On Oct 5, 2018, at 3:36 PM, Israel Brewster via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>
> I recently had the certificates I use on my FreeIPA server expire,
> preventing ipa from starting. So I replaced them with the new ones,
> and IPA still wouldn't start, whereupon after some digging I
> discovered the new certificates came with new Intermediate and root
> certificates. So I installed those using ipa-cacert-manage, ran
> ipa-certupdate, and then re-installed my certificates
> using ipa-server-certinstall, all of which appeared to work. However,
> the IPA service still won't start, with the issue apparently being
> that pki-tomcat isn't starting properly. Looking at
> the /var/log/pki/pki-tomcat/ca/debug file shows that the reason for
> this is:
>
> Internal Database Error encountered: Could not connect to LDAP server
> host
freeipaserver-a.ravnalaska.net
> <
http://freeipaserver-a.ravnalaska.net/> port 636 Error
> netscape.ldap.LDAPException: Unable to create socket:
> org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
> SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been
> marked as not trusted by the user. (-1)
>
> Ok, sounds simple enough, so how do I mark the Peer's certificate
> issuer as trusted? Thanks.
Ok, I managed to get this working by manually adding the new root CA
certificate to the /etc/pki/pki-tomcat/alias database and marking it as
trusted there. For good measure, I went ahead and ran ipa-certupdate
again, and rebooted, but everything seems to be working now.
Ok cool, that's what I was going to suggest. I just didn't want to point
in in the wrong direction. Glad you're up and running again.
rob