From antoine.gatineau at infra-monkey.com Thu Mar 28 10:39:00 2024 Content-Type: multipart/mixed; boundary="===============9112301193433604306==" MIME-Version: 1.0 From: Antoine Gatineau To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] ACME certs fail to renew Date: Thu, 28 Mar 2024 11:38:37 +0100 Message-ID: <3ef3c740-c208-4413-b121-a74205203f7b@infra-monkey.com> --===============9112301193433604306== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello, I have a strange issue regarding acme service. My acme certificates fail to renew. `ipa-acme-manage status`fails with = error: Failed to authenticate to CA REST API The ipa-acme-manage command failed. certbot client fails with error "Failed to renew certificate = office.empire.lan with error: " $ ipa cert-show 49 =C2=A0Issuing CA: ipa =C2=A0Certificate: "The certificate content" =C2=A0Subject: CN=3Doffice.empire.lan =C2=A0Subject DNS name: office.empire.lan =C2=A0Issuer: CN=3DCertificate Authority,O=3DEMPIRE.LAN =C2=A0Not Before: Sun Dec 24 14:05:50 2023 UTC =C2=A0Not After: Sat Mar 23 14:05:50 2024 UTC =C2=A0Serial number: 49 =C2=A0Serial number (hex): 0x31 =C2=A0Revoked: False So last successful renewal was on Dec 24th. Since then I have not really = done anything appart updating. I don't see any issue in ipaupgrade.log I am running on centos stream 9 idm-jss.x86_64 5.5.0-1.el9 idm-jss-tomcat.x86_64 5.5.0-1.el9 idm-ldapjdk.noarch 5.5.0-1.el9 idm-pki-acme.noarch 11.5.0-1.el9 idm-pki-base.noarch 11.5.0-1.el9 idm-pki-ca.noarch 11.5.0-1.el9 idm-pki-java.noarch 11.5.0-1.el9 idm-pki-kra.noarch 11.5.0-1.el9 idm-pki-server.noarch 11.5.0-1.el9 idm-pki-tools.x86_64 11.5.0-1.el9 ipa-client.x86_64 4.11.0-9.el9 ipa-client-common.noarch 4.11.0-9.el9 ipa-common.noarch 4.11.0-9.el9 ipa-healthcheck.noarch 0.16-2.el9 ipa-healthcheck-core.noarch 0.16-2.el9 ipa-selinux.noarch 4.11.0-9.el9 ipa-server.x86_64 4.11.0-9.el9 ipa-server-common.noarch 4.11.0-9.el9 ipa-server-dns.noarch 4.11.0-9.el9 I have followed closely the update on centos stream 9 Running=C2=A0 `ipa-acme-manage status` with the -d switch gives me ipapython.ipaldap: DEBUG: retrieving schema for SchemaCache = url=3Dldapi://%2fvar%2frun%2fslapd-EMPIRE-LAN.socket = conn=3D ipaserver.masters: DEBUG: Discovery: available servers for service 'CA' = are ipa-server-01.empire.lan, ipa-server-02.empire.lan ipaserver.masters: DEBUG: Discovery: using ipa-server-01.empire.lan for = 'CA' service ipapython.dogtag: DEBUG: request POST = https://ipa-server-01.empire.lan:8443/acme/login ipapython.dogtag: DEBUG: request body '' ipapython.dogtag: DEBUG: response status 404 ipapython.dogtag: DEBUG: response headers Content-Type: = text/html;charset=3Dutf-8 Content-Language: en Content-Length: 765 Date: Thu, 28 Mar 2024 10:00:59 GMT ipapython.dogtag: DEBUG: response body (decoded): b'HTTP Status 404 \xe2\x80\x93 Not = Found

= HTTP = Status 404 \xe2\x80\x93 Not Found


Type = Status Report

Message The requested resource = [/acme/login] is not available

Description The = origin server did not find a current representation for the target = resource or is not willing to disclose that one exists.


