On 11/17/20 6:27 PM, Corey Devenport via FreeIPA-users wrote:
Update:
In using the command ipa-certupdate all of the IPA Servers have all the certs as
MONITORING, including the caSigningCert. However, the authentication problem persists,
and I still get the 403 cannot communicate with CMS when trying to perform cert
operations. From what I can tell this is caused by the IPA RA cert, and differences
between the LDAP and the cert on the servers, but I can't find any noticeable
difference.
Is there a way to request a new IPA RA cert? Or force an update so that both LDAP and the
servers have the same information?
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Hi,
you need first to identify the right RA cert to use. On all the servers,
check the content of /var/lib/ipa/ra-agent.pem, for instance with:
# openssl x509 -noout -text -in /var/lib/ipa/ra-agent.pem
The right one is likely to be the most recent one, i.e. the one with the
farther expiration date.
Then check if this certificate is stored in the entry
uid=ipara,ou=people,o=ipaca (run the check on all the servers, if the
replication is broken the entry may not have been updated everywhere):
# ldapsearch -LLL -o ldif-wrap=no -D "cn=directory\ manager" -W -b
uid=ipara,ou=people,o=ipaca dn usercertificate description
You should see the certificate blob from /var/lib/ipa/ra-agent.pem in
one of the attribute values for "usercertificate".
The final check is the description attribute. It needs to contain
something like:
description: 2;<serial>;<issuer>;<subject>
where serial, issuer and subject are the same values as in ra-agent.pem.
HTH,
flo