Hi Rob,
I am planning to revert my existing third party SSL certs for HTTP and
LDAP Services back to CertMonger cert. Is there any way to revert the
certs back to CertMonger certs.
Are you sure the certs exist and are valid?
There is no automated way to do it. Assuming the certs are still in
their respective NSS databases you would:
- change the NSSNickname in /etc/httpd/conf.d/nss.conf to Server-Cert
and restart the httpd process.
- stop dirsrv@EXAMPLE-COM, edit /etc/dirsrv/slapd-EXAMPLE-COM/dse.ldif
and set nsSSLPersonalitySSL to Server-Cert in dn:
cn=RSA,cn=encryption,cn=config then restart dirsrv@EXAMPLE-COM
rob
Awaiting your response.
On Tue, Apr 3, 2018 at 9:56 AM, Alka Murali <alkamuralimolu(a)gmail.com
<mailto:alkamuralimolu@gmail.com>> wrote:
Hi Rob,
Thanks for your reply.
>> Sure. We'd need to know what version of IPA you have.
My FreeIPA Server is running on Version 4.4
Here is the result of the command "getcert list -d
/etc/dirsrv/slapd-YOUR-REALM -n Server-Cert" for my FreeIPA Server:
-----
Number of certificates and requests being tracked: 7.
Request ID '20170622062025':
status: CA_UNCONFIGURED
ca-error: Unable to determine principal name for signing request.
stuck: yes
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-*-*-*',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-*-*-*/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-*-*-*',nickname='Server-Cert'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv *-*-*
track: yes
auto-renew: yes
----------
Several months before, I have installed the third party SSL for
HTTP/LDAP services using the link below:
----
https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
<
https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP>
----
Please let me know if there is any abnormality in the current SSL
installation. Also kindly provide me the steps to use Third party
SSL for HTTP and Certmonger cert for LDAP.
On Mon, Apr 2, 2018 at 10:18 PM, Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>> wrote:
Alka Murali via FreeIPA-users wrote:
> Hello Team,
>
> Right now, I am using third party SSL for both HTTP and LDAP services.
> However I would like to know if there is any way to use third party SSL
> for HTTP alone and certmonger SSL for LDAP services.
Sure. We'd need to know what version of IPA you have. There may
already
be a certmonger-tracked cert. To see if there is and the status run:
# getcert list -d /etc/dirsrv/slapd-YOUR-REALM -n Server-Cert
rob
--
Regards,
Alka Murali
--
Regards,
Alka Murali