Apache Tomcat/9.0.62

' ipapython.admintool: DEBUG:=C2=A0=C2=A0 File = "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in = execute =C2=A0=C2=A0=C2=A0 return_value =3D self.run() =C2=A0 File = "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", = line 403, in run =C2=A0=C2=A0=C2=A0 with state as ca_api: =C2=A0 File = "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", = line 103, in __enter__ =C2=A0=C2=A0=C2=A0 raise errors.RemoteRetrieveError( ipapython.admintool: DEBUG: The ipa-acme-manage command failed, = exception: RemoteRetrieveError: Failed to authenticate to CA REST API ipapython.admintool: ERROR: Failed to authenticate to CA REST API ipapython.admintool: ERROR: The ipa-acme-manage command failed. So it looks like the acme subsystem is not started. But logs for the = acme subsystem in /var/log/pki/pki-tomcat/acme/debug.2024-03-28.log = don't show any issue. (see attached log) How can I go further in troubleshooting/fixing this issue? Thanks --===============9112301193433604306== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PCFET0NUWVBFIGh0bWw+CjxodG1sPgogIDxoZWFkPgoKICAgIDxtZXRhIGh0dHAtZXF1aXY9ImNv bnRlbnQtdHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04Ij4KICA8L2hlYWQ+ CiAgPGJvZHk+CiAgICBIZWxsbyw8YnI+CiAgICA8YnI+CiAgICBJIGhhdmUgYSBzdHJhbmdlIGlz c3VlIHJlZ2FyZGluZyBhY21lIHNlcnZpY2UuPGJyPgogICAgTXkgYWNtZSBjZXJ0aWZpY2F0ZXMg ZmFpbCB0byByZW5ldy4gYGlwYS1hY21lLW1hbmFnZSBzdGF0dXNgZmFpbHMKICAgIHdpdGggZXJy b3I6PGJyPgogICAgRmFpbGVkIHRvIGF1dGhlbnRpY2F0ZSB0byBDQSBSRVNUIEFQSTxicj4KICAg IFRoZSBpcGEtYWNtZS1tYW5hZ2UgY29tbWFuZCBmYWlsZWQuPGJyPgogICAgPGJyPgogICAgPHA+ Y2VydGJvdCBjbGllbnQgZmFpbHMgd2l0aCBlcnJvciAiRmFpbGVkIHRvIHJlbmV3IGNlcnRpZmlj YXRlCiAgICAgIG9mZmljZS5lbXBpcmUubGFuIHdpdGggZXJyb3I6ICZsdDtSZXNwb25zZSBbNDA0 XSZndDsiPC9wPgogICAgPHA+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDAwMDA7YmFja2dyb3VuZC1j b2xvcjojZmZmZmZmOyI+JCBpcGEKICAgICAgICBjZXJ0LXNob3cgNDkKICAgICAgPC9zcGFuPjxi cj4KICAgICAgwqBJc3N1aW5nIENBOiBpcGEKICAgICAgPGJyPgogICAgICDCoENlcnRpZmljYXRl OiAiVGhlIGNlcnRpZmljYXRlIGNvbnRlbnQiPGJyPgogICAgICDCoFN1YmplY3Q6IENOPW9mZmlj ZS5lbXBpcmUubGFuCiAgICAgIDxicj4KICAgICAgwqBTdWJqZWN0IEROUyBuYW1lOiBvZmZpY2Uu ZW1waXJlLmxhbgogICAgICA8YnI+CiAgICAgIMKgSXNzdWVyOiBDTj1DZXJ0aWZpY2F0ZSBBdXRo b3JpdHksTz1FTVBJUkUuTEFOCiAgICAgIDxicj4KICAgICAgwqBOb3QgQmVmb3JlOiBTdW4gRGVj IDI0IDE0OjA1OjUwIDIwMjMgVVRDCiAgICAgIDxicj4KICAgICAgwqBOb3QgQWZ0ZXI6IFNhdCBN YXIgMjMgMTQ6MDU6NTAgMjAyNCBVVEMKICAgICAgPGJyPgogICAgICDCoFNlcmlhbCBudW1iZXI6 IDQ5CiAgICAgIDxicj4KICAgICAgwqBTZXJpYWwgbnVtYmVyIChoZXgpOiAweDMxCiAgICAgIDxi cj4KICAgICAgwqBSZXZva2VkOiBGYWxzZTwvcD4KICAgIDxwPlNvIGxhc3Qgc3VjY2Vzc2Z1bCBy ZW5ld2FsIHdhcyBvbiBEZWMgMjR0aC4gU2luY2UgdGhlbiBJIGhhdmUgbm90CiAgICAgIHJlYWxs eSBkb25lIGFueXRoaW5nIGFwcGFydCB1cGRhdGluZy48c3BhbgogICAgICAgIHN0eWxlPSJmb250 LWZhbWlseTptb25vc3BhY2UiPjxicj4KICAgICAgPC9zcGFuPkkgZG9uJ3Qgc2VlIGFueSBpc3N1 ZSBpbiBpcGF1cGdyYWRlLmxvZyA8c3BhbgogICAgICAgIHN0eWxlPSJmb250LWZhbWlseTptb25v c3BhY2UiPjxicj4KICAgICAgPC9zcGFuPjwvcD4KICAgIDxicj4KICAgIEkgYW0gcnVubmluZyBv biBjZW50b3Mgc3RyZWFtIDk8YnI+CmlkbS1qc3MueDg2XzY0wqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgCiAgICA1LjUuMC0xLmVsOTxicj4KaWRtLWpzcy10b21jYXQueDg2XzY0wqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoAogICAgNS41LjAtMS5lbDk8YnI+CmlkbS1sZGFwamRrLm5vYXJjaMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKICAgIDUuNS4wLTEuZWw5PGJyPgppZG0tcGtpLWFjbWUu bm9hcmNowqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKICAgIDExLjUuMC0xLmVsOSA8YnI+CmlkbS1w a2ktYmFzZS5ub2FyY2jCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAogICAgMTEuNS4wLTEuZWw5IDxi cj4KaWRtLXBraS1jYS5ub2FyY2jCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKICAgIDExLjUu MC0xLmVsOTxicj4KaWRtLXBraS1qYXZhLm5vYXJjaMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCiAg ICAxMS41LjAtMS5lbDk8YnI+CmlkbS1wa2kta3JhLm5vYXJjaMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqAKICAgIDExLjUuMC0xLmVsOTxicj4KaWRtLXBraS1zZXJ2ZXIubm9hcmNowqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoAogICAgMTEuNS4wLTEuZWw5PGJyPgppZG0tcGtpLXRvb2xzLng4Nl82NMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoAogICAgMTEuNS4wLTEuZWw5PGJyPgppcGEtY2xpZW50Lng4Nl82NMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAogICAgNC4xMS4wLTkuZWw5PGJyPgppcGEtY2xpZW50 LWNvbW1vbi5ub2FyY2jCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCiAgICA0LjExLjAtOS5lbDk8YnI+CmlwYS1jb21t b24ubm9hcmNowqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCiAgICA0LjExLjAtOS5lbDk8YnI+ CmlwYS1oZWFsdGhjaGVjay5ub2FyY2jCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAogICAgMC4xNi0yLmVsOTxi cj4KaXBhLWhlYWx0aGNoZWNrLWNvcmUubm9hcmNowqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAogICAgMC4xNi0yLmVsOTxicj4K aXBhLXNlbGludXgubm9hcmNowqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAogICAgNC4xMS4wLTku ZWw5PGJyPgppcGEtc2VydmVyLng4Nl82NMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAogICAg NC4xMS4wLTkuZWw5PGJyPgppcGEtc2VydmVyLWNvbW1vbi5ub2FyY2jCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCiAg ICA0LjExLjAtOS5lbDk8YnI+CmlwYS1zZXJ2ZXItZG5zLm5vYXJjaMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqAKICAgIDQuMTEuMC05LmVsOTxicj4KICAgIDxicj4KICAgIEkgaGF2ZSBmb2xsb3dlZCBjbG9z ZWx5IHRoZSB1cGRhdGUgb24gY2VudG9zIHN0cmVhbSA5PGJyPgogICAgPGJyPgogICAgUnVubmlu Z8KgIGBpcGEtYWNtZS1tYW5hZ2Ugc3RhdHVzYCB3aXRoIHRoZSAtZCBzd2l0Y2ggZ2l2ZXMgbWU8 YnI+CiAgICBpcGFweXRob24uaXBhbGRhcDogREVCVUc6IHJldHJpZXZpbmcgc2NoZW1hIGZvciBT Y2hlbWFDYWNoZQogICAgdXJsPTxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9 ImxkYXBpOi8vJTJmdmFyJTJmcnVuJTJmc2xhcGQtRU1QSVJFLUxBTi5zb2NrZXQiPmxkYXBpOi8v JTJmdmFyJTJmcnVuJTJmc2xhcGQtRU1QSVJFLUxBTi5zb2NrZXQ8L2E+CiAgICBjb25uPSZsdDts ZGFwLmxkYXBvYmplY3QuU2ltcGxlTERBUE9iamVjdCBvYmplY3QgYXQKICAgIDB4N2YxMjNjMDdl MmUwJmd0Ozxicj4KICAgIGlwYXNlcnZlci5tYXN0ZXJzOiBERUJVRzogRGlzY292ZXJ5OiBhdmFp bGFibGUgc2VydmVycyBmb3Igc2VydmljZQogICAgJ0NBJyBhcmUgaXBhLXNlcnZlci0wMS5lbXBp cmUubGFuLCBpcGEtc2VydmVyLTAyLmVtcGlyZS5sYW48YnI+CiAgICBpcGFzZXJ2ZXIubWFzdGVy czogREVCVUc6IERpc2NvdmVyeTogdXNpbmcgaXBhLXNlcnZlci0wMS5lbXBpcmUubGFuCiAgICBm b3IgJ0NBJyBzZXJ2aWNlPGJyPgogICAgaXBhcHl0aG9uLmRvZ3RhZzogREVCVUc6IHJlcXVlc3Qg UE9TVAogICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9p cGEtc2VydmVyLTAxLmVtcGlyZS5sYW46ODQ0My9hY21lL2xvZ2luIj5odHRwczovL2lwYS1zZXJ2 ZXItMDEuZW1waXJlLmxhbjo4NDQzL2FjbWUvbG9naW48L2E+PGJyPgogICAgaXBhcHl0aG9uLmRv Z3RhZzogREVCVUc6IHJlcXVlc3QgYm9keSAnJzxicj4KICAgIGlwYXB5dGhvbi5kb2d0YWc6IERF QlVHOiByZXNwb25zZSBzdGF0dXMgNDA0PGJyPgogICAgaXBhcHl0aG9uLmRvZ3RhZzogREVCVUc6 IHJlc3BvbnNlIGhlYWRlcnMgQ29udGVudC1UeXBlOgogICAgdGV4dC9odG1sO2NoYXJzZXQ9dXRm LTg8YnI+CiAgICBDb250ZW50LUxhbmd1YWdlOiBlbjxicj4KICAgIENvbnRlbnQtTGVuZ3RoOiA3 NjU8YnI+CiAgICBEYXRlOiBUaHUsIDI4IE1hciAyMDI0IDEwOjAwOjU5IEdNVDxicj4KICAgIDxi cj4KICAgIDxicj4KICAgIGlwYXB5dGhvbi5kb2d0YWc6IERFQlVHOiByZXNwb25zZSBib2R5IChk ZWNvZGVkKTogYicmbHQ7IWRvY3R5cGUKICAgIGh0bWwmZ3Q7Jmx0O2h0bWwgbGFuZz0iZW4iJmd0 OyZsdDtoZWFkJmd0OyZsdDt0aXRsZSZndDtIVFRQIFN0YXR1cwogICAgNDA0IFx4ZTJceDgwXHg5 MyBOb3QgRm91bmQmbHQ7L3RpdGxlJmd0OyZsdDtzdHlsZQogICAgdHlwZT0idGV4dC9jc3MiJmd0 O2JvZHkgezxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImZvbnQtZmFtaWx5 OlRhaG9tYSxBcmlhbCxzYW5zLXNlcmlmIj5mb250LWZhbWlseTpUYWhvbWEsQXJpYWwsc2Fucy1z ZXJpZjwvYT47fSBoMSwKICAgIGgyLCBoMywgYiB7PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVl dGV4dCIgaHJlZj0iY29sb3I6d2hpdGU7YmFja2dyb3VuZC1jb2xvcjojNTI1RDc2Ij5jb2xvcjp3 aGl0ZTtiYWNrZ3JvdW5kLWNvbG9yOiM1MjVENzY8L2E+O30gaDEKICAgIHs8YSBjbGFzcz0ibW96 LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJmb250LXNpemU6MjJweCI+Zm9udC1zaXplOjIycHg8 L2E+O30gaDIgezxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImZvbnQtc2l6 ZToxNnB4Ij5mb250LXNpemU6MTZweDwvYT47fSBoMyB7PGEgY2xhc3M9Im1vei10eHQtbGluay1m cmVldGV4dCIgaHJlZj0iZm9udC1zaXplOjE0cHgiPmZvbnQtc2l6ZToxNHB4PC9hPjt9IHAKICAg IHs8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJmb250LXNpemU6MTJweCI+ Zm9udC1zaXplOjEycHg8L2E+O30gYSB7PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg aHJlZj0iY29sb3I6YmxhY2siPmNvbG9yOmJsYWNrPC9hPjt9IC5saW5lCns8YSBjbGFzcz0ibW96 LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJoZWlnaHQ6MXB4O2JhY2tncm91bmQtY29sb3I6IzUy NUQ3Njtib3JkZXI6bm9uZSI+aGVpZ2h0OjFweDtiYWNrZ3JvdW5kLWNvbG9yOiM1MjVENzY7Ym9y ZGVyOm5vbmU8L2E+O30mbHQ7L3N0eWxlJmd0OyZsdDsvaGVhZCZndDsmbHQ7Ym9keSZndDsmbHQ7 aDEmZ3Q7SFRUUAogICAgU3RhdHVzIDQwNCBceGUyXHg4MFx4OTMgTm90IEZvdW5kJmx0Oy9oMSZn