Hi Flo,
Thanks for the response.
On 1/6/20 10:12 PM, Ferdinand Babas via FreeIPA-users wrote:
Hi,
this error usually happens when there are issues with the subsystemCert
cert-pki-ca. According to your certutil output, the cert is missing
u,u,u flags, can you check if the associated key is present?
- Get the password to access the key:
$ sudo grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut
-d= -f2 > /tmp/pwdfile.txt
- Check if the key is present in the NSSdb:
$ sudo certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt |
grep subsystemCert
If the key is there, you should see a line with
< id> rsa 81c..d04 subsystemCert cert-pki-ca
The above steps failed for me with the following:
Incorrect password/PIN entered.
certutil: could not authenticate to token NSS Certificate DB.: SEC_ERROR_BAD_PASSWORD: The
security password entered is incorrect.
The above steps did work with the other 3 nodes however:
< 3> rsa 48f4a4...2c126e NSS Certificate DB:subsystemCert cert-pki-ca
If the key is missing you can recover it from another node where the CA
is installed.
How would I recover the key from the other nodes?
The 'auditSigningCert cert-pki-ca' is the same on all the
nodes with CA.
If you are able to get it from another machine, you can import the cert
on this master. First check if the key is present (with certutil -K),
and if needed also get the key from another node.
To export cert+key from a NSSDB to a p12file: pk12util -d
/etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -o file.p12
To import cert.key from a p12 file to a NSSDB: pk12util -d
/etc/pki/pki-tomcat/alias -i file.p12
Regarding the 'auditSigningCert cert-pki-ca' I ran the export command you provided
but got stuck when prompted for the password (Enter Password or Pin for "NSS
Certificate DB":). What should I do if I have no idea what the password is?
HTH,
flo
Thanks so much for your help!!
Ferdinand