Rob,

I can run "ipa help" on 2 of the 3; the 3rd yields this:

# ipa help
ipa: ERROR: No valid Negotiate header in server response

Through some additional digging & log mining this morning, I figured out that something went tango uniform in our NTP configuration, so two of the servers were agreeing on the time (though incorrectly!) and this one, while closer, was far enough off the others to cause a problem. I synced all 3 manually to a time source and voila. Everything's back and looking groovy.


photo
Bret Wortman
Founder, Damascus Products, LLC

855-644-2783 | bret@wrapbuddies.co

http://wrapbuddies.co/

70 Main St. Suite 23 Warrenton, VA 20186
On Feb 26 2019, at 3:33 pm, Rob Crittenden <rcritten@redhat.com> wrote:
Bret Wortman wrote:
I don't think it's the CSR. We've got 3 IPA servers. Two seem to be
working just fine. One refuses to start named and /var/log/messages says
it's due to:

bind-dyndb-ldap version 11.1 compiled at 13:38:22 Aug 23, 2017, compiler
4.8.5 20150623 (Red Hat 4.8.5-16)
LDAP error: Invalid credentials: bind to LDAP server failed
couldn't establish connection in LDAP connection pool: permission denied
dynamic database 'ipa' configuration failed: permission denied

I don't believe anyone changed our authentication, and in fact the other
two hosts don't have these issues. Where should I be looking first? This
one is our primary CA, so I'd rather not lose it...

I'm not sure what you mean. Are you saying you can submit a request like
this on 2 of the 3 servers, or something else?

AFAIR bind-dyndb-ldap has its own keytab, /etc/named.keytab. I guess I'd
ensure that it is: readable, has matching kvno, can read/write the socket.

rob


photo
*Bret Wortman*
Founder, Damascus Products, LLC

855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/0?redirect=mailto%3Abret%40wrapbuddies.co&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

http://wrapbuddies.co/
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/1?redirect=http%3A%2F%2Fwrapbuddies.co%2F&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

70 Main St. Suite 23 Warrenton, VA 20186

<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/2?redirect=http%3A%2F%2Ffacebook.com%2Fwrapbuddiesco&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/3?redirect=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fbretwortman&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/4?redirect=http%3A%2F%2Ftwitter.com%2Fwrapbuddiesco&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/5?redirect=http%3A%2F%2Finstagram.com%2Fwrapbuddies&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

On Feb 26 2019, at 10:22 am, Bret Wortman via FreeIPA-users
<freeipa-users@lists.fedorahosted.org> wrote:

It /looks/ like we've done everything in your guide. I've sent the
requestor the docs at
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/certificates#requesting-cert-certutil
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/6?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F0%3Fredirect%3Dhttps%253A%252F%252Faccess.redhat.com%252Fdocumentation%252Fen-us%252Fred_hat_enterprise_linux%252F7%252Fhtml%252Flinux_domain_identity_authentication_and_policy_guide%252Fcertificates%2523requesting-cert-certutil%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
to see if that gets us any further in generating a CSR that works.


photo
*Bret Wortman*
Founder, Damascus Products, LLC

855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/7?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F1%3Fredirect%3Dmailto%253Abret%2540wrapbuddies.co%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

http://wrapbuddies.co/
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/8?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F2%3Fredirect%3Dhttp%253A%252F%252Fwrapbuddies.co%252F%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

70 Main St. Suite 23 Warrenton, VA 20186

<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/9?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F3%3Fredirect%3Dhttp%253A%252F%252Ffacebook.com%252Fwrapbuddiesco%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/10?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F4%3Fredirect%3Dhttp%253A%252F%252Fwww.linkedin.com%252Fin%252Fbretwortman%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/11?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F5%3Fredirect%3Dhttp%253A%252F%252Ftwitter.com%252Fwrapbuddiesco%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/12?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F6%3Fredirect%3Dhttp%253A%252F%252Finstagram.com%252Fwrapbuddies%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