dDsmbHQ7aHIgY2xhc3M9ImxpbmUiCiAgICAvJmd0OyZsdDtwJmd0OyZsdDtiJmd0O1R5cGUmbHQ7 L2ImZ3Q7IFN0YXR1cwogICAgUmVwb3J0Jmx0Oy9wJmd0OyZsdDtwJmd0OyZsdDtiJmd0O01lc3Nh Z2UmbHQ7L2ImZ3Q7IFRoZSByZXF1ZXN0ZWQKICAgIHJlc291cmNlIFsmYW1wOyM0NzthY21lJmFt cDsjNDc7bG9naW5dIGlzIG5vdAogICAgYXZhaWxhYmxlJmx0Oy9wJmd0OyZsdDtwJmd0OyZsdDti Jmd0O0Rlc2NyaXB0aW9uJmx0Oy9iJmd0OyBUaGUKICAgIG9yaWdpbiBzZXJ2ZXIgZGlkIG5vdCBm aW5kIGEgY3VycmVudCByZXByZXNlbnRhdGlvbiBmb3IgdGhlIHRhcmdldAogICAgcmVzb3VyY2Ug b3IgaXMgbm90IHdpbGxpbmcgdG8gZGlzY2xvc2UgdGhhdCBvbmUKICAgIGV4aXN0cy4mbHQ7L3Am Z3Q7Jmx0O2hyIGNsYXNzPSJsaW5lIiAvJmd0OyZsdDtoMyZndDtBcGFjaGUKICAgIFRvbWNhdC85 LjAuNjImbHQ7L2gzJmd0OyZsdDsvYm9keSZndDsmbHQ7L2h0bWwmZ3Q7Jzxicj4KICAgIGlwYXB5 dGhvbi5hZG1pbnRvb2w6IERFQlVHOsKgwqAgRmlsZQogICAgIi91c3IvbGliL3B5dGhvbjMuOS9z aXRlLXBhY2thZ2VzL2lwYXB5dGhvbi9hZG1pbnRvb2wucHkiLCBsaW5lIDE4MCwKICAgIGluIGV4 ZWN1dGU8YnI+CiAgICDCoMKgwqAgcmV0dXJuX3ZhbHVlID0gc2VsZi5ydW4oKTxicj4KICAgIMKg IEZpbGUKICAgICIvdXNyL2xpYi9weXRob24zLjkvc2l0ZS1wYWNrYWdlcy9pcGFzZXJ2ZXIvaW5z dGFsbC9pcGFfYWNtZV9tYW5hZ2UucHkiLAogICAgbGluZSA0MDMsIGluIHJ1bjxicj4KICAgIMKg wqDCoCB3aXRoIHN0YXRlIGFzIGNhX2FwaTo8YnI+CiAgICDCoCBGaWxlCiAgICAiL3Vzci9saWIv cHl0aG9uMy45L3NpdGUtcGFja2FnZXMvaXBhc2VydmVyL2luc3RhbGwvaXBhX2FjbWVfbWFuYWdl LnB5IiwKICAgIGxpbmUgMTAzLCBpbiBfX2VudGVyX188YnI+CiAgICDCoMKgwqAgcmFpc2UgZXJy b3JzLlJlbW90ZVJldHJpZXZlRXJyb3IoPGJyPgogICAgPGJyPgogICAgaXBhcHl0aG9uLmFkbWlu dG9vbDogREVCVUc6IFRoZSBpcGEtYWNtZS1tYW5hZ2UgY29tbWFuZCBmYWlsZWQsCiAgICBleGNl cHRpb246IFJlbW90ZVJldHJpZXZlRXJyb3I6IEZhaWxlZCB0byBhdXRoZW50aWNhdGUgdG8gQ0Eg UkVTVAogICAgQVBJPGJyPgogICAgaXBhcHl0aG9uLmFkbWludG9vbDogRVJST1I6IEZhaWxlZCB0 byBhdXRoZW50aWNhdGUgdG8gQ0EgUkVTVCBBUEk8YnI+CiAgICBpcGFweXRob24uYWRtaW50b29s OiBFUlJPUjogVGhlIGlwYS1hY21lLW1hbmFnZSBjb21tYW5kIGZhaWxlZC48YnI+CiAgICA8YnI+ CiAgICA8YnI+CiAgICBTbyBpdCBsb29rcyBsaWtlIHRoZSBhY21lIHN1YnN5c3RlbSBpcyBub3Qg c3RhcnRlZC4gQnV0IGxvZ3MgZm9yIHRoZQogICAgYWNtZSBzdWJzeXN0ZW0gaW4gL3Zhci9sb2cv cGtpL3BraS10b21jYXQvYWNtZS9kZWJ1Zy4yMDI0LTAzLTI4LmxvZwogICAgZG9uJ3Qgc2hvdyBh bnkgaXNzdWUuIChzZWUgYXR0YWNoZWQgbG9nKTxicj4KICAgIDxicj4KICAgIEhvdyBjYW4gSSBn byBmdXJ0aGVyIGluIHRyb3VibGVzaG9vdGluZy9maXhpbmcgdGhpcyBpc3N1ZT88YnI+CiAgICA8 YnI+CiAgICBUaGFua3M8YnI+CiAgICA8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============9112301193433604306== Content-Type: text/plain MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="pki-acme-debug-log.txt" MjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5GTzogU3RhcnRpbmcgQUNNRSBlbmdpbmUKMjAy NC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5GTzogQUNNRSBjb25maWd1cmF0aW9uIGRpcmVjdG9y eTogL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29uZi9hY21lCjIwMjQtMDMtMjggMTE6MDY6MTIg W21haW5dIElORk86IExvYWRpbmcgQUNNRSBlbmdpbmUgY29uZmlnIGZyb20gL3Zhci9saWIvcGtp L3BraS10b21jYXQvY29uZi9hY21lL2VuZ2luZS5jb25mCjIwMjQtMDMtMjggMTE6MDY6MTIgW21h aW5dIElORk86IC0gZW5hYmxlZDogZmFsc2UKMjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5G TzogLSBiYXNlIFVSTDogaHR0cHM6Ly9pcGEtc2VydmVyLTAxLmVtcGlyZS5sYW4vYWNtZQoyMDI0 LTAzLTI4IDExOjA2OjEyIFttYWluXSBJTkZPOiAtIG5vbmNlcyBwZXJzaXN0ZW50OiBudWxsCjIw MjQtMDMtMjggMTE6MDY6MTIgW21haW5dIElORk86IC0gd2lsZGNhcmQ6IGZhbHNlCjIwMjQtMDMt MjggMTE6MDY6MTIgW21haW5dIElORk86IC0gbm9uY2UgcmV0ZW50aW9uOiB7CiAgImxlbmd0aCIg OiAzMCwKICAidW5pdCIgOiAiTUlOVVRFUyIKfQoyMDI0LTAzLTI4IDExOjA2OjEyIFttYWluXSBJ TkZPOiAtIGF1dGhvcml6YXRpb24gcmV0ZW50aW9uOgoyMDI0LTAzLTI4IDExOjA2OjEyIFttYWlu XSBJTkZPOiAgIC0gcGVuZGluZzogewogICJsZW5ndGgiIDogMzAsCiAgInVuaXQiIDogIk1JTlVU RVMiCn0KMjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5GTzogICAtIGludmFsaWQ6IHsKICAi bGVuZ3RoIiA6IDMwLAogICJ1bml0IiA6ICJNSU5VVEVTIgp9CjIwMjQtMDMtMjggMTE6MDY6MTIg W21haW5dIElORk86ICAgLSB2YWxpZDogewogICJsZW5ndGgiIDogMzAsCiAgInVuaXQiIDogIk1J TlVURVMiCn0KMjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5GTzogLSBvcmRlciByZXRlbnRp b246CjIwMjQtMDMtMjggMTE6MDY6MTIgW21haW5dIElORk86ICAgLSBwZW5kaW5nOiB7CiAgImxl bmd0aCIgOiAzMCwKICAidW5pdCIgOiAiTUlOVVRFUyIKfQoyMDI0LTAzLTI4IDExOjA2OjEyIFtt YWluXSBJTkZPOiAgIC0gaW52YWxpZDogewogICJsZW5ndGgiIDogMzAsCiAgInVuaXQiIDogIk1J TlVURVMiCn0KMjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5GTzogICAtIHJlYWR5OiB7CiAg Imxlbmd0aCIgOiAzMCwKICAidW5pdCIgOiAiTUlOVVRFUyIKfQoyMDI0LTAzLTI4IDExOjA2OjEy IFttYWluXSBJTkZPOiAgIC0gcHJvY2Vzc2luZzogewogICJsZW5ndGgiIDogMzAsCiAgInVuaXQi IDogIk1JTlVURVMiCn0KMjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5GTzogICAtIHZhbGlk OiB7CiAgImxlbmd0aCIgOiAzMCwKICAidW5pdCIgOiAiTUlOVVRFUyIKfQoyMDI0LTAzLTI4IDEx OjA2OjEyIFttYWluXSBJTkZPOiAtIGNlcnRpZmljYXRlIHJldGVudGlvbjogewogICJsZW5ndGgi IDogMzAsCiAgInVuaXQiIDogIkRBWVMiCn0KMjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5G TzogTG9hZGluZyBBQ01FIG1ldGFkYXRhIGZyb20gL3Vzci9zaGFyZS9wa2kvYWNtZS9jb25mL21l dGFkYXRhLmNvbmYKMjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gSU5GTzogTG9hZGluZyBBQ01F IGRhdGFiYXNlIGNvbmZpZyBmcm9tIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2NvbmYvYWNtZS9k YXRhYmFzZS5jb25mCjIwMjQtMDMtMjggMTE6MDY6MTIgW21haW5dIElORk86IEluaXRpYWxpemlu ZyBBQ01FIGRhdGFiYXNlCjIwMjQtMDMtMjggMTE6MDY6MTIgW21haW5dIElORk86IExvYWRpbmcg TERBUCBkYXRhYmFzZSBjb25maWd1cmF0aW9uIGZyb20gL2V0Yy9wa2kvcGtpLXRvbWNhdC9jYS9D Uy5jZmcKMjAyNC0wMy0yOCAxMTowNjoxMiBbbWFpbl0gV0FSTklORzogVGhlIGJhc2VkbiBwYXJh bWV0ZXIgaGFzIGJlZW4gZGVwcmVjYXRlZC4gVXNlIGJhc2VETiBpbnN0ZWFkLgoyMDI0LTAzLTI4 IDExOjA2OjEyIFttYWluXSBJTkZPOiAtIGJhc2UgRE46IG91PWFjbWUsbz1pcGFjYQoyMDI0LTAz LTI4IDExOjA2OjEyIFttYWluXSBJTkZPOiBQS0lTb2NrZXRGYWN0b3J5OiBJbml0aWFsaXppbmcg UEtJU29ja2V0RmFjdG9yeQoyMDI0LTAzLTI4IDExOjA2OjEyIFttYWluXSBJTkZPOiBQS0lTb2Nr ZXRGYWN0b3J5OiBDcmVhdGluZyBTU0wgc29ja2V0IGZvciBpcGEtc2VydmVyLTAxLmVtcGlyZS5s YW46NjM2CjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElORk86IC0gbW9uaXRvciBlbmFibGVk OiBudWxsCjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElORk86IExvYWRpbmcgQUNNRSB2YWxp ZGF0b3JzIGNvbmZpZyBmcm9tIC91c3Ivc2hhcmUvcGtpL2FjbWUvY29uZi92YWxpZGF0b3JzLmNv bmYKMjAyNC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogSW5pdGlhbGl6aW5nIEFDTUUgdmFs aWRhdG9ycwoyMDI0LTAzLTI4IDExOjA2OjEzIFttYWluXSBJTkZPOiBJbml0aWFsaXppbmcgZG5z LTAxIHZhbGlkYXRvcgoyMDI0LTAzLTI4IDExOjA2OjEzIFttYWluXSBJTkZPOiBJbml0aWFsaXpp bmcgaHR0cC0wMSB2YWxpZGF0b3IKMjAyNC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogTG9h ZGluZyBBQ01FIGlzc3VlciBjb25maWcgZnJvbSAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9jb25m L2FjbWUvaXNzdWVyLmNvbmYKMjAyNC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogSW5pdGlh bGl6aW5nIEFDTUUgaXNzdWVyCjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElORk86IEluaXRp YWxpemluZyBQS0kgaXNzdWVyCjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElORk86IC0gVVJM OiBodHRwczovL2lwYS1zZXJ2ZXItMDEuZW1waXJlLmxhbjo4NDQzCjIwMjQtMDMtMjggMTE6MDY6 MTMgW21haW5dIElORk86IC0gdXNlcm5hbWU6IGFjbWUtaXBhLXNlcnZlci0wMS5lbXBpcmUubGFu CjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElORk86IC0gcHJvZmlsZTogYWNtZUlQQVNlcnZl ckNlcnQKMjAyNC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogTG9hZGluZyBBQ01FIHNjaGVk dWxlciBjb25maWcgZnJvbSAvdXNyL3NoYXJlL3BraS9hY21lL2NvbmYvc2NoZWR1bGVyLmNvbmYK MjAyNC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogSW5pdGlhbGl6aW5nIEFDTUUgc2NoZWR1 bGVyCjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElORk86IEluaXRpYWxpemluZyBBQ01FIHNj aGVkdWxlcgoyMDI0LTAzLTI4IDExOjA2OjEzIFttYWluXSBJTkZPOiAtIHRocmVhZHM6IDEKMjAy NC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogSW5pdGlhbGl6aW5nIG1haW50ZW5hbmNlIHRh c2sKMjAyNC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogLSBpbml0aWFsIGRlbGF5OiA1CjIw MjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElORk86IC0gZGVsYXk6IDUKMjAyNC0wMy0yOCAxMTow NjoxMyBbbWFpbl0gSU5GTzogLSBpbnRlcnZhbDogbnVsbAoyMDI0LTAzLTI4IDExOjA2OjEzIFtt YWluXSBJTkZPOiAtIHVuaXQ6IE1JTlVURVMKMjAyNC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5G TzogTG9hZGluZyBBQ01FIG1vbml0b3JzIGNvbmZpZyBmcm9tIC92YXIvbGliL3BraS9wa2ktdG9t Y2F0L2NvbmYvYWNtZS9jb25maWdzb3VyY2VzLmNvbmYKMjAyNC0wMy0yOCAxMTowNjoxMyBbbWFp bl0gSU5GTzogQUNNRSBzZXJ2aWNlIGlzIERJU0FCTEVEIGJ5IGNvbmZpZ3VyYXRpb24KMjAyNC0w My0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogQUNNRSB3aWxkY2FyZCBpc3N1YW5jZSBpcyBESVNB QkxFRCBieSBjb25maWd1cmF0aW9uCjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElORk86IExv YWRpbmcgQUNNRSByZWFsbSBjb25maWcgZnJvbSAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9jb25m L2FjbWUvcmVhbG0uY29uZgoyMDI0LTAzLTI4IDExOjA2OjEzIFttYWluXSBJTkZPOiBJbml0aWFs aXppbmcgQUNNRSByZWFsbQoyMDI0LTAzLTI4IDExOjA2OjEzIFtBQ01FRW5naW5lQ29uZmlnRmls