Rob,
now i got error and here is the output, output was very long so i crop
it down and here is the error piece.
ipa: INFO: [Upgrading CA schema]
ipa.ipapython.ipaldap.SchemaCache: DEBUG: flushing
ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket from SchemaCache
ipa.ipapython.ipaldap.SchemaCache: DEBUG: retrieving schema for
SchemaCache url=ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket
conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x85bbf80>
ipa.ipaserver.install.schemaupdate: DEBUG: Processing schema LDIF file
/usr/share/pki/server/conf/schema-certProfile.ldif
ipa.ipaserver.install.schemaupdate: DEBUG: Processing schema LDIF file
/usr/share/pki/server/conf/schema-authority.ldif
ipa.ipaserver.install.schemaupdate: DEBUG: Not updating schema
ipa: INFO: CA schema update complete (no changes)
ipa: INFO: [Verifying that CA audit signing cert has 2 year validity]
ipa.ipaserver.install.cainstance.CAInstance: DEBUG:
caSignedLogCert.cfg profile validity range is 720
ipa: INFO: [Update certmonger certificate renewal configuration to version 5]
ipa: DEBUG: Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state'
ipa: DEBUG: Configuring certmonger to stop tracking system certificates for CA
Configuring certmonger to stop tracking system certificates for CA
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl start messagebus.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active messagebus.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl start certmonger.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active certmonger.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl stop certmonger.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl start certmonger.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active certmonger.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa: DEBUG: Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
ipa: DEBUG: Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state'
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl enable certmonger.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl start messagebus.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active messagebus.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl start certmonger.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/bin/systemctl is-active certmonger.service
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=active
ipa: DEBUG: stderr=
ipa: DEBUG: Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-EXAMPLE-COM -L
-n Server-Cert -a
ipa: DEBUG: Process finished, return code=255
ipa: DEBUG: stdout=
ipa: DEBUG: stderr=certutil: Could not find cert: Server-Cert
: PR_FILE_NOT_FOUND_ERROR: File not found
ipa.ipaserver.install.ipa_server_upgrade.ServerUpgrade: ERROR: IPA
server upgrade failed: Inspect /var/log/ipaupgrade.log and run command
ipa-server-upgrade manually.
ipa.ipaserver.install.ipa_server_upgrade.ServerUpgrade: DEBUG: File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171,
in execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 46, in run
server.upgrade()
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1863, in upgrade
upgrade_configuration()
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1769, in upgrade_configuration
certificate_renewal_update(ca, ds, http),
File "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1027, in certificate_renewal_update
ds.start_tracking_certificates(serverid)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py",
line 983, in start_tracking_certificates
'restart_dirsrv %s' % serverid)
File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py",
line 307, in track_server_cert
nsscert = x509.load_certificate(cert, dbdir=self.secdir)
File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 125, in
load_certificate
return nss.Certificate(buffer(data)) # pylint: disable=buffer-builtin
ipa.ipaserver.install.ipa_server_upgrade.ServerUpgrade: DEBUG: The
ipa-server-upgrade command failed, exception: NSPRError:
(SEC_ERROR_LIBRARY_FAILURE) security library failure.
ipa.ipaserver.install.ipa_server_upgrade.ServerUpgrade: ERROR:
Unexpected error - see /var/log/ipaupgrade.log for details:
NSPRError: (SEC_ERROR_LIBRARY_FAILURE) security library failure.
ipa.ipaserver.install.ipa_server_upgrade.ServerUpgrade: ERROR: The
ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for
more information
On Thu, Sep 26, 2019 at 9:39 AM Rob Crittenden <rcritten(a)redhat.com> wrote:
>
> Satish Patel wrote:
> > I am running "ipa-server-4.4.0-14.el7.centos.4.x86_64"
>
> Ok, that explains what is happening.
>
> Edit /var/lib/ipa/sysupgrade/sysupgrade.state and find the [dogtag]
> section. Remove the entry for certificate_renewal_update_5.
>
> This being present is preventing the tracking to be repaired.
>
> Then run ipa-server-upgrade again and your tracking should be fixed.
