I'm not sure what you mean. Are you saying you can submit a request like
AFAIR bind-dyndb-ldap has its own keytab, /etc/named.keytab. I guess I'd
ensure that it is: readable, has matching kvno, can read/write the socket.
photo
*Bret Wortman*
Founder, Damascus Products, LLC
855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/0?redirect=mailto%3Abret%40wrapbuddies.co&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
http://wrapbuddies.co/
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/1?redirect=http%3A%2F%2Fwrapbuddies.co%2F&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
70 Main St. Suite 23 Warrenton, VA 20186
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/2?redirect=http%3A%2F%2Ffacebook.com%2Fwrapbuddiesco&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/3?redirect=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fbretwortman&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/4?redirect=http%3A%2F%2Ftwitter.com%2Fwrapbuddiesco&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/5?redirect=http%3A%2F%2Finstagram.com%2Fwrapbuddies&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
On Feb 26 2019, at 10:22 am, Bret Wortman via FreeIPA-users
<freeipa-users@lists.fedorahosted.org> wrote:
It /looks/ like we've done everything in your guide. I've sent the
requestor the docs at
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/certificates#requesting-cert-certutil
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/6?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F0%3Fredirect%3Dhttps%253A%252F%252Faccess.redhat.com%252Fdocumentation%252Fen-us%252Fred_hat_enterprise_linux%252F7%252Fhtml%252Flinux_domain_identity_authentication_and_policy_guide%252Fcertificates%2523requesting-cert-certutil%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
to see if that gets us any further in generating a CSR that works.
photo
*Bret Wortman*
Founder, Damascus Products, LLC
855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/7?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F1%3Fredirect%3Dmailto%253Abret%2540wrapbuddies.co%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
http://wrapbuddies.co/
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/8?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F2%3Fredirect%3Dhttp%253A%252F%252Fwrapbuddies.co%252F%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
70 Main St. Suite 23 Warrenton, VA 20186
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/9?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F3%3Fredirect%3Dhttp%253A%252F%252Ffacebook.com%252Fwrapbuddiesco%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/10?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F4%3Fredirect%3Dhttp%253A%252F%252Fwww.linkedin.com%252Fin%252Fbretwortman%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/11?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F5%3Fredirect%3Dhttp%253A%252F%252Ftwitter.com%252Fwrapbuddiesco%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/12?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F6%3Fredirect%3Dhttp%253A%252F%252Finstagram.com%252Fwrapbuddies%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
On Feb 26 2019, at 10:18 am, Bret Wortman via FreeIPA-users
<freeipa-users@lists.fedorahosted.org> wrote:
failed to set perms (3140) on file
(/var/run/ipa/ccaches/bretw@MY.NET)!, referrer:
https:/zsipa3.my.net/ipa/ui/
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/13?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F7%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F0%253Fredirect%253Dzsipa3.my.net%25252Fipa%25252Fui%25252F%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
ipa: ERROR: non-public: TypeError: Incorrect Padding
[traceback]
I'll work through your how-to and see if that resolves anything
for us.
photo
*Bret Wortman*
Founder, Damascus Products, LLC
855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/14?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F8%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F1%253Fredirect%253Dmailto%25253Abret%252540wrapbuddies.co%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
http://wrapbuddies.co/
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/15?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F9%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F2%253Fredirect%253Dhttp%25253A%25252F%25252Fwrapbuddies.co%25252F%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
70 Main St. Suite 23 Warrenton, VA 20186
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/16?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F10%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F3%253Fredirect%253Dhttp%25253A%25252F%25252Ffacebook.com%25252Fwrapbuddiesco%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/17?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F11%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F4%253Fredirect%253Dhttp%25253A%25252F%25252Fwww.linkedin.com%25252Fin%25252Fbretwortman%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/18?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F12%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F5%253Fredirect%253Dhttp%25253A%25252F%25252Ftwitter.com%25252Fwrapbuddiesco%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/19?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F13%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F6%253Fredirect%253Dhttp%25253A%25252F%25252Finstagram.com%25252Fwrapbuddies%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
On Feb 25 2019, at 3:56 pm, Rob Crittenden <rcritten@redhat.com>
wrote:
Bret Wortman via FreeIPA-users wrote:
We have some ESXi boxes that need CA-signed certs
and we're trying to
figure out how to properly construct a CSR so that
our IPA CA will
process it.
I'm having them create the cert using these commands:
# certutil -R -d $PATH_TO_DB -a -g 2048 -s
"CN=${FQDN},O=MY.NET" -i
${SHORTHOSTNAME},${FQDN}
I think you mean -8 and not -i right?
and when I take the resulting file and try to sign
it in the GUI, I
get a 903 error. When I try from the command-line, I
get prompted for
the principal, which might be the problem since I'm
not sure what it
would be:
# ipa cert-request my.csr
Principal:
Has anyone done this, or is it never going to work
since the target
system isn't actually an IPA client?
