Don't know if this is related, but I found somewhere that this should
work, but it does not:
[root@ipa2 slapd-PLEIADES-UNI-WUPPERTAL-DE]# ipa-pkinit-manage enable
Configuring Kerberos KDC (krb5kdc)
[1/1]: installing X509 Certificate for PKINIT
PKINIT certificate request failed: Certificate issuance failed
(CA_REJECTED: Server at
"https://ipa2.pleiades.uni-wuppertal.de:8443/ca/ee/ca/profileSubmitSSLClient"
replied: Profile KDCs_PKINIT_Certs Not Found)
Failed to configure PKINIT
Full PKINIT configuration did not succeed
The setup will only install bits essential to the server functionality
You can enable PKINIT after the setup completed using 'ipa-pkinit-manage'
Done configuring Kerberos KDC (krb5kdc).
The ipa-pkinit-manage command was successful
[root@ipa2 slapd-PLEIADES-UNI-WUPPERTAL-DE]# ipa-pkinit-manage status
PKINIT is disabled
The ipa-pkinit-manage command was successful
[root@ipa2 slapd-PLEIADES-UNI-WUPPERTAL-DE]#
[root@ipa2 slapd-PLEIADES-UNI-WUPPERTAL-DE]# ipa config-show|grep -i pkinit
IPA master capable of PKINIT: ipa2.pleiades.uni-wuppertal.de
but
[root@ipa2 slapd-PLEIADES-UNI-WUPPERTAL-DE]# ipa pkinit-status
-----------------
2 servers matched
-----------------
Servername: ipa.pleiades.uni-wuppertal.de
PKINIT status: disabled
Servername: ipa2.pleiades.uni-wuppertal.de
PKINIT status: enabled
-------------------------------------
Anzahl der zurückgegebenen Einträge 2
-------------------------------------
[root@ipa2 slapd-PLEIADES-UNI-WUPPERTAL-DE]#
(which is probably ok, since ipa is still on 4.4)
Hope someone has an idea.. I googled for hours already but couldn't find
anything that helps.
Kind regards
Torsten
--
Dr. Torsten Harenberg harenberg(a)physik.uni-wuppertal.de
Bergische Universitaet
Fakultät 4 - Physik Tel.: +49 (0)202 439-3521
Gaussstr. 20 Fax : +49 (0)202 439-2811
42097 Wuppertal