>
> Use the -v flag for additional debugging, not --debug, I was mistaken.
>
> rob
>
> >
> > On Wed, Sep 25, 2019 at 5:13 PM Rob Crittenden <rcritten(a)redhat.com>
wrote:
> >>
> >> Satish Patel via FreeIPA-users wrote:
> >>> I did run "ipa-server-upgrade" and look like it was successful
but
> >>> still in getcert list showing CA_NEED :(
> >>
> >> Remind me what the package version of IPA is. I'm confused by the
> >> version 5 in the output about renewal configuration.
> >>
> >> You might also want to try running with --debug as depending on release
> >> it will give more information about this.
> >>
> >> rob
> >>
> >>>
> >>>
> >>> [root@ldap-ca-master ~]# ipa-server-upgrade
> >>> Upgrading IPA:
> >>> [1/10]: stopping directory server
> >>> [2/10]: saving configuration
> >>> [3/10]: disabling listeners
> >>> [4/10]: enabling DS global lock
> >>> [5/10]: starting directory server
> >>> [6/10]: updating schema
> >>> [7/10]: upgrading server
> >>> [8/10]: stopping directory server
> >>> [9/10]: restoring configuration
> >>> [10/10]: starting directory server
> >>> Done.
> >>> Update complete
> >>> Upgrading IPA services
> >>> Upgrading the configuration of the IPA services
> >>> [Verifying that root certificate is published]
> >>> [Migrate CRL publish directory]
> >>> CRL tree already moved
> >>> /etc/dirsrv/slapd-EXAMPLE-COM/certmap.conf is now managed by IPA. It
> >>> will be overwritten. A backup of the original will be made.
> >>> [Verifying that CA proxy configuration is correct]
> >>> [Verifying that KDC configuration is using ipa-kdb backend]
> >>> [Fix DS schema file syntax]
> >>> Syntax already fixed
> >>> [Removing RA cert from DS NSS database]
> >>> RA cert already removed
> >>> [Enable sidgen and extdom plugins by default]
> >>> [Updating HTTPD service IPA configuration]
> >>> [Updating mod_nss protocol versions]
> >>> Protocol versions already updated
> >>> [Updating mod_nss cipher suite]
> >>> [Fixing trust flags in /etc/httpd/alias]
> >>> Trust flags already processed
> >>> [Exporting KRA agent PEM file]
> >>> KRA is not enabled
> >>> [Removing self-signed CA]
> >>> [Removing Dogtag 9 CA]
> >>> [Checking for deprecated KDC configuration files]
> >>> [Checking for deprecated backups of Samba configuration files]
> >>> [Setting up Firefox extension]
> >>> [Add missing CA DNS records]
> >>> IPA CA DNS records already processed
> >>> [Removing deprecated DNS configuration options]
> >>> DNS is not configured
> >>> [Ensuring minimal number of connections]
> >>> DNS is not configured
> >>> [Enabling serial autoincrement in DNS]
> >>> DNS is not configured
> >>> [Updating GSSAPI configuration in DNS]
> >>> DNS is not configured
> >>> [Updating pid-file configuration in DNS]
> >>> DNS is not configured
> >>> DNS is not configured
> >>> DNS is not configured
> >>> DNS is not configured
> >>> DNS is not configured
> >>> DNS is not configured
> >>> DNS is not configured
> >>> DNS is not configured
> >>> [Upgrading CA schema]
> >>> CA schema update complete (no changes)
