On 1/17/20 8:40 AM, Ferdinand Babas via FreeIPA-users wrote:
On 1/16/20 12:26 AM, Ferdinand Babas via FreeIPA-users wrote: Hi, the cert is present but its private key is missing. It looks like you lost many of the private keys on that node, do you have a backup somewhere of the NSS database? Otherwise, the private key may be present on other nodes and can be recovered from them using the export and import commands I provided earlier (pk12util).
flo
Hi flo,
No backup but I was able to export and import the ipaCert from another node and pki-tomcatd starts up now when back dated.
When I stop and start certmonger and run getcert list I get the following errors for a couple of certs:
ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation
Hi,
IPA is using the ipaCert to authenticate to Dogtag when it requests new certs. You need to check that the ipaCert is valid and consistent with the content of uid=ipara,ou=people,o=ipaca. This ldap entry must contain a "userCertificate" attribute (can be multivalued) that contains the certificate + a description attribute with the format "2;<serial number>;<issuer>;<subject>". With all the manual operations done on IPA, it's likely that this entry is inconsistent with the ipaCert and you will need to update it with ldapmodify. When it's done you can check if the cert is valid and allows authentication with the command: # kinit admin # ipa cert-show 1
If it's working, you can resubmit the tracking requests that were showing the error: # getcert resubmit -i <id>
After that, your CA renewal master should be good to go and you can set the date to the current date. HTH, flo
The above error is reported for:
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
and
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
But when I run the following everything checks out:
# grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -f /tmp/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 48f4a4...2c126e subsystemCert cert-pki-ca # certutil -K -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -f /tmp/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 7b55ea...d259f7 auditSigningCert cert-pki-ca
Things seem to checkout. I'm unsure what I should do next, I appreciate all the tips and help you've been providing.
Thanks,
Ferdinand _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...