Hello,

I have some issues with certificate management.

2 important points of the recent information:

- after a longstanding loss of the certification authority. The certification authority was deleted and a new one was created.
https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-lost-ca.htm  ( very big thx )

- For http and ldap, i use 3rd part certificates ( ipa-server-certinstall )
 

So far, I've noticed  2 problems :

1°) ipa-server-upgrade : failed

Impossible to upgrade the server.
i have a 401 error return when the upgrade script wants to access the url:

GET request https://freeipa4.exemple.fr:8443/ca/rest/account/login
...
response status 401

for this problem, I followed this information : https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomcatd-fails-to-start/

certificate on  /etc/pki/pki-tomcat/alias is the same pkiuser on the LDAP server

internaldb.ldapauth.authtype=SslClientAuth

so I don't know why I have a 401 error.


2°) ipa  cert-request --principal : failed

ipa: ERROR: impossible de se connecter à « MailScanner soupçonne le lien suivant d'être une tentative de fraude de la part de "freeipa4.exmple.fr:443" https://freeipa4.exmple.fr:443/ca/eeca/ca/profileSubmitSSLClient » : (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate

this is strange because on this port 443 i use a 3rd part certificates

do you have any idea what the problem is? I'm lost I don't know what to look for anymore.

thank you in advance
Pierre


here are some excerpts from the log


-----

IPA server version 4.4.0. API version 2.213
-----
ipaupgrade.log :
'''
2019-01-29T16:48:21Z DEBUG request GET https://freeipa4.exemple.fr:8443/ca/rest/account/login
2019-01-29T16:48:21Z DEBUG request body ''
2019-01-29T16:48:21Z DEBUG NSSConnection init freeipa4.exemple.fr
2019-01-29T16:48:21Z DEBUG Connecting: XX.XX.XX.XX:0
2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage = SSL Server
2019-01-29T16:48:21Z DEBUG cert valid True for "CN=freeipa4.exemple.fr,O=exemple.FR"
2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443
2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage = SSL Server
2019-01-29T16:48:21Z DEBUG cert valid True for "CN=freeipa4.exemple.fr,O=exemple.FR"
2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443
2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
2019-01-29T16:48:21Z DEBUG response status 401
2019-01-29T16:48:21Z DEBUG response headers {'content-length': '964', 'content-language': 'fr', 'expires': 'Thu, 01 Jan 1970 01:00:00 CET', 'server': 'Apache-Coyote/1.1', 'cache-control': 'private', 'date': 'Tue, 29 Jan 2019 16:48:21 GMT', 'content-type': 'text/html;charset=utf-8', 'www-authenticate': 'Basic realm="C}
2019-01-29T16:48:21Z DEBUG response body '<html><head><title>Apache Tomcat/7.0.69 - Rapport d\'\'erreur</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font'
2019-01-29T16:48:21Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2019-01-29T16:48:21Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
    return_value = self.run()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 46, in run
    server.upgrade()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1863, in upgrade
    upgrade_configuration()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 1785, in upgrade_configuration
    ca_enable_ldap_profile_subsystem(ca)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", line 336, in ca_enable_ldap_profile_subsystem
    cainstance.migrate_profiles_to_ldap()
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1984, in migrate_profiles_to_ldap
    _create_dogtag_profile(profile_id, profile_data, overwrite=False)
  File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1990, in _create_dogtag_profile
    with api.Backend.ra_certprofile as profile_api:
  File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line 2060, in __enter__
    raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API'))

2019-01-29T16:48:21Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Échec de l'authentification auprès de l'API REST de l'AC

-------
# getcert list
Number of certificates and requests being tracked: 5.
-------