> >>> [Verifying that CA audit signing cert has 2 year validity]
> >>> [Update certmonger certificate renewal configuration to version 5]
> >>> [Enable PKIX certificate path discovery and validation]
> >>> PKIX already enabled
> >>> [Authorizing RA Agent to modify profiles]
> >>> [Authorizing RA Agent to manage lightweight CAs]
> >>> [Ensuring Lightweight CAs container exists in Dogtag database]
> >>> [Adding default OCSP URI configuration]
> >>> [Ensuring CA is using LDAPProfileSubsystem]
> >>> [Migrating certificate profiles to LDAP]
> >>> [Ensuring presence of included profiles]
> >>> [Add default CA ACL]
> >>> Default CA ACL already added
> >>> [Set up lightweight CA key retrieval]
> >>> Creating principal
> >>> Retrieving keytab
> >>> Creating Custodia keys
> >>> Configuring key retriever
> >>> The IPA services were upgraded
> >>> The ipa-server-upgrade command was successful
> >>>
> >>>
> >>> [root@ldap-ca-master ~]# getcert list | grep status
> >>> status: NEED_CA
> >>> status: NEED_CA
> >>> status: NEED_CA
> >>> status: NEED_CA
> >>> status: NEED_CA
> >>> status: NEED_KEY_PAIR
> >>> status: NEED_KEY_PAIR
> >>> status: NEED_KEY_PAIR
> >>> status: NEED_KEY_PAIR
> >>> status: NEED_CA
> >>> status: NEED_KEY_PAIR
> >>> status: NEED_CA
> >>>
> >>> On Tue, Sep 24, 2019 at 3:55 AM Florence Blanc-Renaud
<flo(a)redhat.com> wrote:
> >>>>
> >>>> On 9/23/19 4:10 PM, Satish Patel via FreeIPA-users wrote:
> >>>>> Thanks Florence,
> >>>>>
> >>>>> is it safe to run "ipa-server-upgrade" ?
> >>>>>
> >>>> Hi,
> >>>> generally yes :)
> >>>>
> >>>> We had a few tickets related to upgrade but they are mainly
revealing
> >>>> already present issues (for instance because this CLI stops and
starts
> >>>> the services, expired certs would prevent successful completion).
> >>>>
> >>>>> Do i need to provide any option with
"ipa-server-upgrade" command? i
> >>>>> believe few month back when i tried to do
"ipa-server-upgrade" it
> >>>>> broke some stuff but anyway i will take snapshot of VM and try
in
> >>>>> worst case scenario.
> >>>> With the VM snapshot you are on the safe side.
> >>>>
> >>>> flo
> >>>>
> >>>>>
> >>>>> On Mon, Sep 23, 2019 at 2:25 AM Florence Blanc-Renaud
<flo(a)redhat.com> wrote:
> >>>>>>
> >>>>>> On 9/21/19 7:41 PM, Satish Patel via FreeIPA-users wrote:
> >>>>>>> Any thought ?
> >>>>>> Hi,
> >>>>>> if you run ipa-server-upgrade on this node, the command will
fix the
> >>>>>> tracking of certs. You should see in the output;
> >>>>>> [Update certmonger certificate renewal configuration]
> >>>>>>
> >>>>>> HTH,
> >>>>>> flo
> >>>>>>
> >>>>>>>
> >>>>>>> Sent from my iPhone
> >>>>>>>
> >>>>>>>> On Sep 20, 2019, at 11:35 AM, Satish Patel
<satish.txt(a)gmail.com> wrote:
> >>>>>>>>
> >>>>>>>> Rob sorry, i trim my output thought not necessary
but anyway here is
> >>>>>>>> the full list (ignore CAPS letter in output)
> >>>>>>>>
> >>>>>>>> [root@ldap-ca-master ~]# getcert list
> >>>>>>>>
> >>>>>>>> Number of certificates and requests being tracked:
12.
