Corey Devenport via FreeIPA-users wrote:
> Corey Devenport via FreeIPA-users wrote:
>
> I'm pretty sure this is expected to be single-valued. The
> usercertificate should be ok being multi-valued.
>
So should I delete one of the descriptions from LDAP? Then the question is which one,
the ipa servers seem to all have the 805175304 description, so should I remove the
804978693 description?
I have tried editing the ra-agent.pem to use the other cert associated with the other
certificate, but this doesn't seem to change anything
You'd want to keep the most recently issued. This is likely the highest
serial number.
>
> It's a separate package not installed by default.
>
> rob
I was able to install ipa-healthcheck, and running it gave the same ole error of not
being able to communicate with CMS:
Loading instance: pki-tomcat
Loading global Tomcat config: /etc/tomcat/tomcat.conf
Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf
Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf
Loading password config: /etc/pki/pki-tomcat/password.conf
Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat
Loading subsystem: ca
Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg
Getting sslserver cert info for ca from CS.cfg
Getting subsystem cert info for ca from CS.cfg
Getting audit_signing cert info for ca from CS.cfg
Getting ocsp_signing cert info for ca from CS.cfg
Getting signing cert info for ca from CS.cfg
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
ra.get_certificate(): Unable to communicate with CMS (403)
Unhandler rdtype 28
Unhandler rdtype 28
Unhandler rdtype 28
And nothing else? It should at least report the failures as well as
other information.
rob