ZVNvdXJjZV0gSU5GTzogQUNNRUVuZ2luZUNvbmZpZ1NvdXJjZTogd2F0Y2hpbmcgL2V0Yy9wa2kv cGtpLXRvbWNhdC9hY21lL2VuZ2luZS5jb25mCjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElO Rk86IEluaXRpYWxpemluZyBMREFQIHJlYWxtCjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5dIElO Rk86IExvYWRpbmcgTERBUCByZWFsbSBjb25maWcgZnJvbSAvZXRjL3BraS9wa2ktdG9tY2F0L2Nh L0NTLmNmZwoyMDI0LTAzLTI4IDExOjA2OjEzIFttYWluXSBJTkZPOiAtIHVzZXJzIEROOiBvdT1w ZW9wbGUsbz1pcGFjYQoyMDI0LTAzLTI4IDExOjA2OjEzIFttYWluXSBJTkZPOiAtIGdyb3VwcyBE Tjogb3U9Z3JvdXBzLG89aXBhY2EKMjAyNC0wMy0yOCAxMTowNjoxMyBbbWFpbl0gSU5GTzogUEtJ U29ja2V0RmFjdG9yeTogSW5pdGlhbGl6aW5nIFBLSVNvY2tldEZhY3RvcnkKMjAyNC0wMy0yOCAx MTowNjoxMyBbbWFpbl0gSU5GTzogUEtJU29ja2V0RmFjdG9yeTogQ3JlYXRpbmcgU1NMIHNvY2tl dCBmb3IgaXBhLXNlcnZlci0wMS5lbXBpcmUubGFuOjYzNgoyMDI0LTAzLTI4IDExOjA2OjEzIFtt YWluXSBJTkZPOiBBQ01FIGVuZ2luZSBzdGFydGVkCjIwMjQtMDMtMjggMTE6MDY6MTMgW21haW5d IElORk86IEluaXRpYWxpemluZyBBQ01FQXBwbGljYXRpb24K --===============9112301193433604306== Content-Type: text/plain MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="ipa-healthcheck.txt" WwogIHsKICAgICJzb3VyY2UiOiAiaXBhaGVhbHRoY2hlY2suZG9ndGFnLmNhIiwKICAgICJjaGVj ayI6ICJEb2d0YWdDZXJ0c0NvbmZpZ0NoZWNrIiwKICAgICJyZXN1bHQiOiAiRVJST1IiLAogICAg InV1aWQiOiAiOWM0YjI1ZDAtOTlhMi00NDIzLWIwMTktMWNlNmNjOWFlYmUxIiwKICAgICJ3aGVu IjogIjIwMjQwMzI4MTAzNjM4WiIsCiAgICAiZHVyYXRpb24iOiAiMC4zNzI4NDgiLAogICAgImt3 IjogewogICAgICAia2V5IjogImNhU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EiLAogICAgICAiY29u ZmlnZmlsZSI6ICIvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9jb25mL2NhL0NTLmNmZyIsCiAgICAg ICJtc2ciOiAiQ2VydGlmaWNhdGUgY2Euc2lnbmluZy5jZXJ0IG5vdCBmb3VuZCBpbiAvdmFyL2xp Yi9wa2kvcGtpLXRvbWNhdC9jb25mL2NhL0NTLmNmZyIKICAgIH0KICB9LAogIHsKICAgICJzb3Vy Y2UiOiAiaXBhaGVhbHRoY2hlY2suZG9ndGFnLmNhIiwKICAgICJjaGVjayI6ICJEb2d0YWdDZXJ0 c0NvbmZpZ0NoZWNrIiwKICAgICJyZXN1bHQiOiAiRVJST1IiLAogICAgInV1aWQiOiAiZjZmOTZh ZmYtNWNhYi00MmNjLTgxNDYtOGE5NzdlNDE0ZmY3IiwKICAgICJ3aGVuIjogIjIwMjQwMzI4MTAz NjM4WiIsCiAgICAiZHVyYXRpb24iOiAiMC4zNzQxMzEiLAogICAgImt3IjogewogICAgICAia2V5 IjogIm9jc3BTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSIsCiAgICAgICJjb25maWdmaWxlIjogIi92 YXIvbGliL3BraS9wa2ktdG9tY2F0L2NvbmYvY2EvQ1MuY2ZnIiwKICAgICAgIm1zZyI6ICJDZXJ0 aWZpY2F0ZSBjYS5vY3NwX3NpZ25pbmcuY2VydCBub3QgZm91bmQgaW4gL3Zhci9saWIvcGtpL3Br aS10b21jYXQvY29uZi9jYS9DUy5jZmciCiAgICB9CiAgfSwKICB7CiAgICAic291cmNlIjogImlw YWhlYWx0aGNoZWNrLmRvZ3RhZy5jYSIsCiAgICAiY2hlY2siOiAiRG9ndGFnQ2VydHNDb25maWdD aGVjayIsCiAgICAicmVzdWx0IjogIkVSUk9SIiwKICAgICJ1dWlkIjogIjhjZGNiYTgwLTYxODYt NDU3NS04YTVmLWU3Y2Q1MGJhYWRkYSIsCiAgICAid2hlbiI6ICIyMDI0MDMyODEwMzYzOFoiLAog ICAgImR1cmF0aW9uIjogIjAuMzc0OTkxIiwKICAgICJrdyI6IHsKICAgICAgImtleSI6ICJzdWJz eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIiwKICAgICAgImNvbmZpZ2ZpbGUiOiAiL3Zhci9saWIvcGtp L3BraS10b21jYXQvY29uZi9jYS9DUy5jZmciLAogICAgICAibXNnIjogIkNlcnRpZmljYXRlIGNh LnN1YnN5c3RlbS5jZXJ0IG5vdCBmb3VuZCBpbiAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9jb25m L2NhL0NTLmNmZyIKICAgIH0KICB9LAogIHsKICAgICJzb3VyY2UiOiAiaXBhaGVhbHRoY2hlY2su ZG9ndGFnLmNhIiwKICAgICJjaGVjayI6ICJEb2d0YWdDZXJ0c0NvbmZpZ0NoZWNrIiwKICAgICJy ZXN1bHQiOiAiRVJST1IiLAogICAgInV1aWQiOiAiYjc1NjE0NGYtZGI5NS00MzEzLWJjYTItY2Rl NWRlYjM4NDdhIiwKICAgICJ3aGVuIjogIjIwMjQwMzI4MTAzNjM4WiIsCiAgICAiZHVyYXRpb24i OiAiMC4zNzU4MDQiLAogICAgImt3IjogewogICAgICAia2V5IjogImF1ZGl0U2lnbmluZ0NlcnQg Y2VydC1wa2ktY2EiLAogICAgICAiY29uZmlnZmlsZSI6ICIvdmFyL2xpYi9wa2kvcGtpLXRvbWNh dC9jb25mL2NhL0NTLmNmZyIsCiAgICAgICJtc2ciOiAiQ2VydGlmaWNhdGUgY2EuYXVkaXRfc2ln bmluZy5jZXJ0IG5vdCBmb3VuZCBpbiAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9jb25mL2NhL0NT LmNmZyIKICAgIH0KICB9LAogIHsKICAgICJzb3VyY2UiOiAiaXBhaGVhbHRoY2hlY2suZG9ndGFn LmNhIiwKICAgICJjaGVjayI6ICJEb2d0YWdDZXJ0c0NvbmZpZ0NoZWNrIiwKICAgICJyZXN1bHQi OiAiRVJST1IiLAogICAgInV1aWQiOiAiYmQzMDNkMTMtZjk3MS00YjMxLWJiYmEtODRiYjI0YTFj ODEzIiwKICAgICJ3aGVuIjogIjIwMjQwMzI4MTAzNjM4WiIsCiAgICAiZHVyYXRpb24iOiAiMC4z NzY2NDEiLAogICAgImt3IjogewogICAgICAia2V5IjogIlNlcnZlci1DZXJ0IGNlcnQtcGtpLWNh IiwKICAgICAgImNvbmZpZ2ZpbGUiOiAiL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29uZi9jYS9D Uy5jZmciLAogICAgICAibXNnIjogIkNlcnRpZmljYXRlIGNhLnNzbHNlcnZlci5jZXJ0IG5vdCBm b3VuZCBpbiAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9jb25mL2NhL0NTLmNmZyIKICAgIH0KICB9 Cl0K --===============9112301193433604306==-- From rcritten at redhat.com Mon Apr 1 14:47:16 2024 Content-Type: multipart/mixed; boundary="===============5768192954560133059==" MIME-Version: 1.0 From: Rob Crittenden To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: ACME certs fail to renew Date: Mon, 01 Apr 2024 10:46:58 -0400 Message-ID: <2e47af52-bfd8-251a-4739-5918abff075c@redhat.com> In-Reply-To: 3ef3c740-c208-4413-b121-a74205203f7b@infra-monkey.com --===============5768192954560133059== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Antoine Gatineau via FreeIPA-users wrote: > Hello, > = > I have a strange issue regarding acme service. > My acme certificates fail to renew. `ipa-acme-manage status`fails with > error: > Failed to authenticate to CA REST API > The ipa-acme-manage command failed. > = > certbot client fails with error "Failed to renew certificate > office.empire.lan with error: " > = > $ ipa cert-show 49 > =C2=A0Issuing CA: ipa > =C2=A0Certificate: "The certificate content" > =C2=A0Subject: CN=3Doffice.empire.lan > =C2=A0Subject DNS name: office.empire.lan > =C2=A0Issuer: CN=3DCertificate Authority,O=3DEMPIRE.LAN > =C2=A0Not Before: Sun Dec 24 14:05:50 2023 UTC > =C2=A0Not After: Sat Mar 23 14:05:50 2024 UTC > =C2=A0Serial number: 49 > =C2=A0Serial number (hex): 0x31 > =C2=A0Revoked: False > = > So last successful renewal was on Dec 24th. Since then I have not really > done anything appart updating. > I don't see any issue in ipaupgrade.log > = > = > I am running on centos stream 9 > idm-jss.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 5.5.0-1.el9 > idm-jss-tomcat.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 5.5.0-1.el9 > idm-ldapjdk.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 > 5.5.0-1.el9 > idm-pki-acme.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 > 11.5.0-1.el9 > idm-pki-base.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 > 11.5.0-1.el9 > idm-pki-ca.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 > 11.5.0-1.el9 > idm-pki-java.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 > 11.5.0-1.el9 > idm-pki-kra.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 > 11.5.0-1.el9 > idm-pki-server.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 11.5.0-1.el9 > idm-pki-tools.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 11.5.0-1.el9 > ipa-client.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 > 4.11.0-9.el9 > ipa-client-common.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 4.11.0-9.el9 > ipa-common.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 > 4.11.0-9.el9 > ipa-healthcheck.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 0.16-2.el9 > ipa-healthcheck-core.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 0.16-2.el9 > ipa-selinux.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 > 4.11.0-9.el9 > ipa-server.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 > 4.11.0-9.el9 > ipa-server-common.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 4.11.0-9.el9 > ipa-server-dns.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 > 4.11.0-9.el9 > = > I have followed closely the update on centos stream 9 > = > Running=C2=A0 `ipa-acme-manage status` with the -d switch gives me > ipapython.ipaldap: DEBUG: retrieving schema for SchemaCache > url=3Dldapi://%2fvar%2frun%2fslapd-EMPIRE-LAN.socket > conn=3D > ipaserver.masters: DEBUG: Discovery: available servers for service 'CA' > are ipa-server-01.empire.lan, ipa-server-02.empire.lan > ipaserver.masters: DEBUG: Discovery: using ipa-server-01.empire.lan for > 'CA' service > ipapython.dogtag: DEBUG: request POST > https://ipa-server-01.empire.lan:8443/acme/login > ipapython.dogtag: DEBUG: request body '' > ipapython.dogtag: DEBUG: response status 404 > ipapython.dogtag: DEBUG: response headers Content-Type: > text/html;charset=3Dutf-8 > Content-Language: en > Content-Length: 765 > Date: Thu, 28 Mar 2024 10:00:59 GMT > = > = > ipapython.dogtag: DEBUG: response body (decoded): b' lang=3D"en">HTTP Status 404 \xe2\x80\x93 Not > FoundHTTP > Status 404 \xe2\x80\x93 Not Found

