Uzor Ide via FreeIPA-users wrote:
Am certainly not sure that the orphan key is the root cause. It just
looked out of place and the log had the following error
Jan 13 17:44:02
ipasvr01.domain.com <
http://ipasvr01.domain.com>
pki-server[4808]: ERROR: */var/lib/pki/pki-tomcat/alias contains an
incomplete NSS database* in SQL format
However, I compared the certificates stored in "subsystemCert
cert-pki-ca" and " uid=pkidbuser,ou=people,o=ipaca userCertificate".but
haven't been able to detect any difference.
NSS supports two database formats, dbm and sqlite. 4.7 switched to the
sqlite database format. This switch is generally transparent.
Look in the database directory and see what files you have. You should
have the dbm files (cert8.db, key3.db and secmod.db) and the sqlite
files (cert9.db, key4.db, pkcs11.txt).
Let us know what you find.
rob
On Mon, Jan 14, 2019 at 10:02 AM Florence Blanc-Renaud <flo(a)redhat.com
<mailto:flo@redhat.com>> wrote:
On 1/14/19 5:30 PM, Uzor Ide via FreeIPA-users wrote:
> Hello All,
>
> I upgraded our ipa server and after the upgrade ipa won't start
again.
> further investigation shows that components of ipa starts
> but pki-tomcatd(a)pki-tomcat.service appears to be where the issue
lies.
> checking the logs suggested that issue lies in the certificate
database.
> on checking the directory /etc/pki/pki-tomcat/alias with certutils
>
> [namead@ipasvr01 alias]$ sudo certutil -K -d . -f pwdfile.txt
> certutil: Checking token "NSS Certificate DB" in slot "NSS User
Private
> Key and Certificate Services"
> < 0> rsa 9bb20dbec9d8dd63e1db53b0662eaf37a1518bf9
ocspSigningCert
> cert-pki-ca
> < 1> rsa 49d9f7a5f5ab3ed93d4037676b1bf9e236b89d0f
subsystemCert
> cert-pki-ca
> < 2> rsa df374a636d9a424aaefefc6367dcb868f82f536d Server-Cert
> cert-pki-ca
> *< 3> rsa 7cebd0bbadddd5e581c328a99982e0ef5172d61f (orphan)*
> < 4> rsa 52839be82200bb2a9ff2034629c53cd90a0575a8
> auditSigningCert cert-pki-ca
> < 5> rsa c4a6d42c22a874a69231a2d7446bccfe9ce0cbaa
caSigningCert
> cert-pki-ca
>
> Any help in the deleting the key would be appreciated.
The certutil command can delete a key from a NSS database (certutil -F
-k <id> -d /etc/pki/pki-tomcat/alias). But before you delete this
private key, can you explain how you deduced that it was the root
cause?
I wouldn't advise to delete a private key if you're not 100% sure you
need to.
Pki failing to start after an upgrade often happens when the
certificate
"subsystemCert cert-pki-ca" stored in /etc/pki/pki-tomcat/alias does
not
match the content of the usercertificate or description stored in
uid=pkidbuser,ou=people,o=ipaca.
flo
>
> Thanks
>
> _Uz
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...