On 7 Jun 2017, at 14:39, Roberto Cornacchia via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:Things are getting worse.First, the version I reported before was incorrect (taken from a client). Here's the server one.$ ipa --versionVERSION: 4.2.4, API_VERSION: 2.156I did a dnf update (Fedora 23). The IPA upgrade failed.I tried running it again, manually, after a reboot:$ ipa-server-upgradesession memcached servers not runningUpgrading IPA:[1/8]: saving configuration[2/8]: disabling listeners[3/8]: enabling DS global lock[4/8]: starting directory server[5/8]: updating schema[6/8]: upgrading serverAdd failure attribute "cn" not allowed[7/8]: stopping directory server[8/8]: restoring configurationDone.Update completeUpgrading IPA servicesUpgrading the configuration of the IPA services[Verifying that root certificate is published][Migrate CRL publish directory]CRL tree already moved[Verifying that CA proxy configuration is correct][Verifying that KDC configuration is using ipa-kdb backend][Fix DS schema file syntax]Syntax already fixed[Removing RA cert from DS NSS database]RA cert already removed[Enable sidgen and extdom plugins by default][Updating mod_nss protocol versions]Protocol versions already updated[Fixing trust flags in /etc/httpd/alias]Trust flags already processed[Exporting KRA agent PEM file]KRA is not enabledIPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.Unexpected error - see /var/log/ipaupgrade.log for details:CalledProcessError: Command ''/bin/systemctl' 'start' 'httpd.service'' returned non-zero exit status 1The ipaupgrade log only says that starting httpd failed.HTTPD log says:[Wed Jun 07 14:32:26.822478 2017] [core:notice] [pid 3182] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0[Wed Jun 07 14:32:26.823122 2017] [suexec:notice] [pid 3182] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)[Wed Jun 07 14:32:26.823467 2017] [:warn] [pid 3182] NSSSessionCacheTimeout is deprecated. Ignoring.[Wed Jun 07 14:32:26.913923 2017] [:error] [pid 3182] SSL Library Error: -8181 Certificate has expired[Wed Jun 07 14:32:26.913942 2017] [:error] [pid 3182] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.Any suggestion?_______________________________________________On Wed, 7 Jun 2017 at 13:17 Roberto Cornacchia <roberto.cornacchia@gmail.com> wrote:Not being able to login to the admin console, I checked the httpd log and found the following errors:[Wed Jun 07 12:50:59.352022 2017] [:error] [pid 10240] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.[Wed Jun 07 12:50:59.353372 2017] [:error] [pid 10237] SSL Library Error: -8181 Certificate has expired[Wed Jun 07 12:50:59.353395 2017] [:error] [pid 10237] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.[Wed Jun 07 12:50:59.986025 2017] [core:error] [pid 11522] AH00546: no record of generation 47 of exiting child 10203I also get an error during enrollment of a new client (which seems to retrieve a valid certificate anyway):Password for admin@HQ.SPINQUE.COM:Successfully retrieved CA certSubject: CN=Certificate Authority,O=HQ.SPINQUE.COMIssuer: CN=Certificate Authority,O=HQ.SPINQUE.COMValid From: Mon Mar 16 18:44:35 2015 UTCValid Until: Fri Mar 16 18:44:35 2035 UTCJoining realm failed: libcurl failed to execute the HTTP POST transaction, explaining: TCP connection reset by peerServices are up:$ ipactl statusDirectory Service: RUNNINGkrb5kdc Service: RUNNINGkadmin Service: RUNNINGnamed Service: RUNNINGipa_memcached Service: RUNNINGhttpd Service: RUNNINGpki-tomcatd Service: RUNNINGipa-otpd Service: RUNNINGipa-dnskeysyncd Service: RUNNINGipa: INFO: The ipactl command was successfulCertificate monitoring seems ok:$ getcert list -d /etc/httpd/alias -n ipaCertNumber of certificates and requests being tracked: 8.Request ID '20160501114633':status: MONITORINGstuck: nokey pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB'CA: dogtag-ipa-ca-renew-agentissuer: CN=Certificate Authority,O=HQ.SPINQUE.COMsubject: CN=IPA RA,O=HQ.SPINQUE.COMexpires: 2019-01-26 19:41:51 UTCkey usage: digitalSignature,nonRepudiation,keyEncipherment,dataEnciphermenteku: id-kp-serverAuth,id-kp-clientAuthpre-save command: /usr/lib64/ipa/certmonger/renew_ra_cert_prepost-save command: /usr/lib64/ipa/certmonger/renew_ra_certtrack: yesauto-renew: yesVersion:$ ipa --versionVERSION: 4.4.3, API_VERSION: 2.215Could you please point me at what else to check?
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org