I suppose we tackle these one at a time.
The older CA certificate can be deleted eventually which will prevent it
from being re-added by ipa-certupdate. I think for now we defer on that.
What is the serial number for the two "QC.LRTECH.CA IPA CA"
certificates? Are they different? If not that would explain the Firefox
error.
On the IPA server with the CA up, does ipa cert-show 1 work?
If not we need to work on that first. It means the CA isn't quite
functioning despite the renewed certificates.
With the renewed certificates you shouldn't have to fiddle with time
anymore. Do basic operations work on the server with current time?
I'm not sure if this is a typo or not, # certutil -L -d /etc/httpd/nssdb
Did you mean /etc/pki/nssdb?
rob
Eric Boisvert via FreeIPA-users wrote:
Good afternoon,
I was able to find a date where it's possible to start IPA services successfully
(2022-03-02).
Is it possible to clear IPA from bad certificates?
I see four "QC.LRTECH.CA IPA CA" certificates in:
certutil -L -d /etc/ipa/nssdb
certutil -L -d /etc/httpd/alias
certutil -L -d /etc/dirsrv/slapd-QC-LRTECH-CA/
I can manually delete them with certutil -D -d <path/todb> -n <nickname> and
keep the one I want, but each time I execute ipa-certupdate they come back and root CA
isn't trusted anymore.
# certutil -L -d /etc/ipa/nssdb
> Certificate Nickname Trust Attributes
>
SSL,S/MIME,JAR/XPI
>
> E=admin(a)lrtech.ca,CN=LR Tech inc. ROOT CA,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=QC,C=CA CT,C,C
> QC.LRTECH.CA IPA CA CT,C,C
> QC.LRTECH.CA IPA CA CT,C,C
> E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA CT,C,C
# certutil -L -d /etc/httpd/alias
> Certificate Nickname Trust Attributes
>
SSL,S/MIME,JAR/XPI
>
> E=admin(a)lrtech.ca,CN=LR Tech inc. ROOT CA,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=QC,C=CA CT,C,C
> QC.LRTECH.CA IPA CA CT,C,C
> Signing-Cert u,u,u
> QC.LRTECH.CA IPA CA CT,C,C
> E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA CT,C,C
> Server-Cert u,u,u
> ipaCert u,u,u
# certutil -L -d /etc/pki/pki-tomcat/alias/
> Certificate Nickname Trust Attributes
>
SSL,S/MIME,JAR/XPI
>
> E=admin(a)lrtech.ca,CN=LR Tech inc. ROOT CA,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=QC,C=CA CT,C,C
> caSigningCert cert-pki-ca CTu,Cu,Cu
> subsystemCert cert-pki-ca u,u,u
> auditSigningCert cert-pki-ca u,u,Pu
> caSigningCert cert-pki-ca CTu,Cu,Cu
> E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA C,,
> Server-Cert cert-pki-ca u,u,u
> ocspSigningCert cert-pki-ca u,u,u
# certutil -L -d /etc/dirsrv/slapd-QC-LRTECH-CA/
> Certificate Nickname Trust Attributes
>
SSL,S/MIME,JAR/XPI
>
> E=admin(a)lrtech.ca,CN=LR Tech inc. ROOT CA,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=QC,C=CA CT,C,C
> QC.LRTECH.CA IPA CA CT,C,C
> Server-Cert u,u,u
> QC.LRTECH.CA IPA CA CT,C,C
> E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA CT,C,C
After the cleaning I was able to renew all certificates and they are all MONITORING with
a valid date.
See getcert list output below.
> Number of certificates and requests being tracked: 8.
> Request ID '20170113205242':
> status: MONITORING
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=QC.LRTECH.CA
> subject: CN=CA Audit,O=QC.LRTECH.CA
> expires: 2024-02-23 05:00:03 UTC
> key usage: digitalSignature,nonRepudiation
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20170113205243':
> status: MONITORING
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=QC.LRTECH.CA
> subject: CN=OCSP Subsystem,O=QC.LRTECH.CA
> expires: 2024-02-23 05:00:13 UTC
> eku: id-kp-OCSPSigning
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20170113205244':
> status: MONITORING
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=QC.LRTECH.CA
> subject: CN=CA Subsystem,O=QC.LRTECH.CA
> expires: 2024-02-20 05:03:27 UTC
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20170113205245':
> status: MONITORING
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA
> subject: CN=Certificate Authority,O=QC.LRTECH.CA
> expires: 2027-03-04 14:26:48 UTC
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"caSigningCert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20170113205246':
> status: MONITORING
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=QC.LRTECH.CA
> subject: CN=IPA RA,O=QC.LRTECH.CA
> expires: 2024-02-20 05:03:35 UTC
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
> track: yes
> auto-renew: yes
> Request ID '20170113205247':
> status: MONITORING
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-renew-agent
> issuer: CN=Certificate Authority,O=QC.LRTECH.CA
> subject: CN=freeipa.qc.lrtech.ca,O=QC.LRTECH.CA
> expires: 2024-02-23 05:00:11 UTC
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"Server-Cert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20170113205302':
> status: MONITORING
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-QC-LRTECH-CA',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-QC-LRTECH-CA/pwdfile.txt'
> certificate:
type=NSSDB,location='/etc/dirsrv/slapd-QC-LRTECH-CA',nickname='Server-Cert',token='NSS
Certificate DB'
> CA: IPA
> issuer: CN=Certificate Authority,O=QC.LRTECH.CA
> subject: CN=freeipa.qc.lrtech.ca,O=QC.LRTECH.CA
> expires: 2024-03-02 05:03:02 UTC
> principal name: ldap/freeipa.qc.lrtech.ca(a)QC.LRTECH.CA
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command:
> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv QC-LRTECH-CA
> track: yes
> auto-renew: yes
> Request ID '20220304195651':
> status: MONITORING
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
> CA: IPA
> issuer: CN=Certificate Authority,O=QC.LRTECH.CA
> subject: CN=freeipa.qc.lrtech.ca,O=QC.LRTECH.CA
> expires: 2024-03-02 05:02:44 UTC
> dns: freeipa.qc.lrtech.ca
> principal name: HTTP/freeipa.qc.lrtech.ca(a)QC.LRTECH.CA
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command:
> post-save command:
> track: yes
> auto-renew: yes
Now I still got some issue with FreeIPA webUI.
Firefox is unable to load the page and gives error SEC_ERROR_REUSED_ISSUER_AND_SERIAL
Chrome allow me to connect but when I try to reach Authentication tab I get IPA Error
4301: CertificateOperationError Certificate operation cannot be completed: Unable to
communicate with CMS (Internal Server Error)
After that I tried to renew my client certificate by doing what Rob said:
Copy /etc/pki/ca-trust/source/ipa.p11-kit from the server to a client
I set time to 2022-03-02
kinit
Run update-ca-trust
Run ipa-certupdate
But the ipa-certupdate command return:
Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor
(2529639122): Generic preauthentication failure
Also I don't see my new root CA in /etc/httpd/nssdb even if the certificate is in
/etc/pki/ca-trust/anchor/
# certutil -L -d /etc/httpd/nssdb
> Certificate Nickname Trust Attributes
>
SSL,S/MIME,JAR/XPI
>
> LR Tech ROOT CA CT,C,C
> Server-Cert u,u,u
> QC.LRTECH.CA IPA CA CT,C,C
Eric
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure