On 7/10/19 1:46 PM, Harald Dunkel via FreeIPA-users wrote:
Hi folks,
Setup: ipa-server 4.6.4-7 on CentOS 7
Problem:
ipa host-del gives me
[root@ipa1 ~]# ipa host-del
ppcl027.example.com
ipa: ERROR: Certificate operation cannot be completed: Unable to
communicate with CMS (404)
Google pointed me to
https://access.redhat.com/solutions/3624671,
but AFAICS this fix is not applicable. "^/ca/rest/certs/search" is
already in
:
# matches for CA REST API
<LocationMatch
"^/ca/rest/account/login|^/ca/rest/account/logout|^/ca/rest/installer/installToken|^/ca/rest/securityDomain/domainInfo|^/ca/rest/securityDomain/installToken|^/ca/rest/profiles|^/ca/rest/authorities|^/ca/rest/certrequests|^/ca/rest/admin/kraconnector/remove|^/ca/rest/certs/search">
NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
NSSVerifyClient optional
ProxyPassMatch ajp://localhost:8009
ProxyPassReverse ajp://localhost:8009
</LocationMatch>
:
?
Every helpful comment is highly appreciated
Harri
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Hi,
the issue seems rather to be between IPA framework and dogtag. Is the CA
subsystem enabled?
$ pki-server subsystem-show ca
should display "Enabled: True"
The subsystem logs may show more information:
/var/log/pki/pki-tomcat/ca/debug
I would start by checking if the "subsystemCert cert-pki-ca"
certificate is still valid and consistent in the NSSDB and in ldap:
$ certutil -L -d /etc/pki/pki-tomcat/alias/ -n 'subsystemCert
cert-pki-ca' | grep "Not After"
=> check the date
$ certutil -L -d /etc/pki/pki-tomcat/alias/ -n 'subsystemCert
cert-pki-ca' -a
$ ldapsearch -D cn=directory\ manager -W -b o=ipaca uid=pkidbuser
userCertificate
Both commands should return the same content for the certificate
HTH,
flo