Rob, thanks for your response.
The output of both commands is:
certutil: could not find certificate named "Server-Cert":
PR_FILE_NOT_FOUND_ERROR: File not found
Any suggestions?
I guess we do a bit of cleanup when replacing the certs. Not a big deal.
So I wrote up instructions on how to do this but it assumes your CA is
up and functioning and I'm not 100% sure that is the case. If your 3rd
party certs are expired that would explain it. What I'd suggest is use
getcert list |grep expires and then look at the web and LDAP certs to
see when there is a time when all the certs are valid. Then I'd kill
ntpd and use date to go back in time. Manually restart the IPA services
(ipactl will restart ntpd and might reset the date unless it throws its
hands up because it's too far out-of-whack).
Confirm that the CA works using something like: ipa cert-show 1
IF you get any response back other than 503, like cert not found or a
display then things are working.
Then you can follow
Then bring back the date to today and restart ntpd.
Note that this won't remove the 3rd party certs or do any other sort of
cleanup. It might be considered a bit messy I suppose but those certs
shouldn't hurt anything. If you really want to clean them up once you're
sure things are functioning you can use certutil to remove them (after
backing up of course).
rob
Thanks
On Mon, May 6, 2019 at 3:54 PM Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>> wrote:
Adrian HY via FreeIPA-users wrote:
> Exactly, I ran ipa-server-certinstall and replaced both of the Apache
> and 389-ds certificates. I buy the certificate but I can't renew it.
>
> I imported the certificates like this:
>
> Root Certificate:
>
> ipa-cacert-manage -n Godaddy -p PASS_DIRECTORY_MANAGER -t CT,,
install *gdroot-g2.crt*
> ipa-certupdate
>
> Intermediate certificates:
>
> ipa-cacert-manage -n Godaddy2 -p PASS_DIRECTORY_MANAGER -t CT,,
install *gd_bundle-g2-g1.crt 4dfc653ab0cf823d.crt*
> ipa-certupdate
>
> Finally, the certificate:
>
> ipa-server-certinstall --dirman-password=PASS_DIRECTORY_MANAGER
--pin=PASS_CERTIFICATE -w -d *cert.key gd_bundle-g2-g1.crt
4dfc653ab0cf823d.crt* --cert-name=Godaddy2
>
>
> My IPA version is 4.6.4, OS CentOS 7.6.
This is an absolutely perfect response to my question, thank you very
much :-)
Ok, so chances seem good that the original certs are still available.
Whether they are still valid is another question, they too could be
expired, but let's start there.
To check the certs and see if they are valid run:
# certutil -V -u V -d /etc/httpd/alias -n Server-Cert
certutil: certificate is valid
# certutil -V -u V -d /etc/dirsrv/slapd-EXAMPLE-TEST -n Server-Cert
certutil: certificate is valid
If you're lucky both are still valid (I'm mostly concerned that they are
expired).
If they are valid then you can manually edit /etc/httpd/conf.d/nss.conf
and find the NSSNickname line. Set the value to Server-Cert. That will
fix Apache.
To fix 389-ds you'll need to use an ldapmodify:
# ldapmodify -x -D 'cn=directory manager' -W
<password prompt>
dn: cn=RSA,cn=encryption,cn=config
changetype: modify
replace: nsSSLPersonalitySSL
nsSSLPersonalitySSL: Server-Cert
<a blank line>
^D
Run ipactl restart to restart the world and you should be back in
business.
On the other hand if the certs are expired there will be a bit more
digging around. Let's hope for best case scenario and tackle the other
bit if we have to.
rob
>
> Thanks.
>
>
>
>
>
> On Mon, May 6, 2019 at 2:53 PM Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>
> <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>
wrote:
>
> Adrian HY via FreeIPA-users wrote:
> > Hi Florence, thanks for your attention.
> >
> > Yes, IPA was installed with self-signed CA, then I replaced the
> > self-signed CA with
> > an externally-signed CA (godaddy certificate). The
certificate expired
> > and I do not need it anymore. Hence, I need the self-signed CA.
>
> We need to know exactly what it is you did.
>
> On one hand it sounds like you ran ipa-server-certinstall and
replaced
> one or both of the Apache and 389-ds certificates.
>
> On the other it sounds like you go the IPA CA certificate
signed by an
> external CA. Seems dubious to me that godaddy would do this
(at least
> not without you ponying up major $$$).
>
> It matters what you did so please be as detailed as possible.
>
> The version of IPA would be handy to know as well.
>
> rob
>
> >
> > Thanks.
> >
> >
> > On Mon, May 6, 2019 at 2:32 PM Florence Blanc-Renaud
> <flo(a)redhat.com <mailto:flo@redhat.com> <mailto:flo@redhat.com
<mailto:flo@redhat.com>>
> > <mailto:flo@redhat.com <mailto:flo@redhat.com>
<mailto:flo@redhat.com <mailto:flo@redhat.com>>>> wrote:
> >
> > On 5/4/19 5:29 AM, Adrian HY via FreeIPA-users wrote:
> > > Hello all,
> > >
> > > My commercial certificate has expired today.
The pki-tomcatd
> > Service has
> > > stopped and I can´t to login at the web-gui.
> > > Is it possible to revert the original self signed
certificate ?
> > >
> > Hi,
> > can you clarify which certificate expired? There are a
lot of
> > certificates in a FreeIPA installation (IPA CA, the
certs for
> HTTP,
> > LDAP, Pkinit, the certs for Dogtag etc...)
> >
> > You mention "the original self-signed certificate", are
you
> > referring to
> > IPA CA? It would help to have the full story, for instance
> "IPA was
> > installed with self-signed CA, then I replaced the
self-signed
> CA with
> > an externally-signed CA etc..."
> >
> > flo
> >
> > > Thanks.
> > >
> > > _______________________________________________
> > > FreeIPA-users mailing list --
> freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> <mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
> > <mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> <mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>>
> > > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> <mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
> > <mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> <mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>>
> > > Fedora Code of Conduct:
> https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> >
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
> > >
> >
> >
> >
> > _______________________________________________
> > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> <mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
> > To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> <mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
> > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> > List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
> >
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>