Hi Rob,

Often people make backups of the databases. Have you looked to see if
> they exist?

>Given you have no RA agent cert (ipaCert) IPA has no way to talk to your
>existing dogtag CA. I'd start with a hunt for backups. There may be a
>way to force dogtag to generate a new on, I'd cc'd one of the dogtag
>devs to see if he has ever done something like that.

Unfortunately, there is no backup available for the database.

I don't know what advantage that would have over whatever certs you are
> using now. I don't know what problem you think this is going to solve.

As mentioned before, we are using third party signed SSL certificate and it is about to expire in a week. We do not plan to renew the certificate and hence thought of switching back to Dogtag/IPA issues certs.

On Fri, Apr 6, 2018 at 1:02 AM, Rob Crittenden <rcritten@redhat.com> wrote:
Alka Murali wrote:
> Hi Rob,
>
> I can see that the certs with nickname 'Server-Cert' doesn't exist on my
> server for HTTP/LDAP. Hence, I believe, it is not possible apply the
> changes to the des.ldif and nss configuration.

Often people make backups of the databases. Have you looked to see if
they exist?

Given you have no RA agent cert (ipaCert) IPA has no way to talk to your
existing dogtag CA. I'd start with a hunt for backups. There may be a
way to force dogtag to generate a new on, I'd cc'd one of the dogtag
devs to see if he has ever done something like that.

>
> Is it possible for me to install the certs, by generating the Dogtag
> certs using the steps in the link below:
>
> ----
> https://floblanc.wordpress.com/2016/09/02/using-a-dogtag-instance-as-external-ca-for-free-ipa-installation/
> ----
>
> Once, the dogtag certs and CA is generated, shall I install them over
> the current certs using "ipa-cacert-manage" and "ipa-server-certinstall"
> commands. Is that possible?

I don't know what advantage that would have over whatever certs you are
using now. I don't know what problem you think this is going to solve.

rob

>
> On Wed, Apr 4, 2018 at 11:08 PM, Rob Crittenden <rcritten@redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
>     Alka Murali wrote:
>     > Hi Rob,
>     >
>     > I am planning to revert my existing third party SSL certs for HTTP and
>     > LDAP Services back to CertMonger cert. Is there any way to revert the
>     > certs back to CertMonger certs.
>
>     Are you sure the certs exist and are valid?
>
>     There is no automated way to do it. Assuming the certs are still in
>     their respective NSS databases you would:
>
>     - change the NSSNickname in /etc/httpd/conf.d/nss.conf to Server-Cert
>     and restart the httpd process.
>     - stop dirsrv@EXAMPLE-COM, edit /etc/dirsrv/slapd-EXAMPLE-COM/dse.ldif
>     and set nsSSLPersonalitySSL to Server-Cert in dn:
>     cn=RSA,cn=encryption,cn=config then restart dirsrv@EXAMPLE-COM
>
>     rob
>
>     >
>     > Awaiting your response.
>     >
>     > On Tue, Apr 3, 2018 at 9:56 AM, Alka Murali <alkamuralimolu@gmail.com <mailto:alkamuralimolu@gmail.com>
>     > <mailto:alkamuralimolu@gmail.com
>     <mailto:alkamuralimolu@gmail.com>>> wrote:
>     >
>     >     Hi Rob,
>     >
>     >     Thanks for your reply. 
>     >
>     >     >> Sure. We'd need to know what version of IPA you have.
>     >
>     >     My FreeIPA Server is running on Version 4.4
>     >
>     >     Here is the result of the command "getcert list -d
>     >     /etc/dirsrv/slapd-YOUR-REALM -n Server-Cert" for my FreeIPA
>     Server:
>     >
>     >     -----
>     >
>     >     Number of certificates and requests being tracked: 7.
>     >
>     >     Request ID '20170622062025':
>     >
>     >     status: CA_UNCONFIGURED
>     >
>     >     ca-error: Unable to determine principal name for signing request.
>     >
>     >     stuck: yes
>     >
>     >     key pair storage:
>     >   
>      type=NSSDB,location='/etc/dirsrv/slapd-*-*-*',nickname='Server-Cert',token='NSS
>     >     Certificate DB',pinfile='/etc/dirsrv/slapd-*-*-*/pwdfile.txt'
>     >
>     >     certificate:
>     >   
>      type=NSSDB,location='/etc/dirsrv/slapd-*-*-*',nickname='Server-Cert'
>     >
>     >     CA: IPA
>     >
>     >     issuer: 
>     >
>     >     subject: 
>     >
>     >     expires: unknown
>     >
>     >     pre-save command: 
>     >
>     >     post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
>     *-*-*
>     >
>     >     track: yes
>     >
>     >     auto-renew: yes
>     >
>     >     ----------
>     >
>     >     Several months before, I have installed the third party SSL for
>     >     HTTP/LDAP services using the link below:
>     >
>     >     ----
>     >   
>      https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
>     <https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP>
>     >   
>      <https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
>     <https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP>>
>     >     ----
>     >
>     >     Please let me know if there is any abnormality in the current SSL
>     >     installation. Also kindly provide me the steps to use Third party
>     >     SSL for HTTP and Certmonger cert for LDAP.
>     >
>     >     On Mon, Apr 2, 2018 at 10:18 PM, Rob Crittenden
>     <rcritten@redhat.com <mailto:rcritten@redhat.com>
>     >     <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote:
>     >
>     >         Alka Murali via FreeIPA-users wrote:
>     >         > Hello Team,
>     >         >
>     >         > Right now, I am using third party SSL for both HTTP and
>     LDAP services.
>     >         > However I would like to know if there is any way to use
>     third party SSL
>     >         > for HTTP alone and certmonger SSL for LDAP services.
>     >
>     >         Sure. We'd need to know what version of IPA you have.
>     There may
>     >         already
>     >         be a certmonger-tracked cert. To see if there is and the
>     status run:
>     >
>     >         # getcert list -d /etc/dirsrv/slapd-YOUR-REALM -n Server-Cert
>     >
>     >         rob
>     >
>     >
>     >
>     >
>     >     --
>     >     Regards,
>     >     Alka Murali
>     >
>     >
>     >
>     >
>     > --
>     > Regards,
>     > Alka Murali
>
>
>
>
> --
> Regards,
> Alka Murali




--
Regards,
Alka Murali