from CS.cfg

selftests.container.order.startup=SystemCertsVerification:critical, CAPresence:critical

More observations

the following appears in /var/lib/pki/pki-tomcat/logs/ca/selftest.log during the pki-server cert-fix failure

0.localhost-startStop-1 - [25/May/2022:05:13:11 PDT] [20] [1] SystemCertsVerification: system certs verification failure: Certutils.verifySystemCertValidityByNickname:  faliled: nickname: ocspSigningCert cert-pki-cacause: java.lang.Exception: Certutils.verifySystemCertValidityByNickname:  failed: nickname: ocspSigningCert cert-pki-ca

I'm nearly out of ideas at the moment, still applying the following logic:
Since it fails to validate the expired ocsp certificate, let's return in time to the moment it was still valid and it should probably do.
It was expired on Apr, 25th i rewind to Apr,23th and rerun ipa-cert-fix.
However
it fails on password update for some reason.

ipapython.ipautil: DEBUG: Starting external process
ipapython.ipautil: DEBUG: args=pki-server cert-fix --ldapi-socket /var/run/slapd-...socket --agent-uid ipara --cert subsystem --cert ca_ocsp_signing --extra-cert 268304408
ipapython.ipautil: DEBUG: Process finished, return code=1
ipapython.ipautil: DEBUG: stdout=Result: Operations error (1)
Additional info: Failed to update password
ERROR: Command '['ldappasswd', '-H', 'ldapi://%2Fvar%2Frun%2Fslapd....socket', '-Y', 'EXTERNAL', '-T', '/tmp/tmpArCc5k', 'uid=pkidbuser,ou=people,o=ipaca']' returned non-zero exit status 1

ipapython.ipautil: DEBUG: stderr=INFO: Loading password config: /etc/pki/pki-tomcat/password.conf
INFO: Fixing the following system certs: ['subsystem', 'ca_ocsp_signing']
INFO: Renewing the following additional certs: ['268304408']
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
INFO: Stopping the instance to proceed with system cert renewal
INFO: Configuring LDAP password authentication
INFO: Setting pkidbuser password via ldappasswd
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0

ipapython.admintool: DEBUG:   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_cert_fix.py", line 117, in run
    run_cert_fix(certs, extra_certs)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_cert_fix.py", line 245, in run_cert_fix
    ipautil.run(cmd, raiseonerr=True)
  File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 563, in run
    raise CalledProcessError(p.returncode, arg_string, str(output))

ipapython.admintool: DEBUG: The ipa-cert-fix command failed, exception: CalledProcessError: Command 'pki-server cert-fix --ldapi-socket /var/run/slapd-....socket --agent-uid ipara --cert subsystem --cert ca_ocsp_signing --extra-cert 268304408' returned non-zero exit status 1
ipapython.admintool: ERROR: Command 'pki-server cert-fix --ldapi-socket /var/run/slapd-....socket --agent-uid ipara --cert subsystem --cert ca_ocsp_signing --extra-cert 268304408' returned non-zero exit status 1
ipapython.admintool: ERROR: The ipa-cert-fix command failed.

When the date is actual, there's no password update issue.
Probably there's some workaround for this?

Otherwise - is there any way to migrate the directory in the existing state to RHEL8/Whatever recent IPA version?

Thank you 


On Tue, May 24, 2022 at 7:57 PM Rob Crittenden <rcritten@redhat.com> wrote:
This sounds like https://bugzilla.redhat.com/show_bug.cgi?id=1779984

'pki-server cert-fix' fails when CS.cfg parameter
selftests.container.order.startup not present. This also causes failures
in 'ipa-cert-fix'

I'd check to see if that value exists and what it's value is, if any.

