Hi, list,
I replace http and dirsrv with the 3rd SSL certificated signed by
Comodo, whose Root and intermediate certs are 3 files. Below is my
step.
1. remove ALL certs against httpd and dirsrv, I'll write httpd only and skip dirsrv.
# And I also removed /etc/pki/nssdb by the same way.
certutil -D -d /etc/http/alias -n 'XXX'
certutil -F -d /etc/http/alias -n 'xxxx'
2. import ca bundle.( 3 files provided by Comodo.)
certutil -A -d /etc/http/alias -n 'xxx.com IPA CA' -t CT,C,C -a -i ca-bundle.crt
3. import server key and cert.
cat server.key server.crt > server.all
# convert it to p12.
openssl pkcs12 -export -chain -CAfile ca-bundle.crt -in server.all -out Server-Cert.p12
-name "Server-Cert"
pk12util -i Server-Cert.p12 -d /etc/httpd/alias/ -n Server-Cert
I repeat it again for dirsrv. and did Nothing against /etc/pki/nssdb.
Here are certs for httpd and dirsrv, I skip dirsrv as it's the same as httpd's.
# certutil -d /etc/httpd/alias/ -L
xxx.com IPA CA CT,C,C
Server-Cert u,u,u
COMODO RSA Organization Validation Secure Server CA - COMODO CA Limited ,,
COMODO RSA Certification Authority - AddTrust AB ,,
Here are certs for pki-tomcat, 3 ca bundle file don't exist, I added it by certutil.
###############################
Server-Cert cert-pki-ca u,u,u
auditSigningCert cert-pki-ca u,u,Pu
caSigningCert cert-pki-ca CTu,Cu,Cu
xxx.com IPA CA CT,C,C
COMODO RSA Organization Validation Secure Server CA - COMODO CA Limited CT,C,C
ocspSigningCert cert-pki-ca u,u,u
subsystemCert cert-pki-ca u,u,u
COMODO RSA Certification Authority - AddTrust AB CT,C,C
Last, I restart service by ` ipactl restart', pki-tomcat fails to start. Below is the
debug log.
[26/Apr/2019:14:19:18][localhost-startStop-1]: SSLClientCertificateSelectionCB: Setting
desired cert nickname to: subsystemCert cert-pki-ca
[26/Apr/2019:14:19:18][localhost-startStop-1]: LdapJssSSLSocket: set client auth cert
nickname subsystemCert cert-pki-ca
[26/Apr/2019:14:19:18][localhost-startStop-1]: SSLClientCertificatSelectionCB: Entering!
[26/Apr/2019:14:19:18][localhost-startStop-1]: SSLClientCertificateSelectionCB: returning:
null
[26/Apr/2019:14:19:18][localhost-startStop-1]: SSL handshake happened
######### I added it on purpose ###########
Could not connect to LDAP server host wocfreeipa.sap.wingon.hk port 636
Error netscape.ldap.LDAPException: Authentication failed (48)
I search a post
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
and read it carefully, but turns out it has nothing to do with it.
So can someone offer me an idea? thanks.
Why didn't you use
ipa-server-certinstall instead of this manual
process? See man page for ipa-server-certinstall for details.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland