On 06/20/2017 10:38 PM, Rob Crittenden wrote:
Are these three the only expired certs?
For now ...
What version of IPA?
ipa-server-4.4.0-14.el7.centos.7.x86_64
Did you restart IPA after going back in time? If not, try that, then
restart certmonger and it should renew the certs.
Definitely tried that, several times.
Given certmonger didn't fire in the very recent past can you
check the
syslog for any certmonger-related messages? I assume it renewed some,
but not all of the certs?
I did finally managed to get a more useful error message by following
the debugging hints here:
https://floblanc.wordpress.com/2016/12/19/troubleshooting-certmonger-issu...
I get this in /var/log/ipa/renew.log:
* Trying 172.31.255.1...
* Connected to asterisk.penurio.us (172.31.255.1) port 8443 (#0)
* Initializing NSS with certpath: sql:/etc/httpd/alias
* CAfile: /etc/ipa/ca.crt
CApath: none
* Server certificate:
* subject: CN=asterisk.penurio.us,O=PENURIO.US
* start date: Feb 27 23:37:03 2017 GMT
* expire date: Feb 17 23:37:03 2019 GMT
* common name: asterisk.penurio.us
* issuer: CN=Certificate Authority,O=PENURIO.US
* NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER)
* Peer's certificate issuer has been marked as not trusted by the user.
* Closing connection 0
And, sure enough, I am able to reproduce the behavior with curl:
# SSL_DIR=/etc/httpd/alias curl -v -o /dev/null --cacert
/etc/ipa/ca.crt
https://asterisk.penurio.us:8443/ca/agent/ca/profileReview
% Total % Received % Xferd Average Speed Time Time Time
Current
Dload Upload Total Spent Left
Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:--
--:--:-- 0
* About to connect() to asterisk.penurio.us port 8443 (#0)
* Trying 172.31.255.1...
* Connected to asterisk.penurio.us (172.31.255.1) port 8443 (#0)
* Initializing NSS with certpath: sql:/etc/httpd/alias
* CAfile: /etc/ipa/ca.crt
CApath: none
* Server certificate:
* subject: CN=asterisk.penurio.us,O=PENURIO.US
* start date: Feb 27 23:37:03 2017 GMT
* expire date: Feb 17 23:37:03 2019 GMT
* common name: asterisk.penurio.us
* issuer: CN=Certificate Authority,O=PENURIO.US
* NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER)
* Peer's certificate issuer has been marked as not trusted by the user.
0 0 0 0 0 0 0 0 --:--:-- --:--:--
--:--:-- 0
* Closing connection 0
curl: (60) Peer's certificate issuer has been marked as not trusted by
the user.
If I don't specify the SSL_DIR, the curl command works, so it
definitely seems to be an issue with the NSS database in
/etc/httpd/alias. I don't see anything obviously wrong with the trust
flags, though:
# certutil -d /etc/httpd/alias -L
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
Server-Cert u,u,u
ipaCert u,u,u
PENURIO.US IPA CA CT,C,C
Let's Encrypt Authority X3 - Digital Signature Trust Co. ,,
www.penurio.us u,u,u
--
========================================================================
Ian Pilcher arequipeno(a)gmail.com
-------- "I grew up before Mark Zuckerberg invented friendship" --------
========================================================================