rob

Serge Krawczenko via FreeIPA-users wrote:
> The certificate renewed via ipa-cert-fix was
> Server-Cert cert-pki-ca 
> related to my domain
> Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
>         Issuer: "CN=Certificate Authority,O=my domain"
>         Validity:
>             Not Before: Fri May 20 13:45:09 2022
>             Not After : Sat Aug 20 13:45:09 2022
>         Subject: "CN=my domain,O=my domain"
>
> The others which must be also renewed but fail are:
>
> ocspSigningCert cert-pki-ca
> subsystemCert cert-pki-ca
>
> This is what i can see via certutil -L -d /etc/pki/pki-tomcat/alias
>
> Is it possible to disable ocsp temporary somehow or renew manually ? :(
>
>
> On Mon, May 23, 2022 at 8:01 PM Rob Crittenden <rcritten@redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
>     Serge Krawczenko via FreeIPA-users wrote:
>     > Hello again
>     > I was so hoping the story to end but nope.
>     >
>     > ipa-cert-fix managed to renew one of the certs
>     > but failed on the following ones
>     >
>     >
>     > Enter "yes" to proceed: yes
>     > Proceeding.
>     > ipapython.ipautil: DEBUG: Starting external process
>     > ipapython.ipautil: DEBUG: args=pki-server cert-fix --ldapi-socket
>     > /var/run/slapd-...socket --agent-uid ipara --cert subsystem --cert
>     > ca_ocsp_signing --extra-cert 268304408 --extra-cert 268304410
>     > ipapython.ipautil: DEBUG: Process finished, return code=1
>     > ipapython.ipautil: DEBUG: stdout=ERROR: [SSL:
>     > SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure
>     (_ssl.c:618)
>     >
>     > ipapython.ipautil: DEBUG: stderr=INFO: Loading password config:
>     > /etc/pki/pki-tomcat/password.conf
>     > INFO: Fixing the following system certs: ['subsystem',
>     'ca_ocsp_signing']
>     > INFO: Renewing the following additional certs: ['268304408',
>     '268304410']
>     > SASL/EXTERNAL authentication started
>     > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
>     > SASL SSF: 0
>     > INFO: Stopping the instance to proceed with system cert renewal
>     > INFO: Configuring LDAP password authentication
>     > INFO: Setting pkidbuser password via ldappasswd
>     > SASL/EXTERNAL authentication started
>     > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
>     > SASL SSF: 0
>     > INFO: Selftests disabled for subsystems: ca
>     > INFO: Resetting password for uid=ipara,ou=people,o=ipaca
>     > SASL/EXTERNAL authentication started
>     > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
>     > SASL SSF: 0
>     > INFO: Starting the instance
>     > INFO: Sleeping for 10 seconds to allow server time to start...
>     > INFO: Requesting new cert for subsystem
>     > INFO: Getting subsystem cert info for ca
>     > INFO: Trying to setup a secure connection to CA subsystem.
>     > INFO: Starting new HTTPS connection (1): myhost.com
>     <http://myhost.com> <http://myhost.com>
>     > INFO: Stopping the instance
>     > INFO: Selftests enabled for subsystems: ca
>     > INFO: Restoring previous LDAP configuration
>     >
>     > ipapython.admintool: DEBUG:   File
>     > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line
>     178, in
>     > execute
>     >     return_value = self.run()
>     >   File
>     > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_cert_fix.py",
>     > line 128, in run
>     >     replicate_dogtag_certs(subject_base, ca_subject_dn, certs)
>     >   File
>     > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_cert_fix.py",
>     > line 251, in replicate_dogtag_certs
>     >     cert = x509.load_certificate_from_file(cert_path)
>     >   File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 425, in
>     > load_certificate_from_file
>     >     with open(filename, mode='rb') as f:
>     >
>     > ipapython.admintool: DEBUG: The ipa-cert-fix command failed,
>     exception:
>     > IOError: [Errno 2] No such file or directory:
>     > '/etc/pki/pki-tomcat/certs/subsystem.crt'
>     > ipapython.admintool: ERROR: [Errno 2] No such file or directory:
>     > '/etc/pki/pki-tomcat/certs/subsystem.crt'
>     > ipapython.admintool: ERROR: The ipa-cert-fix command failed.
>     >
>     > The csr for subsystem was added according
>     > to https://access.redhat.com/solutions/4852721
>     >
>     > At the time of the above failure in /var/log/pki/pki-tomcat/ca/debug:
>     >
>     > [20/May/2022:07:43:59][localhost-startStop-1]:
>     > Certutils.verifySystemCertValidityByNickname:  failed :
>     > java.lang.Exception: Certutils.verifySystemCertValidityByNickname:
>     >  failed: nickname: ocspSigningCert
>     >  cert-pki-ca
>     > [20/May/2022:07:43:59][localhost-startStop-1]: CertUtils:
>     > verifySystemCertsByTag() failed: java.lang.Exception:
>     > Certutils.verifySystemCertValidityByNickname:  faliled: nickname:
>     > ocspSigningCert cert-pki-c
>     > acause: java.lang.Exception:
>     > Certutils.verifySystemCertValidityByNickname:  failed: nickname:
>     > ocspSigningCert cert-pki-ca
>     > [20/May/2022:07:43:59][localhost-startStop-1]: SignedAuditLogger:
>     event
>     > CIMC_CERT_VERIFICATION
>     > [20/May/2022:07:43:59][localhost-startStop-1]: SignedAuditLogger:
>     event
>     > CIMC_CERT_VERIFICATION
>     > java.lang.Exception: Certutils.verifySystemCertValidityByNickname:
>     >  faliled: nickname: ocspSigningCert cert-pki-cacause:
>     > java.lang.Exception: Certutils.verifySystemCertValidityByNickname:
>     >  failed: nicknam
>     > e: ocspSigningCert cert-pki-ca
>     >         at
>     >
>     com.netscape.cmscore.cert.CertUtils.verifySystemCertValidityByNickname(CertUtils.java:839)
>     >
>     > Nothing else suspicious
>
>     Which certificate was re-issued successfully?
>
>     It appears that pki-server-certfix, for which IPA is a wrapper, failed
>     to connect to the server. Whether the OCSP certs errors are related or
>     not I don't know. Does that cert exist in your PKI NSS database?
>
>     rob
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
>