On 21/06/2023 09:02, Sam Morris via FreeIPA-users wrote:
On 20/06/2023 15:34, Sam Morris via FreeIPA-users wrote:
> I've got an IPA client on which certmonger is unable to renew a
> certificate.
>
> Here are the log messages from certmonger...
>
> 2023-06-20 08:24:49 [622035] Certificate submission attempt
> complete.
> 2023-06-20 08:24:49 [622035] Child status = 2.
> 2023-06-20 08:24:49 [622035] Child output:
> "Server at
https://ipa5.ipa.example.com/ipa/json denied our
> request, giving up: 2100 (Insufficient access: SASL(-1): generic
> failure: GSSAPI Error: Unspecified GSS failure. Minor code may
> provide more information (Credential cache is >
> "
> 2023-06-20 08:24:49 [622035] Server at
>
https://ipa5.ipa.example.com/ipa/json denied our request, giving up:
> 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error:
> Unspecified GSS failure. Minor code may provide more infor>
>
Today I restarted certmonger (in order to increase its debug level) and
the newly-started instance immediately resubmitted its request and was
issued with a new certificate. So I guess the problem was on the client
after all.
(Posting to complete the thread)
With hindsight this must be the same issue I reported a couple of months
later,
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...;,
which was ultimately fixed in <
https://pagure.io/freeipa/issue/9448>.
--
Sam Morris <
https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9