Hi Robert,
On Tue, Jan 22, 2019 at 9:16 PM Robert Alba via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
Having Cert issues on a centos 6 IPA 3 server
ipa: ERROR: Kerberos error: ('Unspecified GSS failure. Minor code may provide more
information', 851968)/('KDC returned error string: PROCESS_TGS', -1765328324)
ipa config-mod --enable-migration=TRUE
ipa: ERROR: cannot connect to u'https://lax4ipa01.mia.bill1st.local/ipa/xml':
(SSL_ERROR_BAD_CERT_DOMAIN) Unable to communicate securely with peer: requested domain
name does not match the server's certificate.
Old server, pretty much cant register any new clients to. Willing to pay for support for
migration help.
Version/Release/Distribution
ipa-server-3.0.0-47.el6.centos.x86_64
ipa-pki-ca-theme-9.0.3-7.el6.noarch
python-iniparse-0.3.1-2.1.el6.noarch
ipa-python-3.0.0-47.el6.centos.x86_64
ipa-pki-common-theme-9.0.3-7.el6.noarch
ipa-admintools-3.0.0-47.el6.centos.x86_64
ipa-server-selinux-3.0.0-47.el6.centos.x86_64
device-mapper-multipath-0.4.9-87.el6.x86_64
libipa_hbac-1.12.4-47.el6.x86_64
libipa_hbac-python-1.12.4-47.el6.x86_64
device-mapper-multipath-libs-0.4.9-87.el6.x86_64
sssd-ipa-1.12.4-47.el6.x86_64
ipa-client-3.0.0-47.el6.centos.x86_64
root@lax4ipa01.mia.bill1st:~$ cat /etc/ipa/ca.crt
-----BEGIN CERTIFICATE-----
MIIDozCCAougAwIBAgIBATANBgkqhkiG9w0BAQsFADA8MRowGAYDVQQKExFNSUEu
QklMTDFTVC5MT0NBTDEeMBwGA1UEAxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4X
DTE0MTEyNTE4MzgxN1oXDTM0MTEyNTE4MzgxN1owPDEaMBgGA1UEChMRTUlBLkJJ
TEwxU1QuTE9DQUwxHjAcBgNVBAMTFUNlcnRpZmljYXRlIEF1dGhvcml0eTCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKXgRpqEULf5v40kMxTtEooRBlEu
u8Kl1LyhXD5Oyvx4qpe7dQTM2EWKel7zm3j0Q2MP7utzTydxF4j4GToT8vlRdDXj
gdZjBpV7qbCc/t6OVF7sAhqY6Hz5Gghx9UTZ3euGJcBC0rcWQPWjSQi4GFA06I1v
MzoWWPoK/dY93eUgEnqXn1hdiD/ediPC5bXsgsERvKBl5LZ6xpbLYmpoNYeAh1KQ
Yg3Wyluj1yel5f+qYTkm/I6UJxT3EHS2grEXizkOWWfuyNguWPKzsuLop3U7iz7K
AycUAcxLVF1X1OxXIczlPv4hF91shwIUluIWBvhjfUttuAxp17Wt9eiGgbUCAwEA
AaOBrzCBrDAfBgNVHSMEGDAWgBR0Qg2UtrPixTY+00wdObnpJGsxazAPBgNVHRMB
Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQUdEINlLaz4sU2PtNM
HTm56SRrMWswSQYIKwYBBQUHAQEEPTA7MDkGCCsGAQUFBzABhi1odHRwOi8vbGF4
NGlwYTAxLm1pYS5iaWxsMXN0LmxvY2FsOjgwL2NhL29jc3AwDQYJKoZIhvcNAQEL
BQADggEBAGNJYJGde8xLSkzSaJo4Q70PDP8gFOVq3x0FK59mkA/eEpV5HsPfbhWh
FcH/T3m5etycX/lh52Y2lYuf4rULJEdEbrFhZmj8u3yd3IOrHCp4oLTb2RIr3EU/
YxNvt0Rq1+tQ7+wrrwZkltpOkZRb54N6JYf1D8SYOfo5278LcwOucHRscfMdtOzu
+QRXwLD8+ifV0OCHdpDw2LyV1H3JnuvzEAlBy3uKvcXPO6qzhPuVyb62JK3+gdtV
6leBi5t9kFbYN5utfjRGy5eABLbTbiCz+100jbKDiBkGBXmVduQeXbP4nvkiQM5w
mnAdvxgn1cNpeNhlYd//D60k5ckE0Us=
-----END CERTIFICATE-----
root@lax4ipa01.mia.bill1st:~$ certutil -L -d /etc/httpd/alias
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Server-Cert u,u,u
ipaCert u,u,u
MIA.BILL1ST.LOCAL IPA CA CT,C,C
getcert list
Number of certificates and requests being tracked: 8.
