On 1/16/20 12:26 AM, Ferdinand Babas via FreeIPA-users wrote: Hi, the cert is present but its private key is missing. It looks like you lost many of the private keys on that node, do you have a backup somewhere of the NSS database? Otherwise, the private key may be present on other nodes and can be recovered from them using the export and import commands I provided earlier (pk12util).
flo
Hi flo,
No backup but I was able to export and import the ipaCert from another node and pki-tomcatd starts up now when back dated.
When I stop and start certmonger and run getcert list I get the following errors for a couple of certs:
ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation
The above error is reported for:
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
and
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
But when I run the following everything checks out:
# grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -f /tmp/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 48f4a4...2c126e subsystemCert cert-pki-ca # certutil -K -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -f /tmp/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 7b55ea...d259f7 auditSigningCert cert-pki-ca
Things seem to checkout. I'm unsure what I should do next, I appreciate all the tips and help you've been providing.
Thanks,
Ferdinand