Hi Flo,
FYI: ipa2 is essential in our environment, so I reinstalled
the replica (without ca). There are still 2 other hosts
ipa0 and ipabak with the same problem.
On 7/17/19 2:50 PM, Florence Blanc-Renaud wrote:
Hi,
the renewal behaves differently on the renewal master and on other nodes. On the renewal
master, post-save will upload the new cert to the LDAP entry, and replication will
propagate this changes to the other masters.
AFAICS this new entry was not replicated.
On a non-renewal master, the renewal obtains the cert from the local
LDAP, but does not write to LDAP (as the replication is supposed to have executed this
part).
This part did not work. Since ipa2, ipa0 and the other don't have the
new CA Subsystem certificate yet, I wonder if ipa1 (the renewal master)
still accepts the old certificate for setting up a connection to ipa0?
I don't understand in your case how the getcert resubmit managed
to update the cert (because it's supposed to get it from the local LDAP server), and
according to the ldapsearch you did it's not present. Can you double check the ldap
search but with -h ipa2 -p 389 to make sure the expected server is used?
See below. There is only one conclusion: getcert resubmit did *not* use the
local ldap server.
ldapsearch on ipa0 shows that the replicas are out of sync wrt
certificate information:
[root@ipa0 ~]# ldapsearch -h ipa0 -p 389 -D cn=directory\ manager -W -b o=ipaca
uid=pkidbuser userCertificate
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: uid=pkidbuser
# requesting: userCertificate
#
# pkidbuser, people, ipaca
dn: uid=pkidbuser,ou=people,o=ipaca
userCertificate:: MIIDhjCCAm6gAwIBAgIBAzANBgkqhkiG9w0BAQsFADBBMQswCQYDVQQGEwJE
:
DLmWOwnnZiyUGBpv1bM46fBcTuDwHG7NVveaiQ0R1Cpva185zzkyyqDB8AL8ygb/e+8iaY
userCertificate:: MIIDhTCCAm2gAwIBAgIBUzANBgkqhkiG9w0BAQsFADBBMQswCQYDVQQGEwJE
:
8DJ0nHC1E4pArqQ/yWDksCpcEWP/woYiF5HgK3jAc5Ba2smS+NyQicpg+ZkpvMPE9ZWsQ=
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
[root@ipa0 ~]# ldapsearch -h ipa1 -p 389 -D cn=directory\ manager -W -b o=ipaca
uid=pkidbuser userCertificate
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: uid=pkidbuser
# requesting: userCertificate
#
# pkidbuser, people, ipaca
dn: uid=pkidbuser,ou=people,o=ipaca
userCertificate:: MIIDhjCCAm6gAwIBAgIBAzANBgkqhkiG9w0BAQsFADBBMQswCQYDVQQGEwJE
:
DLmWOwnnZiyUGBpv1bM46fBcTuDwHG7NVveaiQ0R1Cpva185zzkyyqDB8AL8ygb/e+8iaY
userCertificate:: MIIDhTCCAm2gAwIBAgIBUzANBgkqhkiG9w0BAQsFADBBMQswCQYDVQQGEwJE
:
8DJ0nHC1E4pArqQ/yWDksCpcEWP/woYiF5HgK3jAc5Ba2smS+NyQicpg+ZkpvMPE9ZWsQ=
userCertificate:: MIIDhTCCAm2gAwIBAgIBaTANBgkqhkiG9w0BAQsFADBBMQswCQYDVQQGEwJE
:
qISlV77vwnVQ4f9mHYMDH2fxVn+Yg1NeW7Hfs30w9dh0p1t45KmI5pzEtreyqF/ARtq94=
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
As you can see, ipa1 has a 3rd certificate.
Also, is there a /etc/ipa/renew.conf file with a ldap_uri different
from the one in /etc/ipa/default.conf on ipa1?
[root@ipa1 ~]# cat /etc/ipa/renew.conf
cat: /etc/ipa/renew.conf: No such file or directory
Same on ipa0.
Regards
Harri