On 1/17/20 8:40 AM, Ferdinand Babas via FreeIPA-users wrote:
> On 1/16/20 12:26 AM, Ferdinand Babas via FreeIPA-users wrote:
> Hi,
> the cert is present but its private key is missing. It looks like you
> lost many of the private keys on that node, do you have a backup
> somewhere of the NSS database?
> Otherwise, the private key may be present on other nodes and can be
> recovered from them using the export and import commands I provided
> earlier (pk12util).
>
> flo
Hi flo,
No backup but I was able to export and import the ipaCert from another node and
pki-tomcatd starts up now when back dated.
When I stop and start certmonger and run getcert list I get the following errors for a
couple of certs:
ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess"
replied: 1: You did not provide a valid certificate for this operation
Hi,
IPA is using the ipaCert to authenticate to Dogtag when it requests new
certs. You need to check that the ipaCert is valid and consistent with
the content of uid=ipara,ou=people,o=ipaca. This ldap entry must contain
a "userCertificate" attribute (can be multivalued) that contains the
certificate + a description attribute with the format "2;<serial
number>;<issuer>;<subject>".
With all the manual operations done on IPA, it's likely that this entry
is inconsistent with the ipaCert and you will need to update it with
ldapmodify.
When it's done you can check if the cert is valid and allows
authentication with the command:
# kinit admin
# ipa cert-show 1
If it's working, you can resubmit the tracking requests that were
showing the error:
# getcert resubmit -i <id>
After that, your CA renewal master should be good to go and you can set
the date to the current date.
HTH,
flo
The above error is reported for:
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
and
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
But when I run the following everything checks out:
# grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 >
/tmp/pwdfile.txt
# certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -f
/tmp/pwdfile.txt
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
Key and Certificate Services"
< 0> rsa 48f4a4...2c126e subsystemCert cert-pki-ca
# certutil -K -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -f
/tmp/pwdfile.txt
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
Key and Certificate Services"
< 0> rsa 7b55ea...d259f7 auditSigningCert cert-pki-ca
Things seem to checkout. I'm unsure what I should do next, I appreciate all the tips
and help you've been providing.
Thanks,
Ferdinand
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...