Good afternoon,
Firefox stores the trusted CAs and you can manually remove the
conflicting
one: Edit > Settings > Privacy & Security > Certificates > View
Certificates...
In the Authorities tab, you can look for your original root CA (for which
the key was lost) / the one that you created with the same subject name,
and remove it.
None of my certificates where in Firefox trusted store so I add the new root CA. I tried
to restart Firefox but still got the error.
See ipa-certupdate -v output below:
# ipa-certupdate -v
ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: Not logging to a file
ipa: DEBUG: Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@QC.LRTECH.CA
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: failed to find session_cookie in
persistent storage for principal 'admin(a)QC.LRTECH.CA'
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: trying
https://freeipa.qc.lrtech.ca/ipa/json
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Created connection
context.rpcclient_45621904
ipa.ipaclient.plugins.rpcclient.rpcclient: INFO: Forwarding 'schema' to json
server 'https://freeipa.qc.lrtech.ca/ipa/json'
ipa: DEBUG: NSSConnection init freeipa.qc.lrtech.ca
ipa: DEBUG: Connecting: 192.168.254.203:0
ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server
ipa: DEBUG: cert valid True for "CN=freeipa.qc.lrtech.ca,O=QC.LRTECH.CA"
ipa: DEBUG: handshake complete, peer = 192.168.254.203:443
ipa: DEBUG: Protocol: TLS1.2
ipa: DEBUG: Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
ipa: DEBUG: received Set-Cookie 'ipa_session=bd05b8f4e89ed6380efa3d2dbcf7176f;
Domain=freeipa.qc.lrtech.ca; Path=/ipa; Expires=Tue, 15 Mar 2022 16:37:05 GMT; Secure;
HttpOnly'
ipa: DEBUG: storing cookie 'ipa_session=bd05b8f4e89ed6380efa3d2dbcf7176f;
Domain=freeipa.qc.lrtech.ca; Path=/ipa; Expires=Tue, 15 Mar 2022 16:37:05 GMT; Secure;
HttpOnly' for principal admin(a)QC.LRTECH.CA
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@QC.LRTECH.CA
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl search @s user ipa_session_cookie:admin@QC.LRTECH.CA
ipa: DEBUG: Process finished, return code=1
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=keyctl_search: Required key not available
ipa: DEBUG: Starting external process
ipa: DEBUG: args=keyctl padd user ipa_session_cookie:admin@QC.LRTECH.CA @s
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=253871631
ipa: DEBUG: stderr=
ipa.ipaclient.plugins.rpcclient.rpcclient: DEBUG: Destroyed connection
context.rpcclient_45621904
ipa: DEBUG: importing all plugin modules in ipaclient.remote_plugins.schema$ed0ad850...
ipa: DEBUG: importing plugin module ipaclient.remote_plugins.schema$ed0ad850.plugins
ipa: DEBUG: importing all plugin modules in ipaclient.plugins...
ipa: DEBUG: importing plugin module ipaclient.plugins.automember
ipa: DEBUG: importing plugin module ipaclient.plugins.automount
ipa: DEBUG: importing plugin module ipaclient.plugins.cert
ipa: DEBUG: importing plugin module ipaclient.plugins.certprofile
ipa: DEBUG: importing plugin module ipaclient.plugins.dns
ipa: DEBUG: importing plugin module ipaclient.plugins.hbacrule
ipa: DEBUG: importing plugin module ipaclient.plugins.hbactest
ipa: DEBUG: importing plugin module ipaclient.plugins.host
ipa: DEBUG: importing plugin module ipaclient.plugins.idrange
ipa: DEBUG: importing plugin module ipaclient.plugins.internal
ipa: DEBUG: importing plugin module ipaclient.plugins.location
ipa: DEBUG: importing plugin module ipaclient.plugins.migration
ipa: DEBUG: importing plugin module ipaclient.plugins.misc
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey
ipa: DEBUG: importing plugin module ipaclient.plugins.passwd
ipa: DEBUG: importing plugin module ipaclient.plugins.permission
ipa: DEBUG: importing plugin module ipaclient.plugins.rpcclient
ipa: DEBUG: importing plugin module ipaclient.plugins.server
ipa: DEBUG: importing plugin module ipaclient.plugins.service
ipa: DEBUG: importing plugin module ipaclient.plugins.sudorule
ipa: DEBUG: importing plugin module ipaclient.plugins.topology
ipa: DEBUG: importing plugin module ipaclient.plugins.trust
ipa: DEBUG: importing plugin module ipaclient.plugins.user
ipa: DEBUG: importing plugin module ipaclient.plugins.vault
ipa: DEBUG: Initializing principal host/client.qc.lrtech.ca(a)QC.LRTECH.CA using keytab
/etc/krb5.keytab
ipa: DEBUG: using ccache /tmp/tmp-sszy3c/ccache
ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaclient/ipa_certupdate.py", line 63,
in run
ipautil.kinit_keytab(principal, paths.KRB5_KEYTAB, ccache_name)
File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 1314, in
kinit_keytab
cred = gssapi.Credentials(name=name, store=store, usage='initiate')
File "/usr/lib64/python2.7/site-packages/gssapi/creds.py", line 64, in
__new__
store=store)
File "/usr/lib64/python2.7/site-packages/gssapi/creds.py", line 148, in
acquire
usage)
File "ext_cred_store.pyx", line 182, in
gssapi.raw.ext_cred_store.acquire_cred_from (gssapi/raw/ext_cred_store.c:1732)
ipa.ipaclient.ipa_certupdate.CertUpdate: DEBUG: The ipa-certupdate command failed,
exception: GSSError: Major (851968): Unspecified GSS failure. Minor code may provide more
information, Minor (2529639122): Generic preauthentication failure
ipa.ipaclient.ipa_certupdate.CertUpdate: ERROR: Major (851968): Unspecified GSS failure.
Minor code may provide more information, Minor (2529639122): Generic preauthentication
failure
ipa.ipaclient.ipa_certupdate.CertUpdate: ERROR: The ipa-certupdate command failed.
Also if I do ipa-certupdate on my FreeIPA server old certificates get re-imported and my
root certificate lose is trusted attributes CT,C,C to ,,. It happen in all 4 database:
/etc/ipa/nssdb
/etc/httpd/alias
/etc/pki/pki-tomcat/alias/
/etc/dirsrv/slapd-QC-LRTECH-CA/
Is there a way to save the good state in FreeIPA.
Eric