Type > Status Report

Message The requested resource > [/acme/login] is not available

Description The > origin server did not find a current representation for the target > resource or is not willing to disclose that one exists.


class=3D"line" />

Apache Tomcat/9.0.62

' > ipapython.admintool: DEBUG:=C2=A0=C2=A0 File > "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in > execute > =C2=A0=C2=A0=C2=A0 return_value =3D self.run() > =C2=A0 File > "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", > line 403, in run > =C2=A0=C2=A0=C2=A0 with state as ca_api: > =C2=A0 File > "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", > line 103, in __enter__ > =C2=A0=C2=A0=C2=A0 raise errors.RemoteRetrieveError( > = > ipapython.admintool: DEBUG: The ipa-acme-manage command failed, > exception: RemoteRetrieveError: Failed to authenticate to CA REST API > ipapython.admintool: ERROR: Failed to authenticate to CA REST API > ipapython.admintool: ERROR: The ipa-acme-manage command failed. > = > = > So it looks like the acme subsystem is not started. But logs for the > acme subsystem in /var/log/pki/pki-tomcat/acme/debug.2024-03-28.log > don't show any issue. (see attached log) > = > How can I go further in troubleshooting/fixing this issue? I'd start by verifying that your CA is functioning. Something like ipa cert-find. Since you got a 404 (not found) I'd make sure that /etc/httpd/conf.d/ipa-pki-proxy.conf contains: ... rob --===============5768192954560133059==-- From antoine.gatineau at infra-monkey.com Tue Apr 2 09:42:35 2024 Content-Type: multipart/mixed; boundary="===============4420590048782926160==" MIME-Version: 1.0 From: Antoine Gatineau To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: ACME certs fail to renew Date: Tue, 02 Apr 2024 11:42:18 +0200 Message-ID: In-Reply-To: 2e47af52-bfd8-251a-4739-5918abff075c@redhat.com --===============4420590048782926160== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello Rob, Thank you for replying quickly. As far as I could see, the apache config is good. All the 'ipa cert-*' and 'ipa ca-*' were working properly. This only command not working was ipa-acme-manage (and the certbot renew = obviously). I tried adding a replica and acme was available and working on the new = replica which rules out the ldap content I guess. I then reinstalled my replicas and everything is working properly now. So fixed, but I still don't know what happened :/ Best regards On 4/1/24 16:46, Rob Crittenden via FreeIPA-users wrote: > Antoine Gatineau via FreeIPA-users wrote: >> Hello, >> >> I have a strange issue regarding acme service. >> My acme certificates fail to renew. `ipa-acme-manage status`fails with >> error: >> Failed to authenticate to CA REST API >> The ipa-acme-manage command failed. >> >> certbot client fails with error "Failed to renew certificate >> office.empire.lan with error: " >> >> $ ipa cert-show 49 >> =C2=A0Issuing CA: ipa >> =C2=A0Certificate: "The certificate content" >> =C2=A0Subject: CN=3Doffice.empire.lan >> =C2=A0Subject DNS name: office.empire.lan >> =C2=A0Issuer: CN=3DCertificate Authority,O=3DEMPIRE.LAN >> =C2=A0Not Before: Sun Dec 24 14:05:50 2023 UTC >> =C2=A0Not After: Sat Mar 23 14:05:50 2024 UTC >> =C2=A0Serial number: 49 >> =C2=A0Serial number (hex): 0x31 >> =C2=A0Revoked: False >> >> So last successful renewal was on Dec 24th. Since then I have not really >> done anything appart updating. >> I don't see any issue in ipaupgrade.log >> >> >> I am running on centos stream 9 >> idm-jss.x86_64 >> 5.5.0-1.el9 >> idm-jss-tomcat.x86_64 >> 5.5.0-1.el9 >> idm-ldapjdk.noarch >> 5.5.0-1.el9 >> idm-pki-acme.noarch >> 11.5.0-1.el9 >> idm-pki-base.noarch >> 11.5.0-1.el9 >> idm-pki-ca.noarch >> 11.5.0-1.el9 >> idm-pki-java.noarch >> 11.5.0-1.el9 >> idm-pki-kra.noarch >> 11.5.0-1.el9 >> idm-pki-server.noarch >> 11.5.0-1.el9 >> idm-pki-tools.x86_64 >> 11.5.0-1.el9 >> ipa-client.x86_64 >> 4.11.0-9.el9 >> ipa-client-common.noarch >> 4.11.0-9.el9 >> ipa-common.noarch >> 4.11.0-9.el9 >> ipa-healthcheck.noarch >> 0.16-2.el9 >> ipa-healthcheck-core.noarch >> 0.16-2.el9 >> ipa-selinux.noarch >> 4.11.0-9.el9 >> ipa-server.x86_64 >> 4.11.0-9.el9 >> ipa-server-common.noarch >> 4.11.0-9.el9 >> ipa-server-dns.noarch >> 4.11.0-9.el9 >> >> I have followed closely the update on centos stream 9 >> >> Running=C2=A0 `ipa-acme-manage status` with the -d switch gives me >> ipapython.ipaldap: DEBUG: retrieving schema for SchemaCache >> url=3Dldapi://%2fvar%2frun%2fslapd-EMPIRE-LAN.socket >> conn=3D >> ipaserver.masters: DEBUG: Discovery: available servers for service 'CA' >> are ipa-server-01.empire.lan, ipa-server-02.empire.lan >> ipaserver.masters: DEBUG: Discovery: using ipa-server-01.empire.lan for >> 'CA' service >> ipapython.dogtag: DEBUG: request POST >> https://ipa-server-01.empire.lan:8443/acme/login >> ipapython.dogtag: DEBUG: request body '' >> ipapython.dogtag: DEBUG: response status 404 >> ipapython.dogtag: DEBUG: response headers Content-Type: >> text/html;charset=3Dutf-8 >> Content-Language: en >> Content-Length: 765 >> Date: Thu, 28 Mar 2024 10:00:59 GMT >> >> >> ipapython.dogtag: DEBUG: response body (decoded): b'> lang=3D"en">HTTP Status 404 \xe2\x80\x93 Not >> Found<= h1>HTTP >> Status 404 \xe2\x80\x93 Not Found

Type >> Status Report

Message The requested resource >> [/acme/login] is not available

Description The >> origin server did not find a current representation for the target >> resource or is not willing to disclose that one exists.


