On Oct 5, 2018, at 3:36 PM, Israel Brewster via FreeIPA-users
<freeipa-users@lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>>
wrote:
I recently had the certificates I use on my FreeIPA server expire, preventing ipa from
starting. So I replaced them with the new ones, and IPA still wouldn't start,
whereupon after some digging I discovered the new certificates came with new Intermediate
and root certificates. So I installed those using ipa-cacert-manage, ran ipa-certupdate,
and then re-installed my certificates using ipa-server-certinstall, all of which appeared
to work. However, the IPA service still won't start, with the issue apparently being
that pki-tomcat isn't starting properly. Looking at the
/var/log/pki/pki-tomcat/ca/debug file shows that the reason for this is:
Internal Database Error encountered: Could not connect to LDAP server host
freeipaserver-a.ravnalaska.net<http://freeipaserver-a.ravnalaska.net/> port 636
Error netscape.ldap.LDAPException: Unable to create socket:
org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been marked as not
trusted by the user. (-1)
Ok, sounds simple enough, so how do I mark the Peer's certificate issuer as trusted?
Thanks.
Ok, I managed to get this working by manually adding the new root CA certificate to the
/etc/pki/pki-tomcat/alias database and marking it as trusted there. For good measure, I
went ahead and ran ipa-certupdate again, and rebooted, but everything seems to be working
now.
-----------------------------------------------
Israel Brewster
Systems Analyst II
5245 Airport Industrial Rd
Fairbanks, AK 99709
(907) 450-7293
-----------------------------------------------
-----------------------------------------------
Israel Brewster
Systems Analyst II
5245 Airport Industrial Rd
Fairbanks, AK 99709
(907) 450-7293
-----------------------------------------------
<image001.jpg>
<image002.jpg>
<Israel Brewster.vcf>_______________________________________________
FreeIPA-users mailing list --
freeipa-users@lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>
To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org>
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...