From sbarkov at cea.ru Tue Jan 28 12:37:16 2020 Content-Type: multipart/mixed; boundary="===============5445515990514023426==" MIME-Version: 1.0 From: Serge Barkov To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] pki-tomcat doesn't start, it can't update certificate Date: Tue, 28 Jan 2020 12:35:29 +0000 Message-ID: <20200128123529.9740.74440@mailman01.phx2.fedoraproject.org> --===============5445515990514023426== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I have a freeipa with two nodes. I have no problem with one of them but on = the other one pki-tomcat can't start. ipacts starts with --ignore-service-failure and pki-tomcatd Service: STOPPED The first thing I found a certificate expired and I changed date back in ti= me before expiration date. ipa-cacert-manage renew says ok but certificate = for pki-tomcat doesn't work. getcert list shows all certificates are well but this one no: Request ID '20171110140549': status: CA_UNREACHABLE ca-error: Error 60 connecting to https://ipa0.domain.com:8443/ca/ag= ent/ca/profileReview: Peer certificate cannot be authenticated with given C= A certificates. stuck: no key pair storage: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alia= s',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS Certificate DB',pin set certificate: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias',ni= ckname=3D'Server-Cert cert-pki-ca',token=3D'NSS Certificate DB' CA: dogtag-ipa-renew-agent issuer: CN=3DCertificate Authority,O=3DDOMAIN.COM subject: CN=3Dipa0.domain.com,O=3DDOMAIN.COM expires: 2019-10-31 14:05:23 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEnci= pherment eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Serve= r-Cert cert-pki-ca" track: yes auto-renew: yes [root(a)ipa0 pki-tomcat]# curl https://ipa0.domain.com:8443/ca/agent/ca/pro= fileReview Apache Tomcat/8.0.46 - Error report</titl= e><style type=3D"text/css">H1 {font-family:Tahoma,Arial,sans-serif;color:wh= ite;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,= sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-f= amily:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-siz= e:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-c= olor:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-= color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;col= or:black;font-size:12px;}A {color : black;}A.name {color : black;}.line {he= ight: 1px; background-color: #525D76; border: none;}</style> </head><body><= h1>HTTP Status 404 - /ca/agent/ca/profileReview</h1><div class=3D"line"></d= iv><p><b>type</b> Status report</p><p><b>message</b> <u>/ca/agent/ca/profil= eReview</u></p><p><b>description</b> <u>The requested resource is not avail= able.</u></p><hr class=3D"lin e"><h3>Apache Tomcat/8.0.46</h3></bod What can I do to make pki-tomcat work? How to repair the certificate? --===============5445515990514023426==--