> class=3D"line" />

Apache Tomcat/9.0.62

' >> ipapython.admintool: DEBUG:=C2=A0=C2=A0 File >> "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in >> execute >> =C2=A0=C2=A0=C2=A0 return_value =3D self.run() >> =C2=A0 File >> "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", >> line 403, in run >> =C2=A0=C2=A0=C2=A0 with state as ca_api: >> =C2=A0 File >> "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", >> line 103, in __enter__ >> =C2=A0=C2=A0=C2=A0 raise errors.RemoteRetrieveError( >> >> ipapython.admintool: DEBUG: The ipa-acme-manage command failed, >> exception: RemoteRetrieveError: Failed to authenticate to CA REST API >> ipapython.admintool: ERROR: Failed to authenticate to CA REST API >> ipapython.admintool: ERROR: The ipa-acme-manage command failed. >> >> >> So it looks like the acme subsystem is not started. But logs for the >> acme subsystem in /var/log/pki/pki-tomcat/acme/debug.2024-03-28.log >> don't show any issue. (see attached log) >> >> How can I go further in troubleshooting/fixing this issue? > I'd start by verifying that your CA is functioning. Something like ipa > cert-find. > > Since you got a 404 (not found) I'd make sure that > /etc/httpd/conf.d/ipa-pki-proxy.conf contains: > > > ... > > rob > -- > _______________________________________________ > FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted.o= rg > Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-= of-conduct/ > List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives:https://lists.fedorahosted.org/archives/list/freeipa-users(= a)lists.fedorahosted.org > Do not reply to spam, report it:https://pagure.io/fedora-infrastructure/n= ew_issue --===============4420590048782926160== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PCFET0NUWVBFIGh0bWw+CjxodG1sPgogIDxoZWFkPgogICAgPG1ldGEgaHR0cC1lcXVpdj0iQ29u dGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLTgiPgogIDwvaGVhZD4K ICA8Ym9keT4KICAgIDxwPkhlbGxvIFJvYiw8YnI+CiAgICAgIDxicj4KICAgICAgVGhhbmsgeW91 IGZvciByZXBseWluZyBxdWlja2x5LjwvcD4KICAgIDxwPkFzIGZhciBhcyBJIGNvdWxkIHNlZSwg dGhlIGFwYWNoZSBjb25maWcgaXMgZ29vZC48YnI+CiAgICAgIEFsbCB0aGUgJ2lwYSBjZXJ0LSon IGFuZCAnaXBhIGNhLSonIHdlcmUgd29ya2luZyBwcm9wZXJseS48YnI+CiAgICAgIDxicj4KICAg ICAgVGhpcyBvbmx5IGNvbW1hbmQgbm90IHdvcmtpbmcgd2FzIGlwYS1hY21lLW1hbmFnZSAoYW5k IHRoZSBjZXJ0Ym90CiAgICAgIHJlbmV3IG9idmlvdXNseSkuPGJyPgogICAgICA8YnI+CiAgICAg IEkgdHJpZWQgYWRkaW5nIGEgcmVwbGljYSBhbmQgYWNtZSB3YXMgYXZhaWxhYmxlIGFuZCB3b3Jr aW5nIG9uIHRoZQogICAgICBuZXcgcmVwbGljYSB3aGljaCBydWxlcyBvdXQgdGhlIGxkYXAgY29u dGVudCBJIGd1ZXNzLjxicj4KICAgICAgSSB0aGVuIHJlaW5zdGFsbGVkIG15IHJlcGxpY2FzIGFu ZCBldmVyeXRoaW5nIGlzIHdvcmtpbmcgcHJvcGVybHkKICAgICAgbm93Ljxicj4KICAgICAgPGJy PgogICAgICBTbyBmaXhlZCwgYnV0IEkgc3RpbGwgZG9uJ3Qga25vdyB3aGF0IGhhcHBlbmVkIDov PC9wPgogICAgPHA+QmVzdCByZWdhcmRzPGJyPgogICAgPC9wPgogICAgPGRpdiBjbGFzcz0ibW96 LWNpdGUtcHJlZml4Ij5PbiA0LzEvMjQgMTY6NDYsIFJvYiBDcml0dGVuZGVuIHZpYQogICAgICBG cmVlSVBBLXVzZXJzIHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSIKICAgICAgY2l0ZT0ibWlkOjJlNDdhZjUyLWJmZDgtMjUxYS00NzM5LTU5MThhYmZmMDc1 Y0ByZWRoYXQuY29tIj4KICAgICAgPHByZSBjbGFzcz0ibW96LXF1b3RlLXByZSIgd3JhcD0iIj5B bnRvaW5lIEdhdGluZWF1IHZpYSBGcmVlSVBBLXVzZXJzIHdyb3RlOgo8L3ByZT4KICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgPHByZSBjbGFzcz0ibW96LXF1b3RlLXByZSIg d3JhcD0iIj5IZWxsbywKCkkgaGF2ZSBhIHN0cmFuZ2UgaXNzdWUgcmVnYXJkaW5nIGFjbWUgc2Vy dmljZS4KTXkgYWNtZSBjZXJ0aWZpY2F0ZXMgZmFpbCB0byByZW5ldy4gYGlwYS1hY21lLW1hbmFn ZSBzdGF0dXNgZmFpbHMgd2l0aAplcnJvcjoKRmFpbGVkIHRvIGF1dGhlbnRpY2F0ZSB0byBDQSBS RVNUIEFQSQpUaGUgaXBhLWFjbWUtbWFuYWdlIGNvbW1hbmQgZmFpbGVkLgoKY2VydGJvdCBjbGll bnQgZmFpbHMgd2l0aCBlcnJvciAiRmFpbGVkIHRvIHJlbmV3IGNlcnRpZmljYXRlCm9mZmljZS5l bXBpcmUubGFuIHdpdGggZXJyb3I6ICZsdDtSZXNwb25zZSBbNDA0XSZndDsiCgokIGlwYSBjZXJ0 LXNob3cgNDkKwqBJc3N1aW5nIENBOiBpcGEKwqBDZXJ0aWZpY2F0ZTogIlRoZSBjZXJ0aWZpY2F0 ZSBjb250ZW50IgrCoFN1YmplY3Q6IENOPW9mZmljZS5lbXBpcmUubGFuCsKgU3ViamVjdCBETlMg bmFtZTogb2ZmaWNlLmVtcGlyZS5sYW4KwqBJc3N1ZXI6IENOPUNlcnRpZmljYXRlIEF1dGhvcml0 eSxPPUVNUElSRS5MQU4KwqBOb3QgQmVmb3JlOiBTdW4gRGVjIDI0IDE0OjA1OjUwIDIwMjMgVVRD CsKgTm90IEFmdGVyOiBTYXQgTWFyIDIzIDE0OjA1OjUwIDIwMjQgVVRDCsKgU2VyaWFsIG51bWJl cjogNDkKwqBTZXJpYWwgbnVtYmVyIChoZXgpOiAweDMxCsKgUmV2b2tlZDogRmFsc2UKClNvIGxh c3Qgc3VjY2Vzc2Z1bCByZW5ld2FsIHdhcyBvbiBEZWMgMjR0aC4gU2luY2UgdGhlbiBJIGhhdmUg bm90IHJlYWxseQpkb25lIGFueXRoaW5nIGFwcGFydCB1cGRhdGluZy4KSSBkb24ndCBzZWUgYW55 IGlzc3VlIGluIGlwYXVwZ3JhZGUubG9nCgoKSSBhbSBydW5uaW5nIG9uIGNlbnRvcyBzdHJlYW0g OQppZG0tanNzLng4Nl82NMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAo1LjUuMC0x LmVsOQppZG0tanNzLXRvbWNhdC54ODZfNjTCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCjUuNS4wLTEuZWw5 CmlkbS1sZGFwamRrLm5vYXJjaMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKNS41LjAtMS5lbDkK aWRtLXBraS1hY21lLm5vYXJjaMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCjExLjUuMC0xLmVsOQpp ZG0tcGtpLWJhc2Uubm9hcmNowqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKMTEuNS4wLTEuZWw5Cmlk bS1wa2ktY2Eubm9hcmNowqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCjExLjUuMC0xLmVsOQpp ZG0tcGtpLWphdmEubm9hcmNowqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKMTEuNS4wLTEuZWw5Cmlk bS1wa2kta3JhLm5vYXJjaMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKMTEuNS4wLTEuZWw5Cmlk bS1wa2ktc2VydmVyLm5vYXJjaMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKMTEuNS4wLTEuZWw5CmlkbS1w a2ktdG9vbHMueDg2XzY0wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgCjExLjUuMC0xLmVsOQppcGEtY2xp ZW50Lng4Nl82NMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAo0LjExLjAtOS5lbDkKaXBhLWNs aWVudC1jb21tb24ubm9hcmNowqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAo0LjExLjAtOS5lbDkKaXBhLWNvbW1vbi5u b2FyY2jCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAKNC4xMS4wLTkuZWw5CmlwYS1oZWFsdGhj aGVjay5ub2FyY2jCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoAowLjE2LTIuZWw5CmlwYS1oZWFsdGhjaGVjay1j b3JlLm5vYXJjaMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqAKMC4xNi0yLmVsOQppcGEtc2VsaW51eC5ub2FyY2jCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgCjQuMTEuMC05LmVsOQppcGEtc2VydmVyLng4Nl82NMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoAo0LjExLjAtOS5lbDkKaXBhLXNlcnZlci1jb21tb24ubm9hcmNowqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoAo0LjExLjAtOS5lbDkKaXBhLXNlcnZlci1kbnMubm9hcmNowqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoAo0LjExLjAtOS5lbDkKCkkgaGF2ZSBmb2xsb3dlZCBjbG9zZWx5IHRoZSB1cGRhdGUg b24gY2VudG9zIHN0cmVhbSA5CgpSdW5uaW5nwqAgYGlwYS1hY21lLW1hbmFnZSBzdGF0dXNgIHdp dGggdGhlIC1kIHN3aXRjaCBnaXZlcyBtZQppcGFweXRob24uaXBhbGRhcDogREVCVUc6IHJldHJp ZXZpbmcgc2NoZW1hIGZvciBTY2hlbWFDYWNoZQp1cmw9PGEgY2xhc3M9Im1vei10eHQtbGluay1m cmVldGV4dCIgaHJlZj0ibGRhcGk6Ly8lMmZ2YXIlMmZydW4lMmZzbGFwZC1FTVBJUkUtTEFOLnNv Y2tldCI+bGRhcGk6Ly8lMmZ2YXIlMmZydW4lMmZzbGFwZC1FTVBJUkUtTEFOLnNvY2tldDwvYT4K Y29ubj0mbHQ7bGRhcC5sZGFwb2JqZWN0LlNpbXBsZUxEQVBPYmplY3Qgb2JqZWN0IGF0IDB4N2Yx MjNjMDdlMmUwJmd0OwppcGFzZXJ2ZXIubWFzdGVyczogREVCVUc6IERpc2NvdmVyeTogYXZhaWxh YmxlIHNlcnZlcnMgZm9yIHNlcnZpY2UgJ0NBJwphcmUgaXBhLXNlcnZlci0wMS5lbXBpcmUubGFu LCBpcGEtc2VydmVyLTAyLmVtcGlyZS5sYW4KaXBhc2VydmVyLm1hc3RlcnM6IERFQlVHOiBEaXNj b3Zlcnk6IHVzaW5nIGlwYS1zZXJ2ZXItMDEuZW1waXJlLmxhbiBmb3IKJ0NBJyBzZXJ2aWNlCmlw YXB5dGhvbi5kb2d0YWc6IERFQlVHOiByZXF1ZXN0IFBPU1QKPGEgY2xhc3M9Im1vei10eHQtbGlu ay1mcmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9pcGEtc2VydmVyLTAxLmVtcGlyZS5sYW46ODQ0My9h Y21lL2xvZ2luIj5odHRwczovL2lwYS1zZXJ2ZXItMDEuZW1waXJlLmxhbjo4NDQzL2FjbWUvbG9n aW48L2E+CmlwYXB5dGhvbi5kb2d0YWc6IERFQlVHOiByZXF1ZXN0IGJvZHkgJycKaXBhcHl0aG9u LmRvZ3RhZzogREVCVUc6IHJlc3BvbnNlIHN0YXR1cyA0MDQKaXBhcHl0aG9uLmRvZ3RhZzogREVC VUc6IHJlc3BvbnNlIGhlYWRlcnMgQ29udGVudC1UeXBlOgp0ZXh0L2h0bWw7Y2hhcnNldD11dGYt OApDb250ZW50LUxhbmd1YWdlOiBlbgpDb250ZW50LUxlbmd0aDogNzY1CkRhdGU6IFRodSwgMjgg TWFyIDIwMjQgMTA6MDA6NTkgR01UCgoKaXBhcHl0aG9uLmRvZ3RhZzogREVCVUc6IHJlc3BvbnNl IGJvZHkgKGRlY29kZWQpOiBiJyZsdDshZG9jdHlwZSBodG1sJmd0OyZsdDtodG1sCmxhbmc9ImVu IiZndDsmbHQ7aGVhZCZndDsmbHQ7dGl0bGUmZ3Q7SFRUUCBTdGF0dXMgNDA0IFx4ZTJceDgwXHg5 MyBOb3QKRm91bmQmbHQ7L3RpdGxlJmd0OyZsdDtzdHlsZSB0eXBlPSJ0ZXh0L2NzcyImZ3Q7Ym9k eQp7PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iZm9udC1mYW1pbHk6VGFo b21hLEFyaWFsLHNhbnMtc2VyaWYiPmZvbnQtZmFtaWx5OlRhaG9tYSxBcmlhbCxzYW5zLXNlcmlm PC9hPjt9IGgxLCBoMiwgaDMsIGIKezxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhy ZWY9ImNvbG9yOndoaXRlO2JhY2tncm91bmQtY29sb3I6IzUyNUQ3NiI+Y29sb3I6d2hpdGU7YmFj a2dyb3VuZC1jb2xvcjojNTI1RDc2PC9hPjt9IGgxIHs8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZy ZWV0ZXh0IiBocmVmPSJmb250LXNpemU6MjJweCI+Zm9udC1zaXplOjIycHg8L2E+O30gaDIKezxh IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImZvbnQtc2l6ZToxNnB4Ij5mb250 LXNpemU6MTZweDwvYT47fSBoMyB7PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJl Zj0iZm9udC1zaXplOjE0cHgiPmZvbnQtc2l6ZToxNHB4PC9hPjt9IHAgezxhIGNsYXNzPSJtb3ot dHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImZvbnQtc2l6ZToxMnB4Ij5mb250LXNpemU6MTJweDwv YT47fSBhCns8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJjb2xvcjpibGFj ayI+Y29sb3I6YmxhY2s8L2E+O30gLmxpbmUKezxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRl eHQiIGhyZWY9ImhlaWdodDoxcHg7YmFja2dyb3VuZC1jb2xvcjojNTI1RDc2O2JvcmRlcjpub25l Ij5oZWlnaHQ6MXB4O2JhY2tncm91bmQtY29sb3I6IzUyNUQ3Njtib3JkZXI6bm9uZTwvYT47fSZs