On 7/16/19 11:39 AM, François Cami wrote:
Please have a look at the latest logs from pki:
/var/log/pki/pki-tomcat/ca/
The debug log file on ipa2 gives me an authentication failed for
connecting to ldap on ipa2:
[16/Jul/2019:09:52:22][localhost-startStop-1]:
============================================
[16/Jul/2019:09:52:22][localhost-startStop-1]: ===== DEBUG SUBSYSTEM INITIALIZED
=======
[16/Jul/2019:09:52:22][localhost-startStop-1]:
============================================
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: restart at autoShutdown? false
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: autoShutdown crumb file path?
/var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: about to look for cert for
auto-shutdown support:auditSigningCert cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: found cert:auditSigningCert
cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: done init id=debug
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: initialized debug
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: initSubsystem id=log
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: ready to init id=log
[16/Jul/2019:09:52:22][localhost-startStop-1]: Event filters:
[16/Jul/2019:09:52:22][localhost-startStop-1]: Creating
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
[16/Jul/2019:09:52:22][localhost-startStop-1]: Event filters:
[16/Jul/2019:09:52:22][localhost-startStop-1]: Creating
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
[16/Jul/2019:09:52:22][localhost-startStop-1]: Event filters:
[16/Jul/2019:09:52:22][localhost-startStop-1]: Creating
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: restart at autoShutdown? false
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: autoShutdown crumb file path?
/var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: about to look for cert for
auto-shutdown support:auditSigningCert cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: found cert:auditSigningCert
cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: done init id=log
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: initialized log
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: initSubsystem id=jss
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: ready to init id=jss
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: initializing JSS subsystem
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: enabled: true
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: NSS database:
/var/lib/pki/pki-tomcat/alias/
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: initializing CryptoManager
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: initializing SSL
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: random:
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: - algorithm: pkcs11prng
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: - provider: Mozilla-JSS
[16/Jul/2019:09:52:22][localhost-startStop-1]: JssSubsystem: initialization complete
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: restart at autoShutdown? false
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: autoShutdown crumb file path?
/var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: about to look for cert for
auto-shutdown support:auditSigningCert cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: found cert:auditSigningCert
cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: done init id=jss
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: initialized jss
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: initSubsystem id=dbs
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine: ready to init id=dbs
[16/Jul/2019:09:52:22][localhost-startStop-1]: DBSubsystem: init()
mEnableSerialMgmt=true
[16/Jul/2019:09:52:22][localhost-startStop-1]: Creating LdapBoundConnFactor(DBSubsystem)
[16/Jul/2019:09:52:22][localhost-startStop-1]: LdapBoundConnFactory: init
[16/Jul/2019:09:52:22][localhost-startStop-1]: LdapBoundConnFactory:doCloning true
[16/Jul/2019:09:52:22][localhost-startStop-1]: LdapAuthInfo: init()
[16/Jul/2019:09:52:22][localhost-startStop-1]: LdapAuthInfo: init begins
[16/Jul/2019:09:52:22][localhost-startStop-1]: LdapAuthInfo: init ends
[16/Jul/2019:09:52:22][localhost-startStop-1]: init: before makeConnection errorIfDown is
true
[16/Jul/2019:09:52:22][localhost-startStop-1]: makeConnection: errorIfDown true
[16/Jul/2019:09:52:22][localhost-startStop-1]: TCP Keep-Alive: true
[16/Jul/2019:09:52:22][localhost-startStop-1]: ldapconn/PKISocketFactory.makeSSLSocket:
begins
[16/Jul/2019:09:52:22][localhost-startStop-1]: SSLClientCertificateSelectionCB: Setting
desired cert nickname to: subsystemCert cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: LdapJssSSLSocket: set client auth cert
nickname subsystemCert cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: SSLClientCertificatSelectionCB: Entering!
[16/Jul/2019:09:52:22][localhost-startStop-1]: Candidate cert: ocspSigningCert
cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: Candidate cert: subsystemCert cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: SSLClientCertificateSelectionCB: desired
cert found in list: subsystemCert cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: SSLClientCertificateSelectionCB: returning:
subsystemCert cert-pki-ca
[16/Jul/2019:09:52:22][localhost-startStop-1]: PKIClientSocketListener.handshakeCompleted:
begins
[16/Jul/2019:09:52:22][localhost-startStop-1]: SignedAuditLogger: event
CLIENT_ACCESS_SESSION_ESTABLISH
[16/Jul/2019:09:52:22][localhost-startStop-1]: LogFile: event type not selected:
CLIENT_ACCESS_SESSION_ESTABLISH
[16/Jul/2019:09:52:22][localhost-startStop-1]: PKIClientSocketListener.handshakeCompleted:
CS_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS
[16/Jul/2019:09:52:22][localhost-startStop-1]: PKIClientSocketListener.handshakeCompleted:
clientIP=172.19.96.4 serverIP=172.19.96.4 serverPort=31746
[16/Jul/2019:09:52:22][localhost-startStop-1]: SSL handshake happened
Could not connect to LDAP server host ipa2.example.de port 636 Error
netscape.ldap.LDAPException: Authentication failed (49)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:205)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:166)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:130)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:667)
at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1056)
at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:962)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:568)
at com.netscape.certsrv.apps.CMS.init(CMS.java:191)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1458)
at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124)
at
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1257)
at
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1182)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1072)
at
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5368)
at
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5660)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899)
at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Internal Database Error encountered: Could not connect to LDAP server host ipa2.example.de
port 636 Error netscape.ldap.LDAPException: Authentication failed (49)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:689)
at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1056)
at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:962)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:568)
at com.netscape.certsrv.apps.CMS.init(CMS.java:191)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1458)
at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:117)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175)
at
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124)
at
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1257)
at
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1182)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1072)
at
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5368)
at
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5660)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899)
at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMS.start(): shutdown server
[16/Jul/2019:09:52:22][localhost-startStop-1]: CMSEngine.shutdown()
ldapsearch -D cn=directory\ manager -W -b o=ipaca uid=pkidbuser userCertificate
does not show the new certificate yet. I thought that the post-save command
for this certificate is supposed to add it to ldap as well. Should I have used
the ipa-getcert command instead?
Regards
Harri