On Feb 26 2019, at 10:18 am, Bret Wortman via FreeIPA-users
<freeipa-users@lists.fedorahosted.org> wrote:

failed to set perms (3140) on file
(/var/run/ipa/ccaches/bretw@MY.NET)!, referrer:
https:/zsipa3.my.net/ipa/ui/
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/13?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F7%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F0%253Fredirect%253Dzsipa3.my.net%25252Fipa%25252Fui%25252F%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
ipa: ERROR: non-public: TypeError: Incorrect Padding
[traceback]

I'll work through your how-to and see if that resolves anything
for us.

photo
*Bret Wortman*
Founder, Damascus Products, LLC

855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/14?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F8%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F1%253Fredirect%253Dmailto%25253Abret%252540wrapbuddies.co%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

http://wrapbuddies.co/
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/15?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F9%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F2%253Fredirect%253Dhttp%25253A%25252F%25252Fwrapbuddies.co%25252F%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

70 Main St. Suite 23 Warrenton, VA 20186

<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/16?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F10%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F3%253Fredirect%253Dhttp%25253A%25252F%25252Ffacebook.com%25252Fwrapbuddiesco%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>
<https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/17?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F11%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F4%253Fredirect%253Dhttp%25253A%25252F%25252Fwww.linkedin.com%25252Fin%25252Fbretwortman%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/18?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F12%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F5%253Fredirect%253Dhttp%25253A%25252F%25252Ftwitter.com%25252Fwrapbuddiesco%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D> <https://link.getmailspring.com/link/2902DF05-6BB4-46D2-951A-440762089FB0@getmailspring.com/19?redirect=https%3A%2F%2Flink.getmailspring.com%2Flink%2F8FD7CFB0-F69E-4C9C-B966-66AEA2958446%40getmailspring.com%2F13%3Fredirect%3Dhttps%253A%252F%252Flink.getmailspring.com%252Flink%252F863EDE26-2BBD-4A67-A8F5-681FDF3CB0FB%2540getmailspring.com%252F6%253Fredirect%253Dhttp%25253A%25252F%25252Finstagram.com%25252Fwrapbuddies%2526recipient%253DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn%26recipient%3DZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn&recipient=cmNyaXR0ZW5AcmVkaGF0LmNvbQ%3D%3D>

On Feb 25 2019, at 3:56 pm, Rob Crittenden <rcritten@redhat.com>
wrote:

Bret Wortman via FreeIPA-users wrote:

We have some ESXi boxes that need CA-signed certs
and we're trying to
figure out how to properly construct a CSR so that
our IPA CA will
process it.

I'm having them create the cert using these commands:

# certutil -R -d $PATH_TO_DB -a -g 2048 -s
"CN=${FQDN},O=MY.NET" -i
${SHORTHOSTNAME},${FQDN}


I think you mean -8 and not -i right?

and when I take the resulting file and try to sign
it in the GUI, I
get a 903 error. When I try from the command-line, I
get prompted for
the principal, which might be the problem since I'm
not sure what it
would be:

# ipa cert-request my.csr
Principal:

Has anyone done this, or is it never going to work
since the target
system isn't actually an IPA client?


A 903 is an internal error so there should be more info in
/var/log/httpd/error_log.

For this to work you need to:

- pre-create the host in IPA
- if you are going to use any service principal other than
host/ then
pre-create the service as well
- allow the IPA machine that you are requesting the cert on
to manage
that service.

This is also described in
https://rcritten.wordpress.com/2018/11/26/how-do-i-get-a-certificate-for-my-web-site-with-ipa/
with some additional details.

rob


photo
*Bret Wortman*
Founder, Damascus Products, LLC

855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<mailto:bret@wrapbuddies.co>

http://wrapbuddies.co/

70 Main St. Suite 23 Warrenton, VA 20186

<http://facebook.com/wrapbuddiesco>
<http://www.linkedin.com/in/bretwortman>
<http://twitter.com/wrapbuddiesco>
<http://instagram.com/wrapbuddies>


photo
*Bret Wortman*
Founder, Damascus Products, LLC

855-644-2783 <tel:855-644-2783> | bret@wrapbuddies.co
<mailto:bret@wrapbuddies.co>

