Is the sub-CA key present in the Dogtag NSSDB on ipa01?
To see the list of private keys, execute `certutil -d
/etc/pki/pki-tomcat/alias -K'. The password is the value of
'internal=' in /etc/pki/pki-tomcat/password.conf.
Cheers,
Fraser
On Tue, Sep 17, 2019 at 06:46:37PM -0000, Ben Rawson via FreeIPA-users wrote:
> I've been able to trace this failure back to ipa-custodia on ipa01. the
pki-tomcat/ca/debug log on ipa02 shows:
>
> [17/Sep/2019:18:28:35][KeyRetrieverRunner-b06485e9-c2bb-4ccf-8023-0bf93c32b94b]:
About to execute command: [/usr/libexec/ipa/ipa-pki-retrieve-key, caSigningCert
cert-pki-ca b06485e9-c2bb-4ccf-8023-0bf93c32b94b,
ipa01.yyy.com]
> [17/Sep/2019:18:28:35][KeyRetrieverRunner-b06485e9-c2bb-4ccf-8023-0bf93c32b94b]:
Failed to retrieve key from any host.
> [17/Sep/2019:18:28:35][KeyRetrieverRunner-b06485e9-c2bb-4ccf-8023-0bf93c32b94b]:
KeyRetriever did not return a result.
> [17/Sep/2019:18:28:35][KeyRetrieverRunner-b06485e9-c2bb-4ccf-8023-0bf93c32b94b]:
Retrying in 168338 seconds
>
> The apache access log on ipa01 shows a 404:
> "GET
/ipa/keys/ca_wrapped/caSigningCert%20cert-pki-ca%20b06485e9-c2bb-4ccf-8023-0bf93c32b?.............
HTTP/1.1" 404 190
>
> And then I see a denial in /var/log/ipa-custodia.audit.log:
> 2019-09-17 17:58:54 - SimpleCredsAuth-[auth:simple] - PASS: '4289'
authenticated as '48, 48'
> 2019-09-17 17:58:54 - SimpleHeaderAuth-[auth:header] - PASS: '4289'
authenticated as '(null)'
> 2019-09-17 17:58:54 - IPAKEMKeys-[authz:kemkeys] - PASS: '4289'
authorized for '/keys'
> 2019-09-17 17:58:55 - Secrets-[/keys] - DENIED: '(null)'
requested key 'ca_wrapped/caSigningCert cert-pki-ca
b06485e9-c2bb-4ccf-8023-0bf93c32b'
>
> The other keys are being allowed by custodia:
> 2018-01-24 18:18:31 - SimpleCredsAuth-[auth:simple] - PASS: '15417'
authenticated as '48, 48'
> 2018-01-24 18:18:31 - SimpleHeaderAuth-[auth:header] - PASS: '15417'
authenticated as '(null)'
> 2018-01-24 18:18:31 - IPAKEMKeys-[authz:kemkeys] - PASS: '15417'
authorized for '/keys'
> 2018-01-24 18:18:31 - Secrets-[/keys] - ALLOWED: '(null)'
requested key 'ca/caSigningCert cert-pki-ca'
>
> Any thoughts on why the ca_wrapped request for the intermediate cert is being
denied?
> I did restart ipa-custodia on ipa01 without any effect.
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...