Install freeipa-client
by Vivek Aggarwal
Team,
I'm installing "freeipa-client" agent on the Ubuntu machine but while
installing , UI screen pops up which requires to provide Realm details,
kindly suggest is there a way to install freeipaclient in an unattended
mode .
I ran this command >> *apt-get install **freeipa-client -y*
regards
Vicky
4 years, 10 months
rbac issue met trust users
by Natxo Asenjo
hi,
I have successfully establised a one way cross realm trust between AD and
IDM realms.
I can get info from AD users in the IDM hosts, and I created an external
group and added it to a posix group as indicated in the documentation of
the Windows integration guide.
So when I run this command I get users from AD resolved from the linux
joined to IDM:
$ getent group posixgroupname
posixgroupname:*:1111111111111:user1@ad.local,user2@ad.local,user3@ad.local
,user4(a)ad.local
And I can reolve the AD users as well:
$ getent passwd user1(a)ad.local
user1@ad.local:*:333333333:33333333:User Name:/home/ad.local/user1:
So it seems like it's working. Now I added a rbac rule to allow the members
of that external group to login using ssh to a couple of hosts:
$ ipa hbacrule-show "bastion ssh hosts"
Rule name: bastion ssh hosts
Enabled: TRUE
User Groups: posixgroupname
Host Groups: bastionssh
Services: sshd
But when I try to log on it does not work
$ ssh user1@ad.local(a)bastion1.sub.domain.tld
Password:
Password:
Password:
Jun 28 10:42:06 bastion1 [sssd[krb5_child[20000]]]: Cannot find KDC for
realm "AD.LOCAL"
Jun 28 10:42:06 bastion1 [sssd[krb5_child[20001]]]: Cannot find KDC for
realm "AD.LOCAL"
I am checking the firewall logs but cannot see any denied packets coming
from this host.
I can successfully find the kds using a dns query:
$ dig -t srv _kerberos._udp.ad.local +short
0 100 88 dc01.ad.local.
0 100 88 dc02.ad.local.
So I am a bit at a loss right now what is going wrong.
Is it only supposed to work if you have a working ticket from AD.LOCAL or
can you try to log on interactively? I do not have a connection to the
AD.LOCAL from my laptop or the bastion1 hosts but the kdcs with the trust
do.
How can I debug in sssd this, I tried in the sssd.conf in the bastion host
[domain/idm] section a debug = 9 but I could not spot the error in there.
Thanks in advance!
--
regards,
natxo
4 years, 10 months
Home install failed
by Boyd Ako
So, I'm trying to setup a home instance to play around with before I muck up work stuff. For some reason it looks like it's failing on the install due to some upgrade or something....
# ipa-server-install -r NEVERLAND.DDNS.ME -n neverland.ddns.me --mkhomedir --hostname=unimatrix01.neverland.ddns.me --ssh-trust-dns --setup-kra --enable-compat
.... Truncated log....
2019-06-26T09:11:59Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
2019-06-26T09:11:59Z DEBUG duration: 0 seconds
2019-06-26T09:11:59Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
return cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run
return self.execute()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute
for rval in self._executor():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure
next(executor)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 583, in main
master_install(self)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 250, in decorated
func(installer)
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py", line 862, in install
ds.apply_updates()
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 723, in apply_updates
raise RuntimeError("Update failed: %s" % e)
2019-06-26T09:11:59Z DEBUG The ipa-server-install command failed, exception: RuntimeError: Update failed: no such entry
2019-06-26T09:11:59Z ERROR Update failed: no such entry
2019-06-26T09:11:59Z ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
4 years, 10 months
ipa commands - expanding the tool set
by lejeczek
hi guys
hi @devel, I'm hoping you guys will stumble upon this here, which is a
question from me - I was thinking it would be great to have among ipa
commands a set of arguments/options which would give out when executed
either true or false, which to us admins/users would/could be of a great
help.
For example:
ipa is-renewal-master
ipa is-dns
ipa is-ca
etc.
I think it would be great to have such little bits in the toolkit.
Anybody else?
p.s. can't do no plugins (expressionless)
many thanks, L.
4 years, 10 months
Removing half-present Replica
by Christian Reiss
Hey folks,
In my Test-Setup I have the following:
srv1.auth.alpha-labs.net
srv2.auth.alpha-labs.net
srv3.auth.alpha-labs.net
srv1 is the freshly installed master.
srv2 is a client, promoted to replication via ipa-replica-install.
srv3 failed with ipa-replica-install. Now I can't proceed past:
-- 8< -- -- 8< -- -- 8< -- -- 8< -- -- 8< -- -- 8< -- -- 8< --
[root@srv3 ~]# ipa-replica-install
ipaserver.install.installutils: ERROR Unable to resolve the IP
address 10.1.2.10 to a host name, check /etc/hosts and DNS name resolution
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR A replication agreement for this host
already exists. It needs to be removed.
Run this command:
%% ipa-replica-manage del srv3.auth.alpha-labs.net --force
ipapython.admintool: ERROR The ipa-replica-install command failed.
See /var/log/ipareplica-install.log for more information
-- 8< -- -- 8< -- -- 8< -- -- 8< -- -- 8< -- -- 8< -- -- 8< --
I tried (on srv1):
- ipa-replica-manage del srv3.auth.alpha-labs.net --cleanup --force
- ipa-replica-manage disconnect srv3.auth.alpha-labs.net
- ipa-replica-manage del srv3.auth.alpha-labs.net --force -v --no-lookup
- ipa-replica-manage clean-dangling-ruv
- ipa-replica-manage del --force srv3.auth.alpha-labs.net
As this is just a test setup I can easily drop everything and start
over, but I really wonder how to fix that once we go live with a real setup.
Thanks in advance!
Enjoy your weekend!
-Chris.
--
Christian Reiss - email(a)christian-reiss.de /"\ ASCII Ribbon
support(a)alpha-labs.net \ / Campaign
X against HTML
WEB alpha-labs.net / \ in eMails
GPG Retrieval https://gpg.christian-reiss.de
GPG ID ABCD43C5, 0x44E29126ABCD43C5
GPG fingerprint = 9549 F537 2596 86BA 733C A4ED 44E2 9126 ABCD 43C5
"It's better to reign in hell than to serve in heaven.",
John Milton, Paradise lost.
4 years, 10 months
Re: Cert expired for pki-tomcat and process would not start
by Rob Crittenden
Sayfiddin, Farhad wrote:
> Issue is fixed finally.
Great!
>
> Here are the steps I followed so it is helpful for others:
> 1. If you see Trust flag issue you should see similar error like (NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER), you would need to reset the trust flags following this:
> https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-auth...
>
> I had this issue one of my servers
>
> 2. But just resetting the flag would not fix the cert issue and go back time would not fix it either; You would need to manually re-enable the CA subsystem
>
> ipactl stop
> stop ntp or chronyd and set the time before cert has expired
>
> manually re-enable the CA subsystem
>
> pki-server subsystem-enable ca
> ipactl start --ignore-service-failure (tomcat will still fail, that is a reason, used the ignore option)
Did pki-server subsystem-find show it as disabled? I don't know what
would cause that if so.
> 3. Stay in old date for now and follow these to renew the cert
>
> ipactl stop
> systemctl start dirsrv@<instance_name>
> systemctl start pki-tomcatd(a)pki-tomcat.service
> getcert resubmit -i <Request ID>
> systemctl restart certmonger
>
> -----Original Message-----
> From: Rob Crittenden <rcritten(a)redhat.com>
> Sent: Monday, June 24, 2019 12:38 PM
> To: Sayfiddin, Farhad <fsayfiddin(a)tkcholdings.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Florence Blanc-Renaud <flo(a)redhat.com>
> Subject: Re: [Freeipa-users] Re: Cert expired for pki-tomcat and process would not start
>
> Sayfiddin, Farhad wrote:
>> This still remains an issue...any thoughts???
>
> certmonger should have them moved into the state NOTIFYING_VALIDITY and start the renewal.
>
> Create /etc/sysconfig/certmonger with the contents: OPTS=-d3
>
> Restart certmonger
>
> Go back in time
>
> Resubmit
>
> Check logs.
>
> rob
>
>>
>> ##############
>>
>> To: 'FreeIPA users list' <freeipa-users(a)lists.fedorahosted.org>;
>> Florence Blanc-Renaud <flo(a)redhat.com>; Rob Crittenden
>> <rcritten(a)redhat.com>
>> Subject: RE: [Freeipa-users] Re: Cert expired for pki-tomcat and
>> process would not start
>>
>> This is affecting 3 out of 4 our IPA servers. Would you recommend any other solution for this issue?
