On 04/03/2018 08:37 PM, lejeczek wrote:
On 29/03/18 12:43, Florence Blanc-Renaud wrote:
> On 03/28/2018 12:42 PM, lejeczek via FreeIPA-users wrote:
>> hi guys,
>>
>> I fail to troubleshoot this here:
>>
>> $ ipactl start --ignore-service-failures
>> Starting Directory Service
>> Starting krb5kdc Service
>> Starting kadmin Service
>> Starting named Service
>> Starting httpd Service
>> Starting ipa-custodia Service
>> Starting ntpd Service
>> Starting pki-tomcatd Service
>> Failed to start pki-tomcatd Service
>> Forced start, ignoring pki-tomcatd Service, continuing normal operation
>
> Hi,
>
> pki-tomcatd may fail to start when the subsystemCert cert-pki-ca did
> not properly get renewed. Please find more information in this blog:
>
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
>
>
> Flo
>
>> Starting ipa-otpd Service
>> Starting ipa-dnskeysyncd Service
>> ipa: INFO: The ipactl command was successful
>>
>> logs in /var/log/pki/pki-tomcat:
>> localhost.2018-03-28.log
>> ...
>> Mar 28, 2018 11:35:14 AM org.apache.catalina.core.StandardHostValve
>> invoke
>> SEVERE: Exception Processing /ca/admin/ca/getStatus
>> javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
>> ?????????????? at
>> com.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145)
>>
>> ?????????????? at
>>
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:500)
>>
>> ?????????????? at
>> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
>>
>> ?????????????? at
>> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
>>
>> ?????????????? at
>> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)
>>
>> ?????????????? at
>> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
>>
>> ?????????????? at
>> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
>>
>> ?????????????? at
>>
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087)
>>
>> ?????????????? at
>>
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
>>
>> ?????????????? at
>> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
>>
>> ?????????????? at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>>
>> ?????????????? at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>>
>> ?????????????? at
>>
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
>>
>> ?????????????? at java.lang.Thread.run(Thread.java:748)
>>
>>
>> in catalina.2018-03-28.log:
>> ...
>> Mar 28, 2018 11:41:35 AM org.apache.catalina.core.ContainerBase
>> backgroundProcess
>> WARNING: Exception processing realm
>> com.netscape.cms.tomcat.ProxyRealm@1e572093 background process
>> javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
>> ?????? at
>> com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
>>
>> ?????? at
>> org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
>>
>> ?????? at
>>
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
>>
>> ?????? at
>>
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
>>
>> ?????? at
>>
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
>>
>> ?????? at
>>
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
>>
>> ?????? at
>>
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
>>
>> ?????? at java.lang.Thread.run(Thread.java:748)
>>
>>
>> Would you able to conclude anything from those errors? What might be
>> a problem?
>>
>> many thanks, L.
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>
I have followed those instructions from the link and it seems that both
certutil & ldap have the same certificate.
However I also see:
$ sudo journalctl -lf -o cat -u dirsrv@
...
GSSAPI client step 1
GSSAPI client step 1
GSSAPI client step 2
[03/Apr/2018:19:30:53.962565693 +0100] - ERR - slapi_ldap_bind - Error:
could not send startTLS request: error -11 (Connect error)
[03/Apr/2018:19:30:53.965606137 +0100] - ERR - slapi_ldap_bind - Error:
could not send startTLS request: error -11 (Connect error)
GSSAPI client step 1
GSSAPI client step 1
GSSAPI client step 1
..
and in /var/log/pki/pki-tomcat/ca/debug
[03/Apr/2018:19:09:45][localhost-startStop-1]:
SSLClientCertificatSelectionCB: Entering!
[03/Apr/2018:19:09:45][localhost-startStop-1]: Candidate cert:
Server-Cert cert-pki-ca
[03/Apr/2018:19:09:45][localhost-startStop-1]: Candidate cert:
caSigningCert cert-pki-ca
[03/Apr/2018:19:09:45][localhost-startStop-1]:
SSLClientCertificateSelectionCB: returning: null
Hi,
it looks like the subsystemCert is not picked to authenticate to the
LDAP server. Can you check if the content of
/etc/pki/pki-tomcat/ca/CS.cfg is also consistent: this file contains an
entry for ca.subsystem.cert=MII.. that should match the cert
'subsystemCert cert-pki-ca' stored in /etc/pki/pki-tomcat/alias/ and in
LDAP.
Flo
[03/Apr/2018:19:09:45][localhost-startStop-1]: SSL handshake
happened
Could not connect to LDAP server host rider.private port 636 Error
netscape.ldap.LDAPException: Authentication failed (48)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:205)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:166)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:130)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
at
com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1176)
at
com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1082)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:572)
at com.netscape.certsrv.apps.CMS.init(CMS.java:189)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1631)
at
com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124)
at
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1257)
at
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1182)
at
org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1072)
at
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5368)
at
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5660)
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899)
at
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966)
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
..