Hi FreeIPA,
I am currently using FreeIPA version 4.9.10 with 6 ipareaplicas. I went to upgrade the
server to 4.9.11 but the ipa-server-upgrade failed where it attempted to start pki-tomcat.
In the /var/log/pki/pki-tomcat/ca/debug.log I see:
Unable to connect to LDAP server: Unable to create socket: java.net.ConnectException:
Connection refused (Connection refused)
…
At netscape.ldap.LDAPConnection(Uknown Source)
Unable to start CA engine: Unable to connect to LDAP server: Unable to create socket:
java.net.ConnectionExection: Connection refused (Connection refused)
….
I've been through the guide
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
where I can confirm the /etc/pki/pki-tomcat/ca/CS.cfg is using:
internaldb.ldapauth.authtype=SslClientAuth
internaldb.ldapauth.bindDN=cn=Directory Manager
internaldb.ldapauth.bindPWPrompt=internaldb
internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca
internaldb.ldapconn.host=<servername>
internaldb.ldapconn.port=636
internaldb.ldapconn.secureConn=true
certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' shows the
cert with the correct Serial number and the cert does not expire until next year.
If I read the private key, I have checked the Nickname is correct and does work on another
ipareplica but not the one I'm troubleshooting.
grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 >
/tmp/pwdfile.txt
certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert
cert-pki-ca'
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key
and Certificate Services"
certutil: problem listing keys: SEC_ERROR_INVALID_ARGS: security library: invalid
arguments.
The ldap server configuration looks to be using the correct certificate.
I rolled back the server to my last known working server, and find that commands such as
ipa cert-find work fine, all my replicas have the same cert, but the command certutil -K
-d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca'
fails on 4 out of 6 ipareplicas. 2 replicas see the correct result.
Could any one help point me to how I might resolve this issue?
Many Thanks,
Tania