>>
>> We have only one CRL Master IPA server does not have this issue.
>> Would breaking the replication and recreating replica from one good CRL Master IPA server could work?
>>
>> -----Original Message-----
>> From: Sayfiddin, Farhad via FreeIPA-users
>> <freeipa-users(a)lists.fedorahosted.org>
>> Sent: Wednesday, June 19, 2019 2:51 PM
>> To: Florence Blanc-Renaud <flo(a)redhat.com>; FreeIPA users list
>> <freeipa-users(a)lists.fedorahosted.org>; Rob Crittenden
>> <rcritten(a)redhat.com>
>> Subject: [Freeipa-users] Re: Cert expired for pki-tomcat and process
>> would not start
>>
>> Thanks for your reply. In the journal I did not see anything meaningful when I ran "certmonger resubmit -i 20170214143200 "
>>
>> Jan 07 20:23:29 sl1mmgplidm0002.ipa.gen.zone kernel: FINAL_REJECT: IN=ens192 OUT= MAC=00:50:56:b2:39:92:00:1c:7f:61:a6:27:08:00 SRC=10.48.10.142 DST=172.20.0.36 LEN=89 TOS=0x00 PREC=0x00 TTL=126 ID=28772 PROTO=UDP SPT=52233 DPT=161 LEN=69 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: [07/Jan/2019:20:23:32.598658399 -0600] csngen_new_csn - Warning: too much time skew (-14058896 secs). Current seqnum=1 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 1 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 2 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 3 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: [07/Jan/2019:20:23:32.630614940 -0600] csngen_new_csn - Warning: too much time skew (-14058897 secs). Current seqnum=1 Jan 07 20:23:38 sl1mmgplidm0002.ipa.gen.zone kernel: FINAL_REJECT: IN=ens192 OUT= MAC=00:50:56:b2:39:92:00:1c:7f:61:a6:27:08:00 SRC=10.48.10.142 DST=172.20.0.36 LEN=89 TOS=0x00 PREC=0x00 TTL=126 ID=28773 PROTO=UDP SPT=59164 DPT=161 LEN=69 Jan 07 20:23:45 sl1mmgplidm0002.ipa.gen.zone certmonger[6749]: Certificate named "Server-Cert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will not be valid after 20190108201652.
>>
>> /var/log/pki/pki-tomcat/ca/debug did not generate anything when I ran "certmonger resubmit -i 20170214143200 "
>>
>> Any thoughts?
>>
>> -----Original Message-----
>> From: Florence Blanc-Renaud <flo(a)redhat.com>
>> Sent: Tuesday, June 18, 2019 11:20 AM
>> To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Rob
>> Crittenden <rcritten(a)redhat.com>
>> Subject: Re: [Freeipa-users] Re: Cert expired for pki-tomcat and
>> process would not start
>>
>>> Thanks for your response Rob, really appreciate it.
>>>
>>> I have stopped the IPA and went back in time of Jan 7 of 2019 since
>>> Server-Cert cert-pki-ca would expire on: 2019-01-08 20:16:52 UTC
>>>
>>> Started dirsrv, krb5kdc and pki-tomcatd(a)pki-tomcat.service manually.
>>>
>>> [root@sl1mmgplidm0002 ~]# date
>>> Mon Jan 7 20:23:50 CST 2019
>>> [root@sl1mmgplidm0002 ~]#
>>>
>>> [root@sl1mmgplidm0002 ~]# ipactl status Directory Service: RUNNING
>>> krb5kdc Service: RUNNING kadmin Service: STOPPED named Service:
>>> STOPPED ipa_memcached Service: STOPPED httpd Service: STOPPED
>>> ipa-custodia Service: STOPPED pki-tomcatd Service: STOPPED smb
>>> Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED
>>> ipa-dnskeysyncd Service: STOPPED
>>> ipa: INFO: The ipactl command was successful
>>> [root@sl1mmgplidm0002 ~]# systemctl status
>>> pki-tomcatd(a)pki-tomcat.service ● pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat
>>> Loaded: loaded (/usr/lib/systemd/system/pki-tomcatd@.service; enabled; vendor preset: disabled)
>>> Active: active (running) since Mon 2019-01-07 20:17:53 CST; 4min 59s ago
>>> Process: 58524 ExecStartPre=/usr/bin/pkidaemon start %i (code=exited, status=0/SUCCESS)
>>> Main PID: 58637 (java)
>>> CGroup: /system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service
>>> └─58637 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.library.path=/usr/lib64/nuxwdog-jni -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tom...
>>>
>>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO:
>>> Starting ProtocolHandler ["http-bio-8443"] Jan 07 20:17:57
>>> sl1mmgplidm0002.ipa.gen.zone server[58637]: Jan 07, 2019 8:17:57 PM
>>> org.apache.coyote.AbstractProtocol start Jan 07 20:17:57
>>> sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO: Starting
>>> ProtocolHandler ["ajp-bio-0:0:0:0:0:0:0:1-8009"] Jan 07 20:17:57
>>> sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener:
>>> org.apache.catalina.core.StandardServer[after_start]
>>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: Subsystem CA is disabled.
>>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: Check /var/log/pki/pki-tomcat/ca/selftests.log for possible errors.
>>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: To enable the subsystem:
>>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: pki-server subsystem-enable -i pki-tomcat ca
>>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: Jan 07,
>>> 2019 8:17:57 PM org.apache.catalina.startup.Catalina start Jan 07
>>> 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO: Server
>>> startup in 2477 ms
>>> [root@sl1mmgplidm0002 ~]#
>>>
>>> Ran " certmonger resubmit -i 20170214143200" but cert is still showing to expires on same date, it is not forcing for it to update.
>>>
>>> Status is changed to Monitoring now, but it is only because I went back in time.
>>>
>>> Request ID '20170214143200':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-renew-agent
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>> expires: 2019-01-08 20:16:52 UTC
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>>
>>> I have tried to restart certmonger with no luck. Please advise.
>>>
>> Hi,
>>
>> when you run certmonger resubmit, please have a look at the logs generated in the journal. When everything goes smoothly, you should be able to see the following steps in the journal (may be separated by other unrelated logs):
>> dogtag-ipa-ca-renew-agent-submit[20831]: Forwarding request to
>> dogtag-ipa-renew-agent
>> dogtag-ipa-ca-renew-agent-submit[20831]: dogtag-ipa-renew-agent returned 5 The above 2 lines may appear multiple times and show that the CA helper is using another helper. This other command is directly contacting PKI and authenticates with the RA cert (the 'ipaCert' stored in /etc/http/alias). It is calling the profileSubmit API, then the profileReview API.
>>
>> Then at around the same time in /var/log/pki/pki-tomcat/ca/debug, check if there is a line with "uri = /ca/ee/ca/profileSubmit" and another one with "uri = /ca/ee/ca/profileReview". This shows that the PKI server received a renewal request. The following lines may help diagnose any issue (for instance the authentication failed).
>>
>> flo
>>
>>> -----Original Message-----
>>> From: Rob Crittenden <rcritten(a)redhat.com>
>>> Sent: Monday, June 17, 2019 2:17 PM
>> FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
>>> Subject: Re: [Freeipa-users] Cert expired for pki-tomcat and process
>>> would not start
>>>
>>>> Here is the output of getcert list
>>>
>>> I think if you stop IPA, go back in time to when this server cert is
>>> valid (it is the TLS cert for the CA server) and manually start
>>> dirsrv, dogtag and krb5 then run certmonger resubmit -i
>>> 20170214143200
>>>
>>> You want to be sure ntpd (or chronyc) isn't running to force time back to now.
>>>
>>> rob
>>>
>>>>
>>>> [root@sl1mmgplidm0002 ~]# getcert list Number of certificates and
>>>> requests being tracked: 8.
>>>> Request ID '20170214143155':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> subject: CN=CA Audit,O=IPA.GEN.ZONE
>>>> expires: 2020-12-01 18:52:55 UTC
>>>> key usage: digitalSignature,nonRepudiation
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20170214143156':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> subject: CN=OCSP Subsystem,O=IPA.GEN.ZONE
>>>> expires: 2020-12-01 18:52:54 UTC
>>>> eku: id-kp-OCSPSigning
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20170214143157':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> subject: CN=CA Subsystem,O=IPA.GEN.ZONE
>>>> expires: 2020-12-01 18:53:15 UTC
>>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20170214143158':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> subject: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> expires: 2037-01-18 20:02:36 UTC
>>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20170214143159':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> subject: CN=IPA RA,O=IPA.GEN.ZONE
>>>> expires: 2020-12-01 18:52:44 UTC
>>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20170214143200':
>>>> status: CA_UNREACHABLE
>>>> ca-error: Error 60 connecting to https://sl1mmgplidm0002.ipa.gen.zone:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates.
>>>> stuck: no
>>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-renew-agent
>>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>>> expires: 2019-01-08 20:16:52 UTC
>>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20170214143201':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IPA-GEN-ZONE',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IPA-GEN-ZONE/pwdfile.txt'
>>>> certificate: type=NSSDB,location='/etc/dirsrv/slapd-IPA-GEN-ZONE',nickname='Server-Cert',token='NSS Certificate DB'
>>>> CA: IPA
>>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>>> expires: 2020-12-23 03:40:21 UTC
>>>> principal name: ldap/sl1mmgplidm0002.ipa.gen.zone(a)IPA.GEN.ZONE
>>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command:
>>>> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IPA-GEN-ZONE
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20170214143202':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
>>>> CA: IPA
>>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>>> expires: 2020-12-23 03:40:31 UTC
>>>> principal name: HTTP/sl1mmgplidm0002.ipa.gen.zone(a)IPA.GEN.ZONE
>>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command:
>>>> post-save command: /usr/libexec/ipa/certmonger/restart_httpd
>>>> track: yes
>>>> auto-renew: yes
>>>>
>>>> Already tried this solution with no luck:
>>>>
>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__rcritten.wordpr
>>>> e
>>>> s
>>>> s.com_2017_09_20_peer-2Dcertificate-2Dcannot-2Dbe-2Dauthenticated-2D
>>>> w
>>>> i
>>>> th-2Dgiven-2Dca-2Dcertificates_&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCr
>>>> p
>>>> S
>>>> yubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYn
>>>> O
>>>> q
>>>> UeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=hu2FmrcSxYTX9VEY0j-d7kejsKM
>>>> n
>>>> 3
>>>> 204Kkt_3BRIc80&e=
>>>>
>>>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -L
>>>>
>>>> Certificate Nickname Trust Attributes
>>>>
>>>> SSL,S/MIME,JAR/XPI
>>>>
>>>> Server-Cert u,u,u
>>>> ipaCert u,u,u
>>>> IPA.GEN.ZONE IPA CA CT,C,C
>>>>
>>>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -M -n 'IPA.GEN.ZONE IPA CA' -t ',,'
>>>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -M -n 'IPA.GEN.ZONE IPA CA' -t 'CT,C,C'
>>>>
>>>> Curl command still fails
>>>>
>>>> [root@sl1mmgplidm0002 ~]# SSL_DIR=/etc/httpd/alias/ curl -v -o /dev/null --cacert /etc/ipa/ca.crt https://urldefense.proofpoint.com/v2/url?u=https-3A__-2560hostname-2560-3...
>>>> % Total % Received % Xferd Average Speed Time Time Time Current
>>>> Dload Upload Total Spent Left Speed
>>>> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* About to connect() to sl1mmgplidm0002.ipa.gen.zone port 8443 (#0)
>>>> * Trying 172.20.0.36...
>>>> * Connected to sl1mmgplidm0002.ipa.gen.zone (172.20.0.36) port 8443
>>>> (#0)
>>>> * Initializing NSS with certpath: sql:/etc/httpd/alias/
>>>> * CAfile: /etc/ipa/ca.crt
>>>> CApath: none
>>>> * Server certificate:
>>>> * subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>>> * start date: Jan 18 20:16:52 2017 GMT
>>>> * expire date: Jan 08 20:16:52 2019 GMT
>>>> * common name: sl1mmgplidm0002.ipa.gen.zone
>>>> * issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>>> * NSS error -8181 (SEC_ERROR_EXPIRED_CERTIFICATE)
>>>> * Peer's Certificate has expired.
>>>> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
>>>> * Closing connection 0
>>>> curl: (60) Peer's Certificate has expired.
>>>> More details here:
>>>> https://urldefense.proofpoint.com/v2/url?u=http-3A__curl.haxx.se_doc
>>>> s
>>>> _
>>>> sslcerts.html&d=DwIDaQ&c=YQjZbjrpZrGDVqAPwjXLR6FCrpSyubErKtFCyGSfD8I
>>>> &
>>>> r
>>>> =d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=Z8zd7LpACPgATImRFhdrk
>>>> 5
>>>> 2
>>>> 3IIIKpfTP44sN22Z5k5k&s=PkVO7ngwiWZqwUzfzDqJ6HiWaal9XEglmhYc4u_gkps&e
>>>> =
>>>>
>>>> curl performs SSL certificate verification by default, using a "bundle"
>>>> of Certificate Authority (CA) public keys (CA certs). If the default
>>>> bundle file isn't adequate, you can specify an alternate file
>>>> using the --cacert option.
>>>> If this HTTPS server uses a certificate signed by a CA represented in
>>>> the bundle, the certificate verification probably failed due to a
>>>> problem with the certificate (it might be expired, or the name might
>>>> not match the domain name in the URL).
>>>> If you'd like to turn off curl's verification of the certificate, use
>>>> the -k (or --insecure) option.
>>>>
>>>>
>>>> -----Original Message-----
>>>> From: Rob Crittenden <rcritten(a)redhat.com>
>>>> Sent: Thursday, June 13, 2019 4:08 PM
>>>> To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
>>>> Cc: Sayfiddin, Farhad <fsayfiddin(a)tkcholdings.com>
>>>> Subject: Re: [Freeipa-users] Cert expired for pki-tomcat and process
>>>> would not start
>>>>
>>>>> We have two replica servers sl1mmgplidm0001/2.
>>>>>
>>>>>
>>>>>
>>>>> sl1mmgplidm0001 is functioning as CRL master and has no issues.
>>>>>
>>>>>
>>>>>
>>>>> [root@sl1mmgplidm0001 ~]# ipa config-show | grep 'CA renewal master'
>>>>>
>>>>> IPA CA renewal master: sl1mmgplidm0001
>>>>>
>>>>> [root@sl1mmgplidm0001 ~]#
>>>>>
>>>>>
>>>>>
>>>>> [root@sl1mmgplidm0001 ~]# ipactl status
>>>>>
>>>>> Directory Service: RUNNING
>>>>>
>>>>> krb5kdc Service: RUNNING
>>>>>
>>>>> kadmin Service: RUNNING
>>>>>
>>>>> named Service: RUNNING
>>>>>
>>>>> ipa_memcached Service: RUNNING
>>>>>
>>>>> httpd Service: RUNNING
>>>>>
>>>>> ipa-custodia Service: RUNNING
>>>>>
>>>>> pki-tomcatd Service: RUNNING
>>>>>
>>>>> smb Service: RUNNING
>>>>>
>>>>> winbind Service: RUNNING
>>>>>
>>>>> ipa-otpd Service: RUNNING
>>>>>
>>>>> ipa-dnskeysyncd Service: RUNNING
>>>>>
>>>>> ipa: INFO: The ipactl command was successful
>>>>>
>>>>> [root@sl1mmgplidm0001 ~]#
>>>>>
>>>>>
>>>>>
>>>>> sl1mmgplidm0002 is having an issue where pki-tomcat process would
>>>>> not start due to expired cert. It has CA_UNREACHABLE error
>>>>>
>>>>>
>>>>>
>>>>> [root@sl1mmgplidm0002 ~]# ipactl status
>>>>>
>>>>> Directory Service: RUNNING
>>>>>
>>>>> krb5kdc Service: RUNNING
>>>>>
>>>>> kadmin Service: RUNNING
>>>>>
>>>>> named Service: RUNNING
>>>>>
>>>>> ipa_memcached Service: RUNNING
>>>>>
>>>>> httpd Service: RUNNING
>>>>>
>>>>> ipa-custodia Service: RUNNING
>>>>>
>>>>> pki-tomcatd Service: STOPPED
>>>>>
>>>>> smb Service: RUNNING
>>>>>
>>>>> winbind Service: RUNNING
>>>>>
>>>>> ipa-otpd Service: RUNNING
>>>>>
>>>>> ipa-dnskeysyncd Service: RUNNING
>>>>>
>>>>> ipa: INFO: The ipactl command was successful
>>>>>
>>>>> [root@sl1mmgplidm0002 ~]#
>>>>>
>>>>>
>>>>>
>>>>> [root@sl1mmgplidm0002 ~]# getcert list | grep -A 10 20170214143200
>>>>> Request ID '20170214143200':
>>>>>
>>>>> status: CA_UNREACHABLE
>>>>>
>>>>> ca-error: Error 60 connecting to
>>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__sl1mmgplidm000
>>>>> 2
>>>>> -
>>>>> 3
>>>>> A8443_ca_agent_ca_profileReview&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCrpSyubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYnOqUeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=EvNOXdLcm_vL9kIJfZltxwLVIojayf1wau_ByrzA_m0&e= : Peer certificate cannot be authenticated with given CA certificates.