http://wrapbuddies.co/
<http://link.wisestamp.com/wf/click?upn=Gjsa-2BFCSunt9pf0TgWHHLiysuQa4Ukv-2BkPkFCiKTJ0s-3D_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhke0FLtIXq0DtKLFp52km6gdVt5gIXzf-2Fw6wL0-2FVkrhBYbF4-2BeCYG22jqPm2blqPLX3yKImaHbkvhjMtRJY1x1PWP-2B9ajmPhXc6Q4aRoL66-2FMSNVx7CmekJdRgDc1i692UP9Whj2ad1kwbpOjdXNOn5ibKRti02eOtTuWLgovmnSVq8gHeG6ZqkulatIOfbEHcpg-3D-3D>

70 Main St. Suite 23 Warrenton, VA 20186
<x-apple-data-detectors://3>

<http://link.wisestamp.com/wf/click?upn=vpKJERi1tY7PB5Tngc96AybWG2oBJjuIZXUnsw1N4z5o31wAARdngqurchPNjg3N_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhke1vjU6o7xQGP-2BGzUR27UuIY2GAu5NHqyyvV40vTRWA6I2BnlpZjNvWGuFVfQYs4j-2FIA-2Fp-2FBKLQsK-2FC60OljawZlbUKYvSHJ2vqkmF3OPUdRYWEE-2FM3H-2Ffe6bjlsmWxVeyvJgyWDOr-2FezhQLzMdg80fYO-2FTuPzoYfBxnNGQ6mNaJ4Hu2R5zwaDTgua6HmA-2B09sg-3D-3D>

<http://link.wisestamp.com/wf/click?upn=JpWBgyEnwHH-2BZ-2F6q0khuJNj3-2BOPwXU204ZX623JVNB3sEJ9QbsPPq9gWpz71oDUM_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhkewX7PafcZVEBicpwmDKtHqNqTZvupoiZnlzDeCMqJUKuxsqZV0fxkj2pR2-2FN4wHYxOz2635AZKgWjdLwXGsTJEIFtMxpFWy2s5qEJ6iA1C1eK1h4h3NzCyCEzXkla38CGhOai87X9BNmmW0W3Z6mxJYOxafy9bV5M8ViL-2Fc8nhDQEUwmHjK65ETJexcJy1ElYw-3D-3D>

<http://link.wisestamp.com/wf/click?upn=frqkw0-2BXQfUAqxIenKLOlNVUb3mQcTCczCfpPsp-2FU5YgIibCsyWQLvHEUyKIadlh_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhke-2Fnb74rlxI4RtjP-2FTQFIBXhme3w2u-2FYqdmOEIpKxlRzFeicTWx8DZL20HGaDmNPJILRvlHhn3yReYNcSRSe-2FgO-2BvRxiO0ofJNh4ESWM6qdvqk-2Bx9B7-2B8QNOg-2BjWnFSfUoC9inj3bMdBhQlBWE6uGlPLiIdNYkokKKjQS5paTOmSdvgzwWPJ83kyiwHBtb-2B-2FpNw-3D-3D>

<http://link.wisestamp.com/wf/click?upn=LgCARJHnjtd3UE8bx6jzptjNRyekl8Pvwy5-2FHDn1-2FaQzqpk0QaN2M0cExN-2BbGi6s_4AlNZbcVaMIZvejNZI-2Bx7D3hQosPA6YtG9epbV4F4AqJnNKaxrt8YsBWB-2BYv2bsjV2mRyALVNUvStAVyENhkeze9lCytTK8E8hLfm9vghksv5Ok4L-2FCFJXkPF6Q0QVfAV6El7jssDAuXjyuRZf7r6ZMsVGNCqHmwnjXBsqf1Dz3hXdQu0sG1Sqf-2FfJ8RmEKuQGAbqjM8k2Xo-2Fe4pK3HjRBvVNBulJOwYpu72nu33hU1Wm6yLidz9Z8FIwMuIDTiNmVjC0v6uxmQYIcOHh772AQ-3D-3D>


 


_______________________________________________
FreeIPA-users mailing list --
freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org

Sent from Mailspring
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org

Sent from Mailspring
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org

Sent from Mailspring
Sent from Mailspring