> >>>>>>>>
> >>>>>>>> Request ID '20190915042927':
> >>>>>>>>
> >>>>>>>> status: NEED_CA
> >>>>>>>>
> >>>>>>>> stuck: yes
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> >>>>>>>> cert-pki-ca',token='NSS Certificate
DB',pin set
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> >>>>>>>> cert-pki-ca',token='NSS Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> subject: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> expires: 2037-01-05 14:47:24 UTC
> >>>>>>>>
> >>>>>>>> key usage:
digitalSignature,nonRepudiation,keyCertSign,cRLSign
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915043150':
> >>>>>>>>
> >>>>>>>> status: NEED_CA
> >>>>>>>>
> >>>>>>>> stuck: yes
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> >>>>>>>> cert-pki-ca',token='NSS Certificate
DB',pin set
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> >>>>>>>> cert-pki-ca',token='NSS Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> subject:
CN=ldap-ca-master.foo.EXAMPLE.com,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> expires: 2020-11-17 18:30:29 UTC
> >>>>>>>>
> >>>>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> >>>>>>>>
> >>>>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915043212':
> >>>>>>>>
> >>>>>>>> status: NEED_CA
> >>>>>>>>
> >>>>>>>> stuck: yes
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> >>>>>>>> cert-pki-ca',token='NSS Certificate
DB',pin set
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> >>>>>>>> cert-pki-ca',token='NSS Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> subject: CN=OCSP
Subsystem,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> expires: 2020-11-17 18:31:26 UTC
> >>>>>>>>
> >>>>>>>> eku: id-kp-OCSPSigning
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915043224':
> >>>>>>>>
> >>>>>>>> status: NEED_CA
> >>>>>>>>
> >>>>>>>> stuck: yes
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> >>>>>>>> cert-pki-ca',token='NSS Certificate
DB',pin set
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> >>>>>>>> cert-pki-ca',token='NSS Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> subject: CN=CA
Audit,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> expires: 2020-11-17 18:32:07 UTC
> >>>>>>>>
> >>>>>>>> key usage: digitalSignature,nonRepudiation
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915043237':
> >>>>>>>>
> >>>>>>>> status: NEED_CA
> >>>>>>>>
> >>>>>>>> stuck: yes
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> >>>>>>>> cert-pki-ca',token='NSS Certificate
DB',pin set
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> >>>>>>>> cert-pki-ca',token='NSS Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> subject: CN=CA
Subsystem,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> expires: 2020-11-17 18:31:16 UTC
> >>>>>>>>
> >>>>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> >>>>>>>>
> >>>>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915043246':
> >>>>>>>>
> >>>>>>>> status: NEED_KEY_PAIR
> >>>>>>>>
> >>>>>>>> stuck: no
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',pin
> >>>>>>>> set
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy',token='NSS
> >>>>>>>> Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >>>>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>>>>>>>
> >>>>>>>> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >>>>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>>>>>>>
> >>>>>>>> expires: 2037-12-31 23:59:59 UTC
> >>>>>>>>
> >>>>>>>> key usage: keyCertSign,cRLSign
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915043304':
> >>>>>>>>
> >>>>>>>> status: NEED_KEY_PAIR
> >>>>>>>>
> >>>>>>>> stuck: no
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
> >>>>>>>> Intermediate',pin set
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Godaddy
> >>>>>>>> Intermediate',token='NSS Certificate
DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >>>>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>>>>>>>
> >>>>>>>> subject: CN=Go Daddy Secure Certificate Authority -
> >>>>>>>>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
> >>>>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>>>>>>>
> >>>>>>>> expires: 2031-05-03 07:00:00 UTC
> >>>>>>>>
> >>>>>>>> key usage: keyCertSign,cRLSign
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915045112':
> >>>>>>>>
> >>>>>>>> status: NEED_KEY_PAIR
> >>>>>>>>
> >>>>>>>> stuck: no
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM IPA
> >>>>>>>>
CA',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='EXAMPLE.COM
> >>>>>>>> IPA CA',token='NSS Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> subject: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> expires: 2037-01-05 14:47:24 UTC
> >>>>>>>>
> >>>>>>>> key usage:
digitalSignature,nonRepudiation,keyCertSign,cRLSign
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915045148':
> >>>>>>>>
> >>>>>>>> status: NEED_KEY_PAIR
> >>>>>>>>
> >>>>>>>> stuck: no