>>>>>
>>>>> stuck: no
>>>>>
>>>>> key pair storage:
>>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Ce
>>>>> r t cert-pki-ca',token='NSS Certificate DB',pin set
>>>>>
>>>>> certificate:
>>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Ce
>>>>> r t cert-pki-ca',token='NSS Certificate DB'
>>>>>
>>>>> CA: dogtag-ipa-renew-agent
>>>>>
>>>>> issuer: CN=Certificate Authority,O=IPA
>>>>>
>>>>> subject: CN=sl1mmgplidm0002,O=IPA
>>>>>
>>>>> expires: 2019-01-08 20:16:52 UTC
>>>>>
>>>>> key usage:
>>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>>>
>>>>> [root@sl1mmgplidm0002 ~]#
>>>>>
>>>>>
>>>>>
>>>>> Tried running renew_ca_cert command and "getcert resubmit -i" with no luck.
>>>>
>>>> Don't run ipa-cacert-manage renew. It renews only the root CA cert which won't help.
>>>>
>>>> We need to see the full output of getcert list to see what status all the certs are in.
>>>>
>>>> You might also try this:
>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__rcritten.wordpr
>>>> e
>>>> s
>>>> s.com_2017_09_20_peer-2Dcertificate-2Dcannot-2Dbe-2Dauthenticated-2D
>>>> w
>>>> i
>>>> th-2Dgiven-2Dca-2Dcertificates_&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCr
>>>> p
>>>> S
>>>> yubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYn
>>>> O
>>>> q
>>>> UeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=hu2FmrcSxYTX9VEY0j-d7kejsKM
>>>> n
>>>> 3
>>>> 204Kkt_3BRIc80&e=
>>>>
>>>> rob
>>>>
>>>
>>> _______________________________________________
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct:
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraprojec
>> t.org_en-2DUS_project_code-2Dof-2Dconduct_&d=DwIGaQ&c=YQjZbjrpZrGDVqAP
>> wjXLR6FCrpSyubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgTo
>> D30&m=8YIrh6IwFG4-pS8FUpIurSexWD6Z9ZRuoMvohqtQZP0&s=JclYW87y_nSfmFiayl
>> WyFHYlPsEhG_Rb6oklPda4qGI&e= List Guidelines:
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org
>> _wiki_Mailing-5Flist-5Fguidelines&d=DwIGaQ&c=YQjZbjrpZrGDVqAPwjXLR6FCr
>> pSyubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=8YI
>> rh6IwFG4-pS8FUpIurSexWD6Z9ZRuoMvohqtQZP0&s=HmuXeKbeTs2X_eiTQDiPpYXOv6R
>> WNc_jMvM9GxV6Piw&e= List Archives:
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahoste
>> d.org_archives_list_freeipa-2Dusers-40lists.fedorahosted.org&d=DwIGaQ&
>> c=YQjZbjrpZrGDVqAPwjXLR6FCrpSyubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSb
>> RETC6Fq1LvfisROgToD30&m=8YIrh6IwFG4-pS8FUpIurSexWD6Z9ZRuoMvohqtQZP0&s=
>> Ko7UnEhTLT0NKPdbTZKmo6dNt3UimXbvOQxAVZj2jBQ&e=
>>
>
4 years, 10 months
Re: Cert expired for pki-tomcat and process would not start
by Rob Crittenden
Sayfiddin, Farhad wrote:
> This still remains an issue...any thoughts???
certmonger should have them moved into the state NOTIFYING_VALIDITY and
start the renewal.
Create /etc/sysconfig/certmonger with the contents: OPTS=-d3
Restart certmonger
Go back in time
Resubmit
Check logs.
rob
>
> ##############
>
> To: 'FreeIPA users list' <freeipa-users(a)lists.fedorahosted.org>; Florence Blanc-Renaud <flo(a)redhat.com>; Rob Crittenden <rcritten(a)redhat.com>
> Subject: RE: [Freeipa-users] Re: Cert expired for pki-tomcat and process would not start
>
> This is affecting 3 out of 4 our IPA servers. Would you recommend any other solution for this issue?
>
> We have only one CRL Master IPA server does not have this issue.
> Would breaking the replication and recreating replica from one good CRL Master IPA server could work?
>
> -----Original Message-----
> From: Sayfiddin, Farhad via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
> Sent: Wednesday, June 19, 2019 2:51 PM
> To: Florence Blanc-Renaud <flo(a)redhat.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Rob Crittenden <rcritten(a)redhat.com>
> Subject: [Freeipa-users] Re: Cert expired for pki-tomcat and process would not start
>
> Thanks for your reply. In the journal I did not see anything meaningful when I ran "certmonger resubmit -i 20170214143200 "
>
> Jan 07 20:23:29 sl1mmgplidm0002.ipa.gen.zone kernel: FINAL_REJECT: IN=ens192 OUT= MAC=00:50:56:b2:39:92:00:1c:7f:61:a6:27:08:00 SRC=10.48.10.142 DST=172.20.0.36 LEN=89 TOS=0x00 PREC=0x00 TTL=126 ID=28772 PROTO=UDP SPT=52233 DPT=161 LEN=69 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: [07/Jan/2019:20:23:32.598658399 -0600] csngen_new_csn - Warning: too much time skew (-14058896 secs). Current seqnum=1 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 1 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 2 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 3 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: [07/Jan/2019:20:23:32.630614940 -0600] csngen_new_csn - Warning: too much time skew (-14058897 secs). Current seqnum=1 Jan 07 20:23:38 sl1mmgplidm0002.ipa.gen.zone kernel: FINAL_REJECT: IN=ens192 OUT= MAC=00:50:56:b2:39:92:00:1c:7f:61:a6:27:08:00 SRC=10.48.10.142 DST=172.20.0.36 LEN=89 TOS=0x00 PREC=0x00 TTL=126 ID=28773 PROTO=UDP SPT=59164 DPT=161 LEN=69 Jan 07 20:23:45 sl1mmgplidm0002.ipa.gen.zone certmonger[6749]: Certificate named "Server-Cert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will not be valid after 20190108201652.
>
> /var/log/pki/pki-tomcat/ca/debug did not generate anything when I ran "certmonger resubmit -i 20170214143200 "
>
> Any thoughts?
>
> -----Original Message-----
> From: Florence Blanc-Renaud <flo(a)redhat.com>
> Sent: Tuesday, June 18, 2019 11:20 AM
> To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Rob Crittenden <rcritten(a)redhat.com>
> Subject: Re: [Freeipa-users] Re: Cert expired for pki-tomcat and process would not start
>
>> Thanks for your response Rob, really appreciate it.
>>
>> I have stopped the IPA and went back in time of Jan 7 of 2019 since
>> Server-Cert cert-pki-ca would expire on: 2019-01-08 20:16:52 UTC
>>
>> Started dirsrv, krb5kdc and pki-tomcatd(a)pki-tomcat.service manually.
>>
>> [root@sl1mmgplidm0002 ~]# date
>> Mon Jan 7 20:23:50 CST 2019
>> [root@sl1mmgplidm0002 ~]#
>>
>> [root@sl1mmgplidm0002 ~]# ipactl status Directory Service: RUNNING
>> krb5kdc Service: RUNNING kadmin Service: STOPPED named Service:
>> STOPPED ipa_memcached Service: STOPPED httpd Service: STOPPED
>> ipa-custodia Service: STOPPED pki-tomcatd Service: STOPPED smb
>> Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED
>> ipa-dnskeysyncd Service: STOPPED
>> ipa: INFO: The ipactl command was successful
>> [root@sl1mmgplidm0002 ~]# systemctl status
>> pki-tomcatd(a)pki-tomcat.service ● pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat
>> Loaded: loaded (/usr/lib/systemd/system/pki-tomcatd@.service; enabled; vendor preset: disabled)
>> Active: active (running) since Mon 2019-01-07 20:17:53 CST; 4min 59s ago
>> Process: 58524 ExecStartPre=/usr/bin/pkidaemon start %i (code=exited, status=0/SUCCESS)
>> Main PID: 58637 (java)
>> CGroup: /system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service
>> └─58637 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.library.path=/usr/lib64/nuxwdog-jni -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tom...
