From flo at redhat.com Tue Jan 28 13:58:10 2020 Content-Type: multipart/mixed; boundary="===============1782134403095444559==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: pki-tomcat doesn't start, it can't update certificate Date: Tue, 28 Jan 2020 14:57:30 +0100 Message-ID: <2f53e45e-2a91-3ae9-0084-eaf7b7192043@redhat.com> In-Reply-To: 20200128123529.9740.74440@mailman01.phx2.fedoraproject.org --===============1782134403095444559== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 1/28/20 1:35 PM, Serge Barkov via FreeIPA-users wrote: > I have a freeipa with two nodes. I have no problem with one of them but o= n the other one pki-tomcat can't start. > ipacts starts with --ignore-service-failure > and > pki-tomcatd Service: STOPPED > = > The first thing I found a certificate expired and I changed date back in = time before expiration date. ipa-cacert-manage renew says ok but certificat= e for pki-tomcat doesn't work. Hi, "ipa-cacert-manage renew" is used to renew IPA CA certificate, but in = your case the expired cert is probably a different one. On the working node, are all the certificates valid? On the non-working node, which certificate is expired? Please provide = the whole output of getcert list for both nodes, and the output of $ ipa config-show | grep "CA renewal" Debugging tips can also be found in this blog post: = https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca= td-fails-to-start/ flo > = > getcert list shows all certificates are well but this one no: > Request ID '20171110140549': > status: CA_UNREACHABLE > ca-error: Error 60 connecting to https://ipa0.domain.com:8443/ca= /agent/ca/profileReview: Peer certificate cannot be authenticated with give= n CA certificates. > stuck: no > key pair storage: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/a= lias',nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS Certificate DB',pin= set > certificate: type=3DNSSDB,location=3D'/etc/pki/pki-tomcat/alias'= ,nickname=3D'Server-Cert cert-pki-ca',token=3D'NSS Certificate DB' > CA: dogtag-ipa-renew-agent > issuer: CN=3DCertificate Authority,O=3DDOMAIN.COM > subject: CN=3Dipa0.domain.com,O=3DDOMAIN.COM > expires: 2019-10-31 14:05:23 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataE= ncipherment > eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Se= rver-Cert cert-pki-ca" > track: yes > auto-renew: yes > = > [root(a)ipa0 pki-tomcat]# curl https://ipa0.domain.com:8443/ca/agent/ca/p= rofileReview > = > Apache Tomcat/8.0.46 - Error report</ti= tle><style type=3D"text/css">H1 {font-family:Tahoma,Arial,sans-serif;color:= white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Aria= l,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font= -family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-s= ize:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background= -color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;backgroun= d-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;c= olor:black;font-size:12px;}A {color : black;}A.name {color : black;}.line {= height: 1px; background-color: #525D76; border: none;}</style> </head><body= ><h1>HTTP Status 404 - /ca/agent/ca/profileReview</h1><div class=3D"line"><= /div><p><b>type</b> Status report</p><p><b>message</b> <u>/ca/agent/ca/prof= ileReview</u></p><p><b>description</b> <u>The requested resource is not ava= ilable.</u></p><hr class=3D"lin > e"><h3>Apache Tomcat/8.0.46</h3></bod > = > What can I do to make pki-tomcat work? How to repair the certificate? > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code= -of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users= (a)lists.fedorahosted.org > = --===============1782134403095444559==--