ipabak.ac.example.de@EXAMPLE.DE using keytab /etc/krb5.keytab ipa: DEBUG: using ccache /tmp/tmp-ztRZmV/ccache ipa: DEBUG: Attempt 1/1: success ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Process finished, return code=1 ipa: DEBUG: stdout= ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: failed to find session_cookie in persistent storage for principal 'host/ipabak.ac.example.de@EXAMPLE.DE' ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: trying https://ipabak.ac.example.de/ipa/json ipa: DEBUG: NSSConnection init ipabak.ac.example.de ipa: DEBUG: Connecting: 172.19.96.214:0 ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE" ipa: DEBUG: handshake complete, peer = 172.19.96.214:443 ipa: DEBUG: Protocol: TLS1.2 ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ipa: DEBUG: received Set-Cookie 'ipa_session=68842b001da98e7c8840596d52ad551a; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:10 GMT; Secure; HttpOnly' ipa: DEBUG: storing cookie 'ipa_session=68842b001da98e7c8840596d52ad551a; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:10 GMT; Secure; HttpOnly' for principal host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Process finished, return code=1 ipa: DEBUG: stdout= ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Process finished, return code=1 ipa: DEBUG: stdout= ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl padd user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE @s ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr= ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Created connection context.rpcclient_81599440 ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: Forwarding 'ca_is_enabled' to json server 'https://ipabak.ac.example.de/ipa/json' ipa: DEBUG: NSSConnection init ipabak.ac.example.de ipa: DEBUG: Connecting: 172.19.96.214:0 ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE" ipa: DEBUG: handshake complete, peer = 172.19.96.214:443 ipa: DEBUG: Protocol: TLS1.2 ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
ipa: DEBUG: received Set-Cookie 'ipa_session=94f9d668772ac36b68ce717d80bb87b0; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:10 GMT; Secure; HttpOnly' ipa: DEBUG: storing cookie 'ipa_session=94f9d668772ac36b68ce717d80bb87b0; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:10 GMT; Secure; HttpOnly' for principal host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl pupdate 573622049 ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa.ipapython.ipaldap.SchemaCache: DEBUG: flushing ldap://ipabak.ac.example.de:389 from SchemaCache ipa.ipapython.ipaldap.SchemaCache: DEBUG: retrieving schema for SchemaCache url=ldap://ipabak.ac.example.de:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x59dafc8> ipa.ipaclient.remote_plugins.schema.ca_find: DEBUG: raw: ca_find(None, version=u'2.213') ipa.ipaclient.remote_plugins.schema.ca_find: DEBUG: ca_find(None, version=u'2.213') ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: Forwarding 'ca_find/1' to json server 'https://ipabak.ac.example.de/ipa/json' ipa: DEBUG: NSSConnection init ipabak.ac.example.de ipa: DEBUG: Connecting: 172.19.96.214:0 ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server ipa: DEBUG: cert valid True for "CN=ipabak.ac.example.de,O=example AG,C=DE" ipa: DEBUG: handshake complete, peer = 172.19.96.214:443 ipa: DEBUG: Protocol: TLS1.2 ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ipa: DEBUG: received Set-Cookie 'ipa_session=47d1e62786fa01dc83a49170c91f3837; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:11 GMT; Secure; HttpOnly' ipa: DEBUG: storing cookie 'ipa_session=47d1e62786fa01dc83a49170c91f3837; Domain=ipabak.ac.example.de; Path=/ipa; Expires=Mon, 04 Dec 2017 09:16:11 GMT; Secure; HttpOnly' for principal host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:host/ipabak.ac.example.de@EXAMPLE.DE ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=573622049
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=keyctl pupdate 573622049 ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Destroyed connection context.rpcclient_81599440 ipa: DEBUG: Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-EXAMPLE-DE -A -n CN=example Root CA,OU=example Certificate Authority,O=example AG,C=DE -t CT,C,C ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-EXAMPLE-DE -A -n EXAMPLE.DE IPA CA -t CT,C,C ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-EXAMPLE-DE -A -n CN=root-CA,OU=example Certificate Authority,O=example AG,C=DE -t ,, ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/bin/systemctl is-active dirsrv@EXAMPLE-DE.service ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=active
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/bin/systemctl --system daemon-reload ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/bin/systemctl restart dirsrv@EXAMPLE-DE.service ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/bin/systemctl is-active dirsrv@EXAMPLE-DE.service ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=active
ipa: DEBUG: stderr= ipa: DEBUG: wait_for_open_ports: localhost [389] timeout 300 ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/httpd/alias -A -n CN=example Root CA,OU=example Certificate Authority,O=example AG,C=DE -t CT,C,C ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/httpd/alias -A -n EXAMPLE.DE IPA CA -t CT,C,C ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/httpd/alias -A -n CN=root-CA,OU=example Certificate Authority,O=example AG,C=DE -t ,, ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/bin/systemctl is-active httpd.service ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=active
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/bin/systemctl restart httpd.service ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/bin/systemctl is-active httpd.service ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout=active
ipa: DEBUG: stderr= ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: resubmitting certmonger request '20170318151943' ipa: DEBUG: certmonger request is in state dbus.String(u'GENERATING_CSR', variant_level=1) ipa: DEBUG: certmonger request is in state dbus.String(u'PRE_SAVE_CERT', variant_level=1) ipa: DEBUG: certmonger request is in state dbus.String(u'POST_SAVED_CERT', variant_level=1) ipa: DEBUG: certmonger request is in state dbus.String(u'POST_SAVED_CERT', variant_level=1) ipa: DEBUG: certmonger request is in state dbus.String(u'POST_SAVED_CERT', variant_level=1) ipa: DEBUG: certmonger request is in state dbus.String(u'MONITORING', variant_level=1) ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: modifying certmonger request '20170318151943' ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n IPA CA -a ipa: DEBUG: Process finished, return code=255 ipa: DEBUG: stdout= ipa: DEBUG: stderr=certutil: Could not find cert: IPA CA : PR_FILE_NOT_FOUND_ERROR: File not found
ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n External CA cert -a ipa: DEBUG: Process finished, return code=255 ipa: DEBUG: stdout= ipa: DEBUG: stderr=certutil: Could not find cert: External CA cert : PR_FILE_NOT_FOUND_ERROR: File not found
ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n CN=example Root CA,OU=example Certificate Authority,O=example AG,C=DE -t CT,C,C ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n EXAMPLE.DE IPA CA -t CT,C,C ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -A -n CN=root-CA,OU=example Certificate Authority,O=example AG,C=DE -t ,, ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/update-ca-trust ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: INFO: Systemwide CA database updated. ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/update-ca-trust ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= ipa: DEBUG: stderr= ipa: INFO: Systemwide CA database updated. ipa.ipaclient.ipa_certupdate.CertUpdate: INFO: The ipa-certupdate command was successful
On 12/4/17 10:14 AM, Harald Dunkel via FreeIPA-devel wrote:
On 11/28/17 4:48 PM, Rob Crittenden wrote:
Did you run ipa-certupdate after ipa-cacert-manage per the man page?
I am not 100% sure, but I tried now. See below. There are some "CA certificate not found" errors.
This is CentOS 7.4. There is no ipa-certupdate on the Wheezy clients.
OK, now its broken. "ipa host-del somehost" gives me
Certificate operation cannot be completed: Unable to communicate with CMS
Every helpful comment is highly appreciated Harri
freeipa-devel@lists.fedorahosted.org