>>
>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO:
>> Starting ProtocolHandler ["http-bio-8443"] Jan 07 20:17:57
>> sl1mmgplidm0002.ipa.gen.zone server[58637]: Jan 07, 2019 8:17:57 PM
>> org.apache.coyote.AbstractProtocol start Jan 07 20:17:57
>> sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO: Starting
>> ProtocolHandler ["ajp-bio-0:0:0:0:0:0:0:1-8009"] Jan 07 20:17:57
>> sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener:
>> org.apache.catalina.core.StandardServer[after_start]
>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: Subsystem CA is disabled.
>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: Check /var/log/pki/pki-tomcat/ca/selftests.log for possible errors.
>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: To enable the subsystem:
>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: pki-server subsystem-enable -i pki-tomcat ca
>> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: Jan 07,
>> 2019 8:17:57 PM org.apache.catalina.startup.Catalina start Jan 07
>> 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO: Server
>> startup in 2477 ms
>> [root@sl1mmgplidm0002 ~]#
>>
>> Ran " certmonger resubmit -i 20170214143200" but cert is still showing to expires on same date, it is not forcing for it to update.
>>
>> Status is changed to Monitoring now, but it is only because I went back in time.
>>
>> Request ID '20170214143200':
>> status: MONITORING
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
>> CA: dogtag-ipa-renew-agent
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>> expires: 2019-01-08 20:16:52 UTC
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection
>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
>> track: yes
>> auto-renew: yes
>>
>> I have tried to restart certmonger with no luck. Please advise.
>>
> Hi,
>
> when you run certmonger resubmit, please have a look at the logs generated in the journal. When everything goes smoothly, you should be able to see the following steps in the journal (may be separated by other unrelated logs):
> dogtag-ipa-ca-renew-agent-submit[20831]: Forwarding request to dogtag-ipa-renew-agent
> dogtag-ipa-ca-renew-agent-submit[20831]: dogtag-ipa-renew-agent returned 5 The above 2 lines may appear multiple times and show that the CA helper is using another helper. This other command is directly contacting PKI and authenticates with the RA cert (the 'ipaCert' stored in /etc/http/alias). It is calling the profileSubmit API, then the profileReview API.
>
> Then at around the same time in /var/log/pki/pki-tomcat/ca/debug, check if there is a line with "uri = /ca/ee/ca/profileSubmit" and another one with "uri = /ca/ee/ca/profileReview". This shows that the PKI server received a renewal request. The following lines may help diagnose any issue (for instance the authentication failed).
>
> flo
>
>> -----Original Message-----
>> From: Rob Crittenden <rcritten(a)redhat.com>
>> Sent: Monday, June 17, 2019 2:17 PM
> FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
>> Subject: Re: [Freeipa-users] Cert expired for pki-tomcat and process
>> would not start
>>
>>> Here is the output of getcert list
>>
>> I think if you stop IPA, go back in time to when this server cert is
>> valid (it is the TLS cert for the CA server) and manually start
>> dirsrv, dogtag and krb5 then run certmonger resubmit -i 20170214143200
>>
>> You want to be sure ntpd (or chronyc) isn't running to force time back to now.
>>
>> rob
>>
>>>
>>> [root@sl1mmgplidm0002 ~]# getcert list Number of certificates and
>>> requests being tracked: 8.
>>> Request ID '20170214143155':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=CA Audit,O=IPA.GEN.ZONE
>>> expires: 2020-12-01 18:52:55 UTC
>>> key usage: digitalSignature,nonRepudiation
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20170214143156':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=OCSP Subsystem,O=IPA.GEN.ZONE
>>> expires: 2020-12-01 18:52:54 UTC
>>> eku: id-kp-OCSPSigning
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20170214143157':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=CA Subsystem,O=IPA.GEN.ZONE
>>> expires: 2020-12-01 18:53:15 UTC
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20170214143158':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> expires: 2037-01-18 20:02:36 UTC
>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20170214143159':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=IPA RA,O=IPA.GEN.ZONE
>>> expires: 2020-12-01 18:52:44 UTC
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20170214143200':
>>> status: CA_UNREACHABLE
>>> ca-error: Error 60 connecting to https://sl1mmgplidm0002.ipa.gen.zone:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates.
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-renew-agent
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>> expires: 2019-01-08 20:16:52 UTC
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20170214143201':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IPA-GEN-ZONE',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IPA-GEN-ZONE/pwdfile.txt'
>>> certificate: type=NSSDB,location='/etc/dirsrv/slapd-IPA-GEN-ZONE',nickname='Server-Cert',token='NSS Certificate DB'
>>> CA: IPA
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>> expires: 2020-12-23 03:40:21 UTC
>>> principal name: ldap/sl1mmgplidm0002.ipa.gen.zone(a)IPA.GEN.ZONE
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command:
>>> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IPA-GEN-ZONE
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20170214143202':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
>>> CA: IPA
>>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>> expires: 2020-12-23 03:40:31 UTC
>>> principal name: HTTP/sl1mmgplidm0002.ipa.gen.zone(a)IPA.GEN.ZONE
>>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command:
>>> post-save command: /usr/libexec/ipa/certmonger/restart_httpd
>>> track: yes
>>> auto-renew: yes
>>>
>>> Already tried this solution with no luck:
>>>
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__rcritten.wordpre
>>> s
>>> s.com_2017_09_20_peer-2Dcertificate-2Dcannot-2Dbe-2Dauthenticated-2Dw
>>> i
>>> th-2Dgiven-2Dca-2Dcertificates_&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCrp
>>> S
>>> yubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYnO
>>> q
>>> UeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=hu2FmrcSxYTX9VEY0j-d7kejsKMn
>>> 3
>>> 204Kkt_3BRIc80&e=
>>>
>>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -L
>>>
>>> Certificate Nickname Trust Attributes
>>>
>>> SSL,S/MIME,JAR/XPI
>>>
>>> Server-Cert u,u,u
>>> ipaCert u,u,u
>>> IPA.GEN.ZONE IPA CA CT,C,C
>>>
>>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -M -n 'IPA.GEN.ZONE IPA CA' -t ',,'
>>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -M -n 'IPA.GEN.ZONE IPA CA' -t 'CT,C,C'
>>>
>>> Curl command still fails
>>>
>>> [root@sl1mmgplidm0002 ~]# SSL_DIR=/etc/httpd/alias/ curl -v -o /dev/null --cacert /etc/ipa/ca.crt https://urldefense.proofpoint.com/v2/url?u=https-3A__-2560hostname-2560-3...
>>> % Total % Received % Xferd Average Speed Time Time Time Current
>>> Dload Upload Total Spent Left Speed
>>> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* About to connect() to sl1mmgplidm0002.ipa.gen.zone port 8443 (#0)
>>> * Trying 172.20.0.36...
>>> * Connected to sl1mmgplidm0002.ipa.gen.zone (172.20.0.36) port 8443
>>> (#0)
>>> * Initializing NSS with certpath: sql:/etc/httpd/alias/
>>> * CAfile: /etc/ipa/ca.crt
>>> CApath: none
>>> * Server certificate:
>>> * subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>>> * start date: Jan 18 20:16:52 2017 GMT
>>> * expire date: Jan 08 20:16:52 2019 GMT
>>> * common name: sl1mmgplidm0002.ipa.gen.zone
>>> * issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>>> * NSS error -8181 (SEC_ERROR_EXPIRED_CERTIFICATE)
>>> * Peer's Certificate has expired.
>>> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
>>> * Closing connection 0
>>> curl: (60) Peer's Certificate has expired.
>>> More details here:
>>> https://urldefense.proofpoint.com/v2/url?u=http-3A__curl.haxx.se_docs
>>> _
>>> sslcerts.html&d=DwIDaQ&c=YQjZbjrpZrGDVqAPwjXLR6FCrpSyubErKtFCyGSfD8I&
>>> r
>>> =d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=Z8zd7LpACPgATImRFhdrk5
>>> 2
>>> 3IIIKpfTP44sN22Z5k5k&s=PkVO7ngwiWZqwUzfzDqJ6HiWaal9XEglmhYc4u_gkps&e=
>>>
>>> curl performs SSL certificate verification by default, using a "bundle"
>>> of Certificate Authority (CA) public keys (CA certs). If the default
>>> bundle file isn't adequate, you can specify an alternate file
>>> using the --cacert option.
>>> If this HTTPS server uses a certificate signed by a CA represented in
>>> the bundle, the certificate verification probably failed due to a
>>> problem with the certificate (it might be expired, or the name might
>>> not match the domain name in the URL).
>>> If you'd like to turn off curl's verification of the certificate, use
>>> the -k (or --insecure) option.
>>>
>>>
>>> -----Original Message-----
>>> From: Rob Crittenden <rcritten(a)redhat.com>
>>> Sent: Thursday, June 13, 2019 4:08 PM
>>> To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
>>> Cc: Sayfiddin, Farhad <fsayfiddin(a)tkcholdings.com>
>>> Subject: Re: [Freeipa-users] Cert expired for pki-tomcat and process
>>> would not start
>>>
>>>> We have two replica servers sl1mmgplidm0001/2.
