Hello,
I have some issues with certificate management.
2 important points of the recent information:
- after a longstanding loss of the certification authority. The
certification authority was deleted and a new one was created.
https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-lost-ca.htm
( very big thx )
- For http and ldap, i use 3rd part certificates ( ipa-server-certinstall
)
So far, I've noticed 2 problems :
1°) ipa-server-upgrade : failed
Impossible to upgrade the server.
i have a 401 error return when the upgrade script wants to access
the url:
GET request https://freeipa4.exemple.fr:8443/ca/rest/account/login
...
response status 401
for this problem, I followed this information : https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomcatd-fails-to-start/
certificate on /etc/pki/pki-tomcat/alias is the
same pkiuser on the LDAP server
internaldb.ldapauth.authtype=SslClientAuth
so I don't know why I have a 401 error.
2°) ipa cert-request --principal : failed
ipa: ERROR: impossible de se connecter à
« MailScanner soupçonne le lien suivant d'être une tentative de fraude de la part de "freeipa4.exmple.fr:443" https://freeipa4.exmple.fr:443/ca/eeca/ca/profileSubmitSSLClient » :
(SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate
this is strange because on this port 443 i use a 3rd part
certificates
do you have any idea what the problem is? I'm lost I don't know what
to look for anymore.
thank you in advance
Pierre
here are some excerpts from the log
-----
IPA server version 4.4.0. API version 2.213
-----
ipaupgrade.log :
'''
2019-01-29T16:48:21Z DEBUG request GET https://freeipa4.exemple.fr:8443/ca/rest/account/login
2019-01-29T16:48:21Z DEBUG request body ''
2019-01-29T16:48:21Z DEBUG NSSConnection init freeipa4.exemple.fr
2019-01-29T16:48:21Z DEBUG Connecting: XX.XX.XX.XX:0
2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server
intended_usage = SSL Server
2019-01-29T16:48:21Z DEBUG cert valid True for
"CN=freeipa4.exemple.fr,O=exemple.FR"
2019-01-29T16:48:21Z DEBUG handshake complete, peer =
XX.XX.XX.XX:8443
2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server
intended_usage = SSL Server
2019-01-29T16:48:21Z DEBUG cert valid True for
"CN=freeipa4.exemple.fr,O=exemple.FR"
2019-01-29T16:48:21Z DEBUG handshake complete, peer =
XX.XX.XX.XX:8443
2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
2019-01-29T16:48:21Z DEBUG response status 401
2019-01-29T16:48:21Z DEBUG response headers {'content-length':
'964', 'content-language': 'fr', 'expires': 'Thu, 01 Jan 1970
01:00:00 CET', 'server': 'Apache-Coyote/1.1', 'cache-control':
'private', 'date': 'Tue, 29 Jan 2019 16:48:21 GMT', 'content-type':
'text/html;charset=utf-8', 'www-authenticate': 'Basic realm="C}
2019-01-29T16:48:21Z DEBUG response body
'<html><head><title>Apache Tomcat/7.0.69 - Rapport
d\'\'erreur</title><style><!--H1
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
H2
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;}
H3 {font'
2019-01-29T16:48:21Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2019-01-29T16:48:21Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171,
in execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 46, in run
server.upgrade()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1863, in upgrade
upgrade_configuration()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1785, in upgrade_configuration
ca_enable_ldap_profile_subsystem(ca)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 336, in ca_enable_ldap_profile_subsystem
cainstance.migrate_profiles_to_ldap()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 1984, in migrate_profiles_to_ldap
_create_dogtag_profile(profile_id, profile_data,
overwrite=False)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 1990, in _create_dogtag_profile
with api.Backend.ra_certprofile as profile_api:
File
"/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line
2060, in __enter__
raise errors.RemoteRetrieveError(reason=_('Failed to
authenticate to CA REST API'))
2019-01-29T16:48:21Z DEBUG The ipa-server-upgrade command failed,
exception: RemoteRetrieveError: Échec de l'authentification auprès
de l'API REST de l'AC
-------
# getcert list
Number of certificates and requests being tracked: 5.
-------