dDsvc3R5bGUmZ3Q7Jmx0Oy9oZWFkJmd0OyZsdDtib2R5Jmd0OyZsdDtoMSZndDtIVFRQClN0YXR1 cyA0MDQgXHhlMlx4ODBceDkzIE5vdCBGb3VuZCZsdDsvaDEmZ3Q7Jmx0O2hyIGNsYXNzPSJsaW5l IiAvJmd0OyZsdDtwJmd0OyZsdDtiJmd0O1R5cGUmbHQ7L2ImZ3Q7ClN0YXR1cyBSZXBvcnQmbHQ7 L3AmZ3Q7Jmx0O3AmZ3Q7Jmx0O2ImZ3Q7TWVzc2FnZSZsdDsvYiZndDsgVGhlIHJlcXVlc3RlZCBy ZXNvdXJjZQpbJmFtcDsjNDc7YWNtZSZhbXA7IzQ3O2xvZ2luXSBpcyBub3QgYXZhaWxhYmxlJmx0 Oy9wJmd0OyZsdDtwJmd0OyZsdDtiJmd0O0Rlc2NyaXB0aW9uJmx0Oy9iJmd0OyBUaGUKb3JpZ2lu IHNlcnZlciBkaWQgbm90IGZpbmQgYSBjdXJyZW50IHJlcHJlc2VudGF0aW9uIGZvciB0aGUgdGFy Z2V0CnJlc291cmNlIG9yIGlzIG5vdCB3aWxsaW5nIHRvIGRpc2Nsb3NlIHRoYXQgb25lIGV4aXN0 cy4mbHQ7L3AmZ3Q7Jmx0O2hyCmNsYXNzPSJsaW5lIiAvJmd0OyZsdDtoMyZndDtBcGFjaGUgVG9t Y2F0LzkuMC42MiZsdDsvaDMmZ3Q7Jmx0Oy9ib2R5Jmd0OyZsdDsvaHRtbCZndDsnCmlwYXB5dGhv bi5hZG1pbnRvb2w6IERFQlVHOsKgwqAgRmlsZQoiL3Vzci9saWIvcHl0aG9uMy45L3NpdGUtcGFj a2FnZXMvaXBhcHl0aG9uL2FkbWludG9vbC5weSIsIGxpbmUgMTgwLCBpbgpleGVjdXRlCsKgwqDC oCByZXR1cm5fdmFsdWUgPSBzZWxmLnJ1bigpCsKgIEZpbGUKIi91c3IvbGliL3B5dGhvbjMuOS9z aXRlLXBhY2thZ2VzL2lwYXNlcnZlci9pbnN0YWxsL2lwYV9hY21lX21hbmFnZS5weSIsCmxpbmUg NDAzLCBpbiBydW4KwqDCoMKgIHdpdGggc3RhdGUgYXMgY2FfYXBpOgrCoCBGaWxlCiIvdXNyL2xp Yi9weXRob24zLjkvc2l0ZS1wYWNrYWdlcy9pcGFzZXJ2ZXIvaW5zdGFsbC9pcGFfYWNtZV9tYW5h Z2UucHkiLApsaW5lIDEwMywgaW4gX19lbnRlcl9fCsKgwqDCoCByYWlzZSBlcnJvcnMuUmVtb3Rl UmV0cmlldmVFcnJvcigKCmlwYXB5dGhvbi5hZG1pbnRvb2w6IERFQlVHOiBUaGUgaXBhLWFjbWUt bWFuYWdlIGNvbW1hbmQgZmFpbGVkLApleGNlcHRpb246IFJlbW90ZVJldHJpZXZlRXJyb3I6IEZh aWxlZCB0byBhdXRoZW50aWNhdGUgdG8gQ0EgUkVTVCBBUEkKaXBhcHl0aG9uLmFkbWludG9vbDog RVJST1I6IEZhaWxlZCB0byBhdXRoZW50aWNhdGUgdG8gQ0EgUkVTVCBBUEkKaXBhcHl0aG9uLmFk bWludG9vbDogRVJST1I6IFRoZSBpcGEtYWNtZS1tYW5hZ2UgY29tbWFuZCBmYWlsZWQuCgoKU28g aXQgbG9va3MgbGlrZSB0aGUgYWNtZSBzdWJzeXN0ZW0gaXMgbm90IHN0YXJ0ZWQuIEJ1dCBsb2dz IGZvciB0aGUKYWNtZSBzdWJzeXN0ZW0gaW4gL3Zhci9sb2cvcGtpL3BraS10b21jYXQvYWNtZS9k ZWJ1Zy4yMDI0LTAzLTI4LmxvZwpkb24ndCBzaG93IGFueSBpc3N1ZS4gKHNlZSBhdHRhY2hlZCBs b2cpCgpIb3cgY2FuIEkgZ28gZnVydGhlciBpbiB0cm91Ymxlc2hvb3RpbmcvZml4aW5nIHRoaXMg aXNzdWU/CjwvcHJlPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDxwcmUgY2xhc3M9Im1vei1x dW90ZS1wcmUiIHdyYXA9IiI+CkknZCBzdGFydCBieSB2ZXJpZnlpbmcgdGhhdCB5b3VyIENBIGlz IGZ1bmN0aW9uaW5nLiBTb21ldGhpbmcgbGlrZSBpcGEKY2VydC1maW5kLgoKU2luY2UgeW91IGdv dCBhIDQwNCAobm90IGZvdW5kKSBJJ2QgbWFrZSBzdXJlIHRoYXQKL2V0Yy9odHRwZC9jb25mLmQv aXBhLXBraS1wcm94eS5jb25mIGNvbnRhaW5zOgoKJmx0O0xvY2F0aW9uTWF0Y2ggIl4vYWNtZSIm Z3Q7Ci4uLgoKcm9iCi0tCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fCkZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxp bmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhv c3RlZC5vcmciPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8gdW5z dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlh dGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQu b3JnIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CkZlZG9y YSBDb2RlIG9mIENvbmR1Y3Q6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9 Imh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29u ZHVjdC8iPmh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUt b2YtY29uZHVjdC88L2E+Ckxpc3QgR3VpZGVsaW5lczogPGEgY2xhc3M9Im1vei10eHQtbGluay1m cmVldGV4dCIgaHJlZj0iaHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtpL01haWxpbmdfbGlz dF9ndWlkZWxpbmVzIj5odHRwczovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0 X2d1aWRlbGluZXM8L2E+Ckxpc3QgQXJjaGl2ZXM6IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJl ZXRleHQiIGhyZWY9Imh0dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9hcmNoaXZlcy9saXN0 L2ZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+aHR0cHM6Ly9saXN0cy5mZWRv cmFob3N0ZWQub3JnL2FyY2hpdmVzL2xpc3QvZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0 ZWQub3JnPC9hPgpEbyBub3QgcmVwbHkgdG8gc3BhbSwgcmVwb3J0IGl0OiA8YSBjbGFzcz0ibW96 LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJodHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFz dHJ1Y3R1cmUvbmV3X2lzc3VlIj5odHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFzdHJ1Y3R1 cmUvbmV3X2lzc3VlPC9hPgo8L3ByZT4KICAgIDwvYmxvY2txdW90ZT4KICA8L2JvZHk+CjwvaHRt bD4K --===============4420590048782926160==-- From rcritten at redhat.com Tue Apr 2 15:13:44 2024 Content-Type: multipart/mixed; boundary="===============5755514281049055257==" MIME-Version: 1.0 From: Rob Crittenden To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: ACME certs fail to renew Date: Tue, 02 Apr 2024 11:13:31 -0400 Message-ID: <6227664c-26a4-0128-5273-895135609bda@redhat.com> In-Reply-To: a642f913-a8d7-4b2f-b79e-13f391e5d8c2@infra-monkey.com --===============5755514281049055257== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Antoine Gatineau via FreeIPA-users wrote: > Hello Rob, > = > Thank you for replying quickly. > = > As far as I could see, the apache config is good. > All the 'ipa cert-*' and 'ipa ca-*' were working properly. > = > This only command not working was ipa-acme-manage (and the certbot renew > obviously). > = > I tried adding a replica and acme was available and working on the new > replica which rules out the ldap content I guess. > I then reinstalled my replicas and everything is working properly now. > = > So fixed, but I still don't know what happened :/ Yes, rather unsatisfying. But on the other hand I'm glad its working again for you. ipa-healthcheck might be something to look into. I think it would have alerted you to the issue earlier since ipa-acme-manage was failing. Thanks for following up. rob > = > Best regards > = > On 4/1/24 16:46, Rob Crittenden via FreeIPA-users wrote: >> Antoine Gatineau via FreeIPA-users wrote: >>> Hello, >>> >>> I have a strange issue regarding acme service. >>> My acme certificates fail to renew. `ipa-acme-manage status`fails with >>> error: >>> Failed to authenticate to CA REST API >>> The ipa-acme-manage command failed. >>> >>> certbot client fails with error "Failed to renew certificate >>> office.empire.lan with error: " >>> >>> $ ipa cert-show 49 >>> =C2=A0Issuing CA: ipa >>> =C2=A0Certificate: "The certificate content" >>> =C2=A0Subject: CN=3Doffice.empire.lan >>> =C2=A0Subject DNS name: office.empire.lan >>> =C2=A0Issuer: CN=3DCertificate Authority,O=3DEMPIRE.LAN >>> =C2=A0Not Before: Sun Dec 24 14:05:50 2023 UTC >>> =C2=A0Not After: Sat Mar 23 14:05:50 2024 UTC >>> =C2=A0Serial number: 49 >>> =C2=A0Serial number (hex): 0x31 >>> =C2=A0Revoked: False >>> >>> So last successful renewal was on Dec 24th. Since then I have not really >>> done anything appart updating. >>> I don't see any issue in ipaupgrade.log >>> >>> >>> I am running on centos stream 9 >>> idm-jss.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 5.5.0-1.el9 >>> idm-jss-tomcat.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 5.5.0-1.el9 >>> idm-ldapjdk.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 >>> 5.5.0-1.el9 >>> idm-pki-acme.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 >>> 11.5.0-1.el9 >>> idm-pki-base.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 >>> 11.5.0-1.el9 >>> idm-pki-ca.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 >>> 11.5.0-1.el9 >>> idm-pki-java.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 >>> 11.5.0-1.el9 >>> idm-pki-kra.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 >>> 11.5.0-1.el9 >>> idm-pki-server.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 11.5.0-1.el9 >>> idm-pki-tools.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 11.5.0-1.el9 >>> ipa-client.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 >>> 4.11.0-9.el9 >>> ipa-client-common.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 4.11.0-9.el9 >>> ipa-common.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 >>> 4.11.0-9.el9 >>> ipa-healthcheck.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 0.16-2.el9 >>> ipa-healthcheck-core.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 0.16-2.el9 >>> ipa-selinux.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 >>> 4.11.0-9.el9 >>> ipa-server.x86_64=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 >>> 4.11.0-9.el9 >>> ipa-server-common.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 4.11.0-9.el9 >>> ipa-server-dns.noarch=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 >>> 4.11.0-9.el9 >>> >>> I have followed closely the update on centos stream 9 >>> >>> Running=C2=A0 `ipa-acme-manage status` with the -d switch gives me >>> ipapython.ipaldap: DEBUG: retrieving schema for SchemaCache >>> url=3Dldapi://%2fvar%2frun%2fslapd-EMPIRE-LAN.socket >>> conn=3D >>> ipaserver.masters: DEBUG: Discovery: available servers for service 'CA' >>> are ipa-server-01.empire.lan, ipa-server-02.empire.lan >>> ipaserver.masters: DEBUG: Discovery: using ipa-server-01.empire.lan for >>> 'CA' service >>> ipapython.dogtag: DEBUG: request POST >>> https://ipa-server-01.empire.lan:8443/acme/login >>> ipapython.dogtag: DEBUG: request body '' >>> ipapython.dogtag: DEBUG: response status 404 >>> ipapython.dogtag: DEBUG: response headers Content-Type: >>> text/html;charset=3Dutf-8 >>> Content-Language: en >>> Content-Length: 765 >>> Date: Thu, 28 Mar 2024 10:00:59 GMT >>> >>> >>> ipapython.dogtag: DEBUG: response body (decoded): b'>> lang=3D"en">HTTP Status 404 \xe2\x80\x93 Not >>> Found=