>>>>
>>>>
>>>>
>>>> sl1mmgplidm0001 is functioning as CRL master and has no issues.
>>>>
>>>>
>>>>
>>>> [root@sl1mmgplidm0001 ~]# ipa config-show | grep 'CA renewal master'
>>>>
>>>> IPA CA renewal master: sl1mmgplidm0001
>>>>
>>>> [root@sl1mmgplidm0001 ~]#
>>>>
>>>>
>>>>
>>>> [root@sl1mmgplidm0001 ~]# ipactl status
>>>>
>>>> Directory Service: RUNNING
>>>>
>>>> krb5kdc Service: RUNNING
>>>>
>>>> kadmin Service: RUNNING
>>>>
>>>> named Service: RUNNING
>>>>
>>>> ipa_memcached Service: RUNNING
>>>>
>>>> httpd Service: RUNNING
>>>>
>>>> ipa-custodia Service: RUNNING
>>>>
>>>> pki-tomcatd Service: RUNNING
>>>>
>>>> smb Service: RUNNING
>>>>
>>>> winbind Service: RUNNING
>>>>
>>>> ipa-otpd Service: RUNNING
>>>>
>>>> ipa-dnskeysyncd Service: RUNNING
>>>>
>>>> ipa: INFO: The ipactl command was successful
>>>>
>>>> [root@sl1mmgplidm0001 ~]#
>>>>
>>>>
>>>>
>>>> sl1mmgplidm0002 is having an issue where pki-tomcat process would
>>>> not start due to expired cert. It has CA_UNREACHABLE error
>>>>
>>>>
>>>>
>>>> [root@sl1mmgplidm0002 ~]# ipactl status
>>>>
>>>> Directory Service: RUNNING
>>>>
>>>> krb5kdc Service: RUNNING
>>>>
>>>> kadmin Service: RUNNING
>>>>
>>>> named Service: RUNNING
>>>>
>>>> ipa_memcached Service: RUNNING
>>>>
>>>> httpd Service: RUNNING
>>>>
>>>> ipa-custodia Service: RUNNING
>>>>
>>>> pki-tomcatd Service: STOPPED
>>>>
>>>> smb Service: RUNNING
>>>>
>>>> winbind Service: RUNNING
>>>>
>>>> ipa-otpd Service: RUNNING
>>>>
>>>> ipa-dnskeysyncd Service: RUNNING
>>>>
>>>> ipa: INFO: The ipactl command was successful
>>>>
>>>> [root@sl1mmgplidm0002 ~]#
>>>>
>>>>
>>>>
>>>> [root@sl1mmgplidm0002 ~]# getcert list | grep -A 10 20170214143200
>>>> Request ID '20170214143200':
>>>>
>>>> status: CA_UNREACHABLE
>>>>
>>>> ca-error: Error 60 connecting to
>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__sl1mmgplidm0002
>>>> -
>>>> 3
>>>> A8443_ca_agent_ca_profileReview&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCrpSyubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYnOqUeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=EvNOXdLcm_vL9kIJfZltxwLVIojayf1wau_ByrzA_m0&e= : Peer certificate cannot be authenticated with given CA certificates.
>>>>
>>>> stuck: no
>>>>
>>>> key pair storage:
>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cer
>>>> t cert-pki-ca',token='NSS Certificate DB',pin set
>>>>
>>>> certificate:
>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cer
>>>> t cert-pki-ca',token='NSS Certificate DB'
>>>>
>>>> CA: dogtag-ipa-renew-agent
>>>>
>>>> issuer: CN=Certificate Authority,O=IPA
>>>>
>>>> subject: CN=sl1mmgplidm0002,O=IPA
>>>>
>>>> expires: 2019-01-08 20:16:52 UTC
>>>>
>>>> key usage:
>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>>
>>>> [root@sl1mmgplidm0002 ~]#
>>>>
>>>>
>>>>
>>>> Tried running renew_ca_cert command and "getcert resubmit -i" with no luck.
>>>
>>> Don't run ipa-cacert-manage renew. It renews only the root CA cert which won't help.
>>>
>>> We need to see the full output of getcert list to see what status all the certs are in.
>>>
>>> You might also try this:
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__rcritten.wordpre
>>> s
>>> s.com_2017_09_20_peer-2Dcertificate-2Dcannot-2Dbe-2Dauthenticated-2Dw
>>> i
>>> th-2Dgiven-2Dca-2Dcertificates_&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCrp
>>> S
>>> yubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYnO
>>> q
>>> UeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=hu2FmrcSxYTX9VEY0j-d7kejsKMn
>>> 3
>>> 204Kkt_3BRIc80&e=
>>>
>>> rob
>>>
>>
>> _______________________________________________
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraproject.o...
> List Guidelines: https://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wi...
> List Archives: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.o...
>
4 years, 10 months
Re: Cert expired for pki-tomcat and process would not start
by Sayfiddin, Farhad
This still remains an issue...any thoughts???
##############
To: 'FreeIPA users list' <freeipa-users(a)lists.fedorahosted.org>; Florence Blanc-Renaud <flo(a)redhat.com>; Rob Crittenden <rcritten(a)redhat.com>
Subject: RE: [Freeipa-users] Re: Cert expired for pki-tomcat and process would not start
This is affecting 3 out of 4 our IPA servers. Would you recommend any other solution for this issue?
We have only one CRL Master IPA server does not have this issue.
Would breaking the replication and recreating replica from one good CRL Master IPA server could work?
-----Original Message-----
From: Sayfiddin, Farhad via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
Sent: Wednesday, June 19, 2019 2:51 PM
To: Florence Blanc-Renaud <flo(a)redhat.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Rob Crittenden <rcritten(a)redhat.com>
Subject: [Freeipa-users] Re: Cert expired for pki-tomcat and process would not start
Thanks for your reply. In the journal I did not see anything meaningful when I ran "certmonger resubmit -i 20170214143200 "
Jan 07 20:23:29 sl1mmgplidm0002.ipa.gen.zone kernel: FINAL_REJECT: IN=ens192 OUT= MAC=00:50:56:b2:39:92:00:1c:7f:61:a6:27:08:00 SRC=10.48.10.142 DST=172.20.0.36 LEN=89 TOS=0x00 PREC=0x00 TTL=126 ID=28772 PROTO=UDP SPT=52233 DPT=161 LEN=69 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: [07/Jan/2019:20:23:32.598658399 -0600] csngen_new_csn - Warning: too much time skew (-14058896 secs). Current seqnum=1 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 1 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 2 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: GSSAPI server step 3 Jan 07 20:23:32 sl1mmgplidm0002.ipa.gen.zone ns-slapd[6208]: [07/Jan/2019:20:23:32.630614940 -0600] csngen_new_csn - Warning: too much time skew (-14058897 secs). Current seqnum=1 Jan 07 20:23:38 sl1mmgplidm0002.ipa.gen.zone kernel: FINAL_REJECT: IN=ens192 OUT= MAC=00:50:56:b2:39:92:00:1c:7f:61:a6:27:08:00 SRC=10.48.10.142 DST=172.20.0.36 LEN=89 TOS=0x00 PREC=0x00 TTL=126 ID=28773 PROTO=UDP SPT=59164 DPT=161 LEN=69 Jan 07 20:23:45 sl1mmgplidm0002.ipa.gen.zone certmonger[6749]: Certificate named "Server-Cert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will not be valid after 20190108201652.
/var/log/pki/pki-tomcat/ca/debug did not generate anything when I ran "certmonger resubmit -i 20170214143200 "
Any thoughts?
-----Original Message-----
From: Florence Blanc-Renaud <flo(a)redhat.com>
Sent: Tuesday, June 18, 2019 11:20 AM
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Rob Crittenden <rcritten(a)redhat.com>
Subject: Re: [Freeipa-users] Re: Cert expired for pki-tomcat and process would not start
> Thanks for your response Rob, really appreciate it.
>
> I have stopped the IPA and went back in time of Jan 7 of 2019 since
> Server-Cert cert-pki-ca would expire on: 2019-01-08 20:16:52 UTC
>
> Started dirsrv, krb5kdc and pki-tomcatd(a)pki-tomcat.service manually.
