Hello,
I have some issues with certificate management.
2 important points of the recent information:
- after a longstanding loss of the certification authority. The
certification authority was deleted and a new one was created.
https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-l...
<
https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-l...
( very big thx )
- For http and ldap, i use 3rd part certificates (
/ipa-server-certinstall /)
So far, I've noticed 2 problems :
1°) ipa-server-upgrade : failed
Impossible to upgrade the server.
i have a 401 error return when the upgrade script wants to access the url:
for this problem, I followed this information :
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
certificate on //etc/pki/pki-tomcat/alias///is the same pkiuser on the
LDAP server
internaldb.ldapauth.authtype=SslClientAuth
so I don't know why I have a 401 error.
//
2°) ipa cert-request --principal : failed
ipa: ERROR: impossible de se connecter à
« https://freeipa4.exmple.fr:443/ca/eeca/ca/profileSubmitSSLClient » :
(SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate
this is strange because on this port 443 i use a 3rd part certificates
do you have any idea what the problem is? I'm lost I don't know what to
look for anymore.
thank you in advance
Pierre
here are some excerpts from the log
-----
IPA server version 4.4.0. API version 2.213
-----
ipaupgrade.log :
'''
2019-01-29T16:48:21Z DEBUG request GET
https://freeipa4.exemple.fr:8443/ca/rest/account/login
2019-01-29T16:48:21Z DEBUG request body ''
2019-01-29T16:48:21Z DEBUG NSSConnection init freeipa4.exemple.fr
2019-01-29T16:48:21Z DEBUG Connecting: XX.XX.XX.XX:0
2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage =
SSL Server
2019-01-29T16:48:21Z DEBUG cert valid True for
"CN=freeipa4.exemple.fr,O=exemple.FR"
2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443
2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage =
SSL Server
2019-01-29T16:48:21Z DEBUG cert valid True for
"CN=freeipa4.exemple.fr,O=exemple.FR"
2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443
2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
2019-01-29T16:48:21Z DEBUG response status 401
2019-01-29T16:48:21Z DEBUG response headers {'content-length': '964',
'content-language': 'fr', 'expires': 'Thu, 01 Jan 1970
01:00:00 CET',
'server': 'Apache-Coyote/1.1', 'cache-control': 'private',
'date': 'Tue,
29 Jan 2019 16:48:21 GMT', 'content-type': 'text/html;charset=utf-8',
'www-authenticate': 'Basic realm="C}
2019-01-29T16:48:21Z DEBUG response body '<html><head><title>Apache
Tomcat/7.0.69 - Rapport d\'\'erreur</title><style><!--H1
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
H2
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;}
H3 {font'
2019-01-29T16:48:21Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2019-01-29T16:48:21Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in
execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 46, in run
server.upgrade()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1863, in upgrade
upgrade_configuration()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1785, in upgrade_configuration
ca_enable_ldap_profile_subsystem(ca)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 336, in ca_enable_ldap_profile_subsystem
cainstance.migrate_profiles_to_ldap()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1984, in migrate_profiles_to_ldap
_create_dogtag_profile(profile_id, profile_data, overwrite=False)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1990, in _create_dogtag_profile
with api.Backend.ra_certprofile as profile_api:
File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py",
line 2060, in __enter__
raise errors.RemoteRetrieveError(reason=_('Failed to authenticate
to CA REST API'))
2019-01-29T16:48:21Z DEBUG The ipa-server-upgrade command failed,
exception: RemoteRetrieveError: Échec de l'authentification auprès de
l'API REST de l'AC
-------
# getcert list
Number of certificates and requests being tracked: 5.
-------