HTTP >>> Status 404 \xe2\x80\x93 Not Found


Type >>> Status Report

Message The requested resource >>> [/acme/login] is not available

Description The >>> origin server did not find a current representation for the target >>> resource or is not willing to disclose that one exists.


>> class=3D"line" />

Apache Tomcat/9.0.62

' >>> ipapython.admintool: DEBUG:=C2=A0=C2=A0 File >>> "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in >>> execute >>> =C2=A0=C2=A0=C2=A0 return_value =3D self.run() >>> =C2=A0 File >>> "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", >>> line 403, in run >>> =C2=A0=C2=A0=C2=A0 with state as ca_api: >>> =C2=A0 File >>> "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", >>> line 103, in __enter__ >>> =C2=A0=C2=A0=C2=A0 raise errors.RemoteRetrieveError( >>> >>> ipapython.admintool: DEBUG: The ipa-acme-manage command failed, >>> exception: RemoteRetrieveError: Failed to authenticate to CA REST API >>> ipapython.admintool: ERROR: Failed to authenticate to CA REST API >>> ipapython.admintool: ERROR: The ipa-acme-manage command failed. >>> >>> >>> So it looks like the acme subsystem is not started. But logs for the >>> acme subsystem in /var/log/pki/pki-tomcat/acme/debug.2024-03-28.log >>> don't show any issue. (see attached log) >>> >>> How can I go further in troubleshooting/fixing this issue? >> I'd start by verifying that your CA is functioning. Something like ipa >> cert-find. >> >> Since you got a 404 (not found) I'd make sure that >> /etc/httpd/conf.d/ipa-pki-proxy.conf contains: >> >> >> ... >> >> rob >> -- >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted= .org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/cod= e-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-user= s(a)lists.fedorahosted.org >> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure= /new_issue > = > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/= new_issue >=20 --===============5755514281049055257==--