From luckydogxf at gmail.com Wed Jun 17 09:33:06 2020 Content-Type: multipart/mixed; boundary="===============7504265558138116645==" MIME-Version: 1.0 From: luckydog xf To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] pki-tomcat fails to start after I update CA for dirsrv and httpd. Date: Wed, 17 Jun 2020 09:32:56 +0000 Message-ID: <20200617093256.13400.8899@mailman01.iad2.fedoraproject.org> --===============7504265558138116645== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, As state in https://support.sectigo.com/articles/Knowledge/Sectigo-AddT= rust-External-CA-Root-Expiring-May-30-2020 I cannot login in FreeIPA web page. = So I update CA by : # delete everything except IPA CA of httpd and dirsrv certutil -d /etc/http/alias -D -n 'xxx' # ca-bundle.crt is 3 files named USERTrust, .etc. # server.all is an combination of my certificate signed by Sectigo( fomerly= named Comodo). openssl pkcs12 -export -chain -CAfile ca-bundle.crt -in server.all -out S= erver-Cert.p12 -name "Server-Cert" # add to httpd and dirsrv. pk12util -i Server-Cert.p12 -d /etc/httpd/alias/ -n Server-Cert I restart all services by ipactl restart. But it seems pki-tomcat fails to = startup. #### log of ipactcl start #### Starting pki-tomcatd Service ipa: DEBUG: Starting external process ipa: DEBUG: args=3D/bin/systemctl start pki-tomcatd.target ipa: DEBUG: Process finished, return code=3D0 ipa: DEBUG: request POST http://wocfreeipa.sap.wingon.hk:8080/ca/admin/ca/g= etStatus ipa: DEBUG: request body '' ipa: DEBUG: response status 500 ipa: DEBUG: response headers Server: Apache-Coyote/1.1 Content-Type: text/html;charset=3Dutf-8 Content-Language: en Content-Length: 2208 Date: Wed, 17 Jun 2020 09:13:19 GMT Connection: close ipa: DEBUG: response body 'Apache Tomcat/7.0.76 - Error = report