John Dennis via FreeIPA-users wrote:
> On 10/12/2017 05:06 PM, Bhavin Vaidya wrote:
>> Hello Jon,
>>
>>
>> thank you for your help. responded to main thread, and just sending
>> you the actual output for certutil.
>>
>>
>> [root@ds01 log]#  certutil -d /etc/pki/nssdb -L
>>
>> Certificate Nickname                                         Trust
>> Attributes
>>
>>   SSL,S/MIME,JAR/XPI
>>
>> ARTERIS.COM IPA CA                                           CT,C,C
>> ARTERIS.COM IPA CA                                           CT,C,C
>> ARTERIS.COM IPA CA                                           CT,C,C
>> ARTERIS.COM IPA CA                                           CT,C,C
>
> These nicknames do not look unique to me, I'm assuming you're still
> editing them for inclusion in this email.
>
> But irregardless here is where I'm going with this. Your goal is to
> identify the correct cert to use and which to discard. The only way you
> can do that is to examine each individual cert. To examine an individual
> cert you must have it's *unique* nickname to pass to "certutil -L -a -n
> xxx" where xxx is the unique nickname.
>
> Only you can identify the correct cert once you list them. At the
> absolute minimum they should each have a unique (issuer,serial_number)
> pair. The one you want to use will probably select based on the issuer
> and validity dates.

This is how NSS handles multiple copies of the same certificate subject
in a given database.

My assumption is that the CA was renewed multiple times.

This should get you the PEM-encoded copies of the certs:

# certutil -D -d /etc/pki/nssdb -n "ARTERIS.COM IPA CA" -a

rob

>
>>
>> ------------------------------------------------------------------------
>> *From:* John Dennis <jdennis@redhat.com>
>> *Sent:* Thursday, October 12, 2017 6:10 AM
>> *To:* FreeIPA users list
>> *Cc:* Bhavin Vaidya; Rob Crittenden
>> *Subject:* Re: [Freeipa-users] Re: several IPA CA certificate entries
>> On 10/12/2017 03:29 AM, Rob Crittenden via FreeIPA-users wrote:
>>> Bhavin Vaidya via FreeIPA-users wrote:
>>>> Hello,
>>>>
>>>>
>>>> I'm having various problem on our FreeIPA setup, like can not establish
>>>> new replica server or add a client anymore. Initially we had
>>>> certificate
>>>> issue, then we upgraded the Master FreeIPA server (CentOS 7.0.146) to
>>>> FreeIPA v4.4.0) few months back.
>>>>
>>>>
>>>> On master server it shows up 4 entries for IPA CA certificate. Is this
>>>> normal?
>>>>
>>>>
>>>> [root@ds01 ~]# certutil -d /etc/pki/nssdb -L
>>>>
>>>> Certificate Nickname                                         Trust
>>>> Attributes
>>>>
>>>>         SSL,S/MIME,JAR/XPI
>>>>
>>>> EXAMPLE.COM IPA CA                                           CT,C,C
>>>> EXAMPLE.COM IPA CA                                           CT,C,C
>>>> EXAMPLE.COM IPA CA                                           CT,C,C
>>>> EXAMPLE.COM IPA CA                                           CT,C,C
>>>
>>> The question is: are these all different certificates (and why)? I
>>> assume someone ran ipa-cacert-manage renew a bunch of times.
>>>
>>> Multiple entries in itself shouldn't be a problem.
>>>
>>> I assume this is related to your client install issues. You may be
>>> able to get away with having just the latest CA cert stored in LDAP
>>> to avoid this.
>>
>> I saw this last night and my first thought was this shouldn't happen
>> because certutil enforces nickname uniqueness.
>>
>> We would like to verify what each cert is, specifically it's issuer and
>> serial number. But we can't ask certutil to show us the details of a
>> cert because you must pass the -n nickname flag to certutil so it can
>> find the cert to display. But since the nicknames are not unique you
>> can't do that. This is why certutil (and any low level NSS API that adds
>> a cert to the db) demands name uniqueness.
>>
>> Are the names listed with -L truly unique? It looks like you edited them.
>>
>>
>> --
>> John
>
>