A 903 is an internal error so there should be more info in
/var/log/httpd/error_log.
For this to work you need to:
- pre-create the host in IPA
- if you are going to use any service principal other than
host/ then
pre-create the service as well
- allow the IPA machine that you are requesting the cert on
to manage
that service.
This is also described in
https://rcritten.wordpress.com/2018/11/26/how-do-i-get-a-certificate-for-my-web-site-with-ipa/
with some additional details.
rob
photo
*Bret Wortman*
Founder, Damascus Products, LLC
855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<mailto:bret@wrapbuddies.co>
http://wrapbuddies.co/
70 Main St. Suite 23 Warrenton, VA 20186
<http://facebook.com/wrapbuddiesco>
<http://www.linkedin.com/in/bretwortman>
<http://twitter.com/wrapbuddiesco>
<http://instagram.com/wrapbuddies>
photo
*Bret Wortman*
Founder, Damascus Products, LLC
855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<mailto:bret@wrapbuddies.co>
http://wrapbuddies.co/
<http://link.wisestamp.com/wf/click?upn=Gjsa-2BFCSunt9pf0TgWHHLiysuQa4Ukv-2BkPkFCiKTJ0s-3D_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhke0FLtIXq0DtKLFp52km6gdVt5gIXzf-2Fw6wL0-2FVkrhBYbF4-2BeCYG22jqPm2blqPLX3yKImaHbkvhjMtRJY1x1PWP-2B9ajmPhXc6Q4aRoL66-2FMSNVx7CmekJdRgDc1i692UP9Whj2ad1kwbpOjdXNOn5ibKRti02eOtTuWLgovmnSVq8gHeG6ZqkulatIOfbEHcpg-3D-3D>
70 Main St. Suite 23 Warrenton, VA 20186
<x-apple-data-detectors://3>
<http://link.wisestamp.com/wf/click?upn=vpKJERi1tY7PB5Tngc96AybWG2oBJjuIZXUnsw1N4z5o31wAARdngqurchPNjg3N_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhke1vjU6o7xQGP-2BGzUR27UuIY2GAu5NHqyyvV40vTRWA6I2BnlpZjNvWGuFVfQYs4j-2FIA-2Fp-2FBKLQsK-2FC60OljawZlbUKYvSHJ2vqkmF3OPUdRYWEE-2FM3H-2Ffe6bjlsmWxVeyvJgyWDOr-2FezhQLzMdg80fYO-2FTuPzoYfBxnNGQ6mNaJ4Hu2R5zwaDTgua6HmA-2B09sg-3D-3D>
<http://link.wisestamp.com/wf/click?upn=JpWBgyEnwHH-2BZ-2F6q0khuJNj3-2BOPwXU204ZX623JVNB3sEJ9QbsPPq9gWpz71oDUM_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhkewX7PafcZVEBicpwmDKtHqNqTZvupoiZnlzDeCMqJUKuxsqZV0fxkj2pR2-2FN4wHYxOz2635AZKgWjdLwXGsTJEIFtMxpFWy2s5qEJ6iA1C1eK1h4h3NzCyCEzXkla38CGhOai87X9BNmmW0W3Z6mxJYOxafy9bV5M8ViL-2Fc8nhDQEUwmHjK65ETJexcJy1ElYw-3D-3D>
<http://link.wisestamp.com/wf/click?upn=frqkw0-2BXQfUAqxIenKLOlNVUb3mQcTCczCfpPsp-2FU5YgIibCsyWQLvHEUyKIadlh_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhke-2Fnb74rlxI4RtjP-2FTQFIBXhme3w2u-2FYqdmOEIpKxlRzFeicTWx8DZL20HGaDmNPJILRvlHhn3yReYNcSRSe-2FgO-2BvRxiO0ofJNh4ESWM6qdvqk-2Bx9B7-2B8QNOg-2BjWnFSfUoC9inj3bMdBhQlBWE6uGlPLiIdNYkokKKjQS5paTOmSdvgzwWPJ83kyiwHBtb-2B-2FpNw-3D-3D>
<http://link.wisestamp.com/wf/click?upn=LgCARJHnjtd3UE8bx6jzptjNRyekl8Pvwy5-2FHDn1-2FaQzqpk0QaN2M0cExN-2BbGi6s_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhkeze9lCytTK8E8hLfm9vghksv5Ok4L-2FCFJXkPF6Q0QVfAV6El7jssDAuXjyuRZf7r6ZMsVGNCqHmwnjXBsqf1Dz3hXdQu0sG1Sqf-2FfJ8RmEKuQGAbqjM8k2Xo-2Fe4pK3HjRBvVNBulJOwYpu72nu33hU1Wm6yLidz9Z8FIwMuIDTiNmVjC0v6uxmQYIcOHh772AQ-3D-3D>
_______________________________________________
FreeIPA-users mailing list --
freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Sent from Mailspring
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Sent from Mailspring
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Sent from Mailspring