Request ID '20141125183905':
status: MONITORING
ca-error: Internal error: no response to
"http://lax4ipa01.mia.bill1st.local:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=173&renewal=true&xml=true".
stuck: no
key pair storage:
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=MIA.BILL1ST.LOCAL
subject: CN=CA Audit,O=MIA.BILL1ST.LOCAL
expires: 2018-10-08 17:15:13 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "auditSigningCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20141125183906':
status: MONITORING
ca-error: Internal error: no response to
"http://lax4ipa01.mia.bill1st.local:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=174&renewal=true&xml=true".
stuck: no
key pair storage:
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=MIA.BILL1ST.LOCAL
subject: CN=OCSP Subsystem,O=MIA.BILL1ST.LOCAL
expires: 2018-10-08 17:14:13 UTC
Okay, so your CA subsystem certificates expired on 2018-10-08
eku: id-kp-OCSPSigning
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "ocspSigningCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20141125183907':
status: MONITORING
ca-error: Internal error: no response to
"http://lax4ipa01.mia.bill1st.local:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=175&renewal=true&xml=true".
stuck: no
key pair storage:
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=MIA.BILL1ST.LOCAL
subject: CN=CA Subsystem,O=MIA.BILL1ST.LOCAL
expires: 2018-10-08 17:14:13 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20141125183908':
status: MONITORING
ca-error: Internal error: no response to
"http://lax4ipa01.mia.bill1st.local:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=177&renewal=true&xml=true".
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=MIA.BILL1ST.LOCAL
subject: CN=IPA RA,O=MIA.BILL1ST.LOCAL
expires: 2018-10-08 17:14:13 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20141125183909':
status: MONITORING
ca-error: Internal error: no response to
"http://lax4ipa01.mia.bill1st.local:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=176&renewal=true&xml=true".
stuck: no
key pair storage:
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=MIA.BILL1ST.LOCAL
subject: CN=lax4ipa01.mia.bill1st.local,O=MIA.BILL1ST.LOCAL
expires: 2018-10-08 17:14:13 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20141125183922':
status: CA_UNREACHABLE
ca-error: Server at
https://lax4ipa01.mia.bill1st.local/ipa/xml failed request,
will retry: -504 (libcurl failed to execute the HTTP POST transaction. SSL connect
error).
And since the cert is expired IPA could not restart services, which
explains the SSL connect error you get now.
What you might want to try at this point is to go back in time on the
original master (don't do it on other replicas) and run the following
to get certmonger to renew your certs:
* stop all FreeIPA services: ipactl stop
* make sure ntpd is stopped
* go back in time to 2018-10-06 - two days before the expiring date of
your certificates
* DO NOT RESTART IPA AT THIS POINT
* restart the two services for dirserv
* service named restart
* service pki-cad restart
* service httpd restart
* service certmonger restart
And then monitor your certificates using the following command:
getcert list
At some point (you might need to be very patient) it should renew your
certificates.
Please post the results or questions as a reply to this email.
Regards
François
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-MIA-BILL1ST-LOCAL',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-MIA-BILL1ST-LOCAL/pwdfile.txt'
> certificate:
type=NSSDB,location='/etc/dirsrv/slapd-MIA-BILL1ST-LOCAL',nickname='Server-Cert',token='NSS
Certificate DB'
> CA: IPA
> issuer: CN=Certificate Authority,O=MIA.BILL1ST.LOCAL
> subject: CN=lax4ipa01.mia.bill1st.local,O=MIA.BILL1ST.LOCAL
> expires: 2018-10-30 17:14:19 UTC
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command:
> post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv
MIA-BILL1ST-LOCAL
> track: yes
> auto-renew: yes
> Request ID '20141125183953':
> status: CA_UNREACHABLE
> ca-error: Server at
https://lax4ipa01.mia.bill1st.local/ipa/xml failed
request, will retry: -504 (libcurl failed to execute the HTTP POST transaction. SSL
connect error).
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA/pwdfile.txt'
> certificate:
type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS
Certificate DB'
> CA: IPA
> issuer: CN=Certificate Authority,O=MIA.BILL1ST.LOCAL
> subject: CN=lax4ipa01.mia.bill1st.local,O=MIA.BILL1ST.LOCAL
> expires: 2018-10-30 17:14:22 UTC
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command:
> post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv PKI-IPA
> track: yes
> auto-renew: yes
> Request ID '20141125184220':
> status: CA_UNREACHABLE
> ca-error: Server at
https://lax4ipa01.mia.bill1st.local/ipa/xml failed
request, will retry: -504 (libcurl failed to execute the HTTP POST transaction. SSL
connect error).
> stuck: no
> key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
> CA: IPA
> issuer: CN=Certificate Authority,O=MIA.BILL1ST.LOCAL
> subject: CN=lax4ipa01.lax.bill1st.local,O=MIA.BILL1ST.LOCAL
> expires: 2019-05-03 14:41:19 UTC
> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command:
> post-save command: /usr/lib64/ipa/certmonger/restart_httpd
> track: yes
> auto-renew: yes
> root@lax4ipa01.mia.bill1st:~$
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...