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy',token='NSS
> >>>>>>>> Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >>>>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>>>>>>>
> >>>>>>>> subject: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >>>>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>>>>>>>
> >>>>>>>> expires: 2037-12-31 23:59:59 UTC
> >>>>>>>>
> >>>>>>>> key usage: keyCertSign,cRLSign
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915045156':
> >>>>>>>>
> >>>>>>>> status: NEED_CA
> >>>>>>>>
> >>>>>>>> stuck: yes
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
> >>>>>>>> Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Signing-Cert',token='NSS
> >>>>>>>> Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> subject: CN=Object Signing
Cert,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> expires: 2021-01-05 14:49:59 UTC
> >>>>>>>>
> >>>>>>>> key usage: digitalSignature,keyCertSign
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915045206':
> >>>>>>>>
> >>>>>>>> status: NEED_KEY_PAIR
> >>>>>>>>
> >>>>>>>> stuck: no
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
> >>>>>>>>
Intermediate',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Godaddy
> >>>>>>>> Intermediate',token='NSS Certificate
DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Go Daddy Root Certificate Authority -
G2,O="GoDaddy.com,
> >>>>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>>>>>>>
> >>>>>>>> subject: CN=Go Daddy Secure Certificate Authority -
> >>>>>>>>
G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com,
> >>>>>>>> Inc.",L=Scottsdale,ST=Arizona,C=US
> >>>>>>>>
> >>>>>>>> expires: 2031-05-03 07:00:00 UTC
> >>>>>>>>
> >>>>>>>> key usage: keyCertSign,cRLSign
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>> Request ID '20190915045216':
> >>>>>>>>
> >>>>>>>> status: NEED_CA
> >>>>>>>>
> >>>>>>>> stuck: yes
> >>>>>>>>
> >>>>>>>> key pair storage:
> >>>>>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
> >>>>>>>> Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> >>>>>>>>
> >>>>>>>> certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
> >>>>>>>> Certificate DB'
> >>>>>>>>
> >>>>>>>> issuer: CN=Certificate
Authority,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> subject: CN=IPA
RA,O=EXAMPLE.COM
> >>>>>>>>
> >>>>>>>> expires: 2020-11-17 18:31:36 UTC
> >>>>>>>>
> >>>>>>>> key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> >>>>>>>>
> >>>>>>>> eku: id-kp-serverAuth,id-kp-clientAuth
> >>>>>>>>
> >>>>>>>> pre-save command:
> >>>>>>>>
> >>>>>>>> post-save command:
> >>>>>>>>
> >>>>>>>> track: yes
> >>>>>>>>
> >>>>>>>> auto-renew: yes
> >>>>>>>>
> >>>>>>>>> On Fri, Sep 20, 2019 at 10:58 AM Rob Crittenden
<rcritten(a)redhat.com> wrote:
> >>>>>>>>>
> >>>>>>>>> Satish Patel via FreeIPA-users wrote:
> >>>>>>>>>> Few days ago my Master CA was messed up and
getcert list was showing
> >>>>>>>>>> empty list (no cert to track)
> >>>>>>>>>>
> >>>>>>>>>> So i run following command to add certs
manually:
> >>>>>>>>>>
> >>>>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n
> >>>>>>>>>> 'ocspSigningCert cert-pki-ca' -P
XXXXXXX
> >>>>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n
> >>>>>>>>>> 'auditSigningCert cert-pki-ca' -P
XXXXXXX
> >>>>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n 'subsystemCert
> >>>>>>>>>> cert-pki-ca' -P XXXXXXX
> >>>>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n 'Godaddy' -P XXXXXXX
> >>>>>>>>>> getcert start-tracking -d
/etc/pki/pki-tomcat/alias -n 'Godaddy
> >>>>>>>>>> Intermediate' -P XXXXXXX
> >>>>>>>>>>
> >>>>>>>>>> And after that i am seeing this status
(status: NEED_CA ) it should
> >>>>>>>>>> be MONITORING right?
> >>>>>>>>>>
> >>>>>>>>>> # getcert list
> >>>>>>>>>> Number of certificates and requests being
tracked: 12.
> >>>>>>>>>
> >>>>>>>>> You setup the tracking wrong. Your output only
shows 3 certs and yet
> >>>>>>>>> certmonger thinks it has 12. Where are the other
9?
> >>>>>>>>>
> >>>>>>>>> rob
> >>>>>>> _______________________________________________
> >>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
> >>>>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> >>>>>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >>>>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> >>>>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >>>>>>>
> >>>>>>
> >>>>> _______________________________________________
> >>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
> >>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> >>>>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> >>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >>>>>
> >>>>
> >>> _______________________________________________
> >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> >>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> >>> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> >>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >>>
> >>
>