>
> [root@sl1mmgplidm0002 ~]# date
> Mon Jan 7 20:23:50 CST 2019
> [root@sl1mmgplidm0002 ~]#
>
> [root@sl1mmgplidm0002 ~]# ipactl status Directory Service: RUNNING
> krb5kdc Service: RUNNING kadmin Service: STOPPED named Service:
> STOPPED ipa_memcached Service: STOPPED httpd Service: STOPPED
> ipa-custodia Service: STOPPED pki-tomcatd Service: STOPPED smb
> Service: STOPPED winbind Service: STOPPED ipa-otpd Service: STOPPED
> ipa-dnskeysyncd Service: STOPPED
> ipa: INFO: The ipactl command was successful
> [root@sl1mmgplidm0002 ~]# systemctl status
> pki-tomcatd(a)pki-tomcat.service ● pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat
> Loaded: loaded (/usr/lib/systemd/system/pki-tomcatd@.service; enabled; vendor preset: disabled)
> Active: active (running) since Mon 2019-01-07 20:17:53 CST; 4min 59s ago
> Process: 58524 ExecStartPre=/usr/bin/pkidaemon start %i (code=exited, status=0/SUCCESS)
> Main PID: 58637 (java)
> CGroup: /system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service
> └─58637 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.library.path=/usr/lib64/nuxwdog-jni -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tom...
>
> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO:
> Starting ProtocolHandler ["http-bio-8443"] Jan 07 20:17:57
> sl1mmgplidm0002.ipa.gen.zone server[58637]: Jan 07, 2019 8:17:57 PM
> org.apache.coyote.AbstractProtocol start Jan 07 20:17:57
> sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO: Starting
> ProtocolHandler ["ajp-bio-0:0:0:0:0:0:0:1-8009"] Jan 07 20:17:57
> sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener:
> org.apache.catalina.core.StandardServer[after_start]
> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: Subsystem CA is disabled.
> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: Check /var/log/pki/pki-tomcat/ca/selftests.log for possible errors.
> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: To enable the subsystem:
> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: PKIListener: pki-server subsystem-enable -i pki-tomcat ca
> Jan 07 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: Jan 07,
> 2019 8:17:57 PM org.apache.catalina.startup.Catalina start Jan 07
> 20:17:57 sl1mmgplidm0002.ipa.gen.zone server[58637]: INFO: Server
> startup in 2477 ms
> [root@sl1mmgplidm0002 ~]#
>
> Ran " certmonger resubmit -i 20170214143200" but cert is still showing to expires on same date, it is not forcing for it to update.
>
> Status is changed to Monitoring now, but it is only because I went back in time.
>
> Request ID '20170214143200':
> status: MONITORING
> stuck: no
> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-renew-agent
> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
> expires: 2019-01-08 20:16:52 UTC
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
> track: yes
> auto-renew: yes
>
> I have tried to restart certmonger with no luck. Please advise.
>
Hi,
when you run certmonger resubmit, please have a look at the logs generated in the journal. When everything goes smoothly, you should be able to see the following steps in the journal (may be separated by other unrelated logs):
dogtag-ipa-ca-renew-agent-submit[20831]: Forwarding request to dogtag-ipa-renew-agent
dogtag-ipa-ca-renew-agent-submit[20831]: dogtag-ipa-renew-agent returned 5 The above 2 lines may appear multiple times and show that the CA helper is using another helper. This other command is directly contacting PKI and authenticates with the RA cert (the 'ipaCert' stored in /etc/http/alias). It is calling the profileSubmit API, then the profileReview API.
Then at around the same time in /var/log/pki/pki-tomcat/ca/debug, check if there is a line with "uri = /ca/ee/ca/profileSubmit" and another one with "uri = /ca/ee/ca/profileReview". This shows that the PKI server received a renewal request. The following lines may help diagnose any issue (for instance the authentication failed).
flo
> -----Original Message-----
> From: Rob Crittenden <rcritten(a)redhat.com>
> Sent: Monday, June 17, 2019 2:17 PM
FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
> Subject: Re: [Freeipa-users] Cert expired for pki-tomcat and process
> would not start
>
>> Here is the output of getcert list
>
> I think if you stop IPA, go back in time to when this server cert is
> valid (it is the TLS cert for the CA server) and manually start
> dirsrv, dogtag and krb5 then run certmonger resubmit -i 20170214143200
>
> You want to be sure ntpd (or chronyc) isn't running to force time back to now.
>
> rob
>
>>
>> [root@sl1mmgplidm0002 ~]# getcert list Number of certificates and
>> requests being tracked: 8.
>> Request ID '20170214143155':
>> status: MONITORING
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
>> CA: dogtag-ipa-ca-renew-agent
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=CA Audit,O=IPA.GEN.ZONE
>> expires: 2020-12-01 18:52:55 UTC
>> key usage: digitalSignature,nonRepudiation
>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
>> track: yes
>> auto-renew: yes
>> Request ID '20170214143156':
>> status: MONITORING
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
>> CA: dogtag-ipa-ca-renew-agent
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=OCSP Subsystem,O=IPA.GEN.ZONE
>> expires: 2020-12-01 18:52:54 UTC
>> eku: id-kp-OCSPSigning
>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
>> track: yes
>> auto-renew: yes
>> Request ID '20170214143157':
>> status: MONITORING
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
>> CA: dogtag-ipa-ca-renew-agent
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=CA Subsystem,O=IPA.GEN.ZONE
>> expires: 2020-12-01 18:53:15 UTC
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth
>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
>> track: yes
>> auto-renew: yes
>> Request ID '20170214143158':
>> status: MONITORING
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
>> CA: dogtag-ipa-ca-renew-agent
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=Certificate Authority,O=IPA.GEN.ZONE
>> expires: 2037-01-18 20:02:36 UTC
>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
>> track: yes
>> auto-renew: yes
>> Request ID '20170214143159':
>> status: MONITORING
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB'
>> CA: dogtag-ipa-ca-renew-agent
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=IPA RA,O=IPA.GEN.ZONE
>> expires: 2020-12-01 18:52:44 UTC
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth
>> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
>> track: yes
>> auto-renew: yes
>> Request ID '20170214143200':
>> status: CA_UNREACHABLE
>> ca-error: Error 60 connecting to https://sl1mmgplidm0002.ipa.gen.zone:8443/ca/agent/ca/profileReview: Peer certificate cannot be authenticated with given CA certificates.
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
>> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
>> CA: dogtag-ipa-renew-agent
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>> expires: 2019-01-08 20:16:52 UTC
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection
>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
>> track: yes
>> auto-renew: yes
>> Request ID '20170214143201':
>> status: MONITORING
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IPA-GEN-ZONE',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IPA-GEN-ZONE/pwdfile.txt'
>> certificate: type=NSSDB,location='/etc/dirsrv/slapd-IPA-GEN-ZONE',nickname='Server-Cert',token='NSS Certificate DB'
>> CA: IPA
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>> expires: 2020-12-23 03:40:21 UTC
>> principal name: ldap/sl1mmgplidm0002.ipa.gen.zone(a)IPA.GEN.ZONE
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth
>> pre-save command:
>> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IPA-GEN-ZONE
>> track: yes
>> auto-renew: yes
>> Request ID '20170214143202':
>> status: MONITORING
>> stuck: no
>> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
>> CA: IPA
>> issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>> expires: 2020-12-23 03:40:31 UTC
>> principal name: HTTP/sl1mmgplidm0002.ipa.gen.zone(a)IPA.GEN.ZONE
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth
>> pre-save command:
>> post-save command: /usr/libexec/ipa/certmonger/restart_httpd
>> track: yes
>> auto-renew: yes
>>
>> Already tried this solution with no luck:
>>
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__rcritten.wordpre
>> s
>> s.com_2017_09_20_peer-2Dcertificate-2Dcannot-2Dbe-2Dauthenticated-2Dw
>> i
>> th-2Dgiven-2Dca-2Dcertificates_&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCrp
>> S
>> yubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYnO
>> q
>> UeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=hu2FmrcSxYTX9VEY0j-d7kejsKMn
>> 3
>> 204Kkt_3BRIc80&e=
>>
>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -L
>>
>> Certificate Nickname Trust Attributes
>>
>> SSL,S/MIME,JAR/XPI
>>
>> Server-Cert u,u,u
>> ipaCert u,u,u
>> IPA.GEN.ZONE IPA CA CT,C,C
>>
>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -M -n 'IPA.GEN.ZONE IPA CA' -t ',,'
>> [root@sl1mmgplidm0002 ~]# certutil -d /etc/httpd/alias -M -n 'IPA.GEN.ZONE IPA CA' -t 'CT,C,C'
>>
>> Curl command still fails
>>
>> [root@sl1mmgplidm0002 ~]# SSL_DIR=/etc/httpd/alias/ curl -v -o /dev/null --cacert /etc/ipa/ca.crt https://urldefense.proofpoint.com/v2/url?u=https-3A__-2560hostname-2560-3...
>> % Total % Received % Xferd Average Speed Time Time Time Current
>> Dload Upload Total Spent Left Speed
>> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* About to connect() to sl1mmgplidm0002.ipa.gen.zone port 8443 (#0)
>> * Trying 172.20.0.36...
>> * Connected to sl1mmgplidm0002.ipa.gen.zone (172.20.0.36) port 8443
>> (#0)
>> * Initializing NSS with certpath: sql:/etc/httpd/alias/
>> * CAfile: /etc/ipa/ca.crt
>> CApath: none
>> * Server certificate:
>> * subject: CN=sl1mmgplidm0002.ipa.gen.zone,O=IPA.GEN.ZONE
>> * start date: Jan 18 20:16:52 2017 GMT
>> * expire date: Jan 08 20:16:52 2019 GMT
>> * common name: sl1mmgplidm0002.ipa.gen.zone
>> * issuer: CN=Certificate Authority,O=IPA.GEN.ZONE
>> * NSS error -8181 (SEC_ERROR_EXPIRED_CERTIFICATE)
>> * Peer's Certificate has expired.
>> 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
>> * Closing connection 0
>> curl: (60) Peer's Certificate has expired.
>> More details here:
>> https://urldefense.proofpoint.com/v2/url?u=http-3A__curl.haxx.se_docs
>> _
>> sslcerts.html&d=DwIDaQ&c=YQjZbjrpZrGDVqAPwjXLR6FCrpSyubErKtFCyGSfD8I&
>> r
>> =d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=Z8zd7LpACPgATImRFhdrk5
>> 2
>> 3IIIKpfTP44sN22Z5k5k&s=PkVO7ngwiWZqwUzfzDqJ6HiWaal9XEglmhYc4u_gkps&e=
>>
>> curl performs SSL certificate verification by default, using a "bundle"
>> of Certificate Authority (CA) public keys (CA certs). If the default
>> bundle file isn't adequate, you can specify an alternate file
>> using the --cacert option.
>> If this HTTPS server uses a certificate signed by a CA represented in
>> the bundle, the certificate verification probably failed due to a
>> problem with the certificate (it might be expired, or the name might
>> not match the domain name in the URL).
>> If you'd like to turn off curl's verification of the certificate, use
>> the -k (or --insecure) option.
>>
>>
>> -----Original Message-----
>> From: Rob Crittenden <rcritten(a)redhat.com>
>> Sent: Thursday, June 13, 2019 4:08 PM
>> To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
>> Cc: Sayfiddin, Farhad <fsayfiddin(a)tkcholdings.com>
>> Subject: Re: [Freeipa-users] Cert expired for pki-tomcat and process
>> would not start
>>
>>> We have two replica servers sl1mmgplidm0001/2.
>>>
>>>
>>>
>>> sl1mmgplidm0001 is functioning as CRL master and has no issues.
>>>
>>>
>>>
>>> [root@sl1mmgplidm0001 ~]# ipa config-show | grep 'CA renewal master'
>>>
>>> IPA CA renewal master: sl1mmgplidm0001
>>>
>>> [root@sl1mmgplidm0001 ~]#
>>>
>>>
>>>
>>> [root@sl1mmgplidm0001 ~]# ipactl status
>>>
>>> Directory Service: RUNNING
>>>
>>> krb5kdc Service: RUNNING
>>>
>>> kadmin Service: RUNNING
>>>
>>> named Service: RUNNING
>>>
>>> ipa_memcached Service: RUNNING
>>>
>>> httpd Service: RUNNING
>>>
>>> ipa-custodia Service: RUNNING
>>>
>>> pki-tomcatd Service: RUNNING
>>>
>>> smb Service: RUNNING
>>>
>>> winbind Service: RUNNING
>>>
>>> ipa-otpd Service: RUNNING
>>>
>>> ipa-dnskeysyncd Service: RUNNING
>>>
>>> ipa: INFO: The ipactl command was successful
>>>
>>> [root@sl1mmgplidm0001 ~]#
>>>
>>>
>>>
>>> sl1mmgplidm0002 is having an issue where pki-tomcat process would
>>> not start due to expired cert. It has CA_UNREACHABLE error
>>>
>>>
>>>
>>> [root@sl1mmgplidm0002 ~]# ipactl status
>>>
>>> Directory Service: RUNNING
>>>
>>> krb5kdc Service: RUNNING
>>>
>>> kadmin Service: RUNNING
>>>
>>> named Service: RUNNING
>>>
>>> ipa_memcached Service: RUNNING
>>>
>>> httpd Service: RUNNING
>>>
>>> ipa-custodia Service: RUNNING
>>>
>>> pki-tomcatd Service: STOPPED
>>>
>>> smb Service: RUNNING
>>>
>>> winbind Service: RUNNING
>>>
>>> ipa-otpd Service: RUNNING
>>>
>>> ipa-dnskeysyncd Service: RUNNING
>>>
>>> ipa: INFO: The ipactl command was successful
>>>
>>> [root@sl1mmgplidm0002 ~]#
>>>
>>>
>>>
>>> [root@sl1mmgplidm0002 ~]# getcert list | grep -A 10 20170214143200
>>> Request ID '20170214143200':
>>>
>>> status: CA_UNREACHABLE
>>>
>>> ca-error: Error 60 connecting to
>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__sl1mmgplidm0002
>>> -
>>> 3
>>> A8443_ca_agent_ca_profileReview&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCrpSyubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYnOqUeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=EvNOXdLcm_vL9kIJfZltxwLVIojayf1wau_ByrzA_m0&e= : Peer certificate cannot be authenticated with given CA certificates.
>>>
>>> stuck: no
>>>
>>> key pair storage:
>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cer
>>> t cert-pki-ca',token='NSS Certificate DB',pin set
>>>
>>> certificate:
>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cer
>>> t cert-pki-ca',token='NSS Certificate DB'
>>>
>>> CA: dogtag-ipa-renew-agent
>>>
>>> issuer: CN=Certificate Authority,O=IPA
>>>
>>> subject: CN=sl1mmgplidm0002,O=IPA
>>>
>>> expires: 2019-01-08 20:16:52 UTC
>>>
>>> key usage:
>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>
>>> [root@sl1mmgplidm0002 ~]#
>>>
>>>
>>>
>>> Tried running renew_ca_cert command and "getcert resubmit -i" with no luck.
>>
>> Don't run ipa-cacert-manage renew. It renews only the root CA cert which won't help.
>>
>> We need to see the full output of getcert list to see what status all the certs are in.
>>
>> You might also try this:
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__rcritten.wordpre
>> s
>> s.com_2017_09_20_peer-2Dcertificate-2Dcannot-2Dbe-2Dauthenticated-2Dw
>> i
>> th-2Dgiven-2Dca-2Dcertificates_&d=DwIDAw&c=YQjZbjrpZrGDVqAPwjXLR6FCrp
>> S
>> yubErKtFCyGSfD8I&r=d-TYcZJsaxSN2fvTay_nSbRETC6Fq1LvfisROgToD30&m=vYnO
>> q
>> UeSIamQw5SC2J9Rs9eMlJ1Jd7WemUOfBlK_wz4&s=hu2FmrcSxYTX9VEY0j-d7kejsKMn
>> 3
>> 204Kkt_3BRIc80&e=
>>
>> rob
>>
>
> _______________________________________________
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraproject.o...
List Guidelines: https://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wi...
List Archives: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.o...
4 years, 10 months
AD's users ssh to IPA's client - should it work?
by lejeczek
hi guys
I think it was asked on the list before but I still cannot find the thread.
Should AD's users be able to login to IPA's clients(non-replica) in a
pretty vanilla setup? Those users can login to IPA masters okey.
I have not created any HBACs yet, nor added new hostgroups etc.
When I ssh to IPA's client that client denies that user & shows:
pam_sss(sshd:auth): received for user user1@private: 6 (Permission denied)
...
many thanks, L.
4 years, 10 months
pki-tomcat generating ~280MB debug logs per day - best practices for managing disk usage?
by Jonathan Vaughn
Is it safe to nuke older log files? Some of our CA instances are on VMs
which were only allocated a reasonable amount of space for just running
FreeIPA, and this adds up fast. The ones on physical have space to spare
for some time yet, but some day it would be an issue for them too.
Is there a "best" way to control this? I know I can meddle with the
pki-tomcat config but I assume it's set to generate all this hilariously
verbose logging by default for a reason (or perhaps it's just an oversight
that FreeIPA doesn't set this to a sane production configuration?). Also, I
don't want to make a change then have it reverted by FreeIPA later...
4 years, 10 months