On Oct 5, 2018, at 3:53 PM, Rob Crittenden
<rcritten(a)redhat.com> wrote:
Israel Brewster via FreeIPA-users wrote:
> I recently had the certificates I use on my FreeIPA server expire,
> preventing ipa from starting. So I replaced them with the new ones, and
> IPA still wouldn't start, whereupon after some digging I discovered the
> new certificates came with new Intermediate and root certificates. So I
> installed those using ipa-cacert-manage, ran ipa-certupdate, and then
> re-installed my certificates using ipa-server-certinstall, all of which
> appeared to work. However, the IPA service still won't start, with the
> issue apparently being that pki-tomcat isn't starting properly. Looking
> at the /var/log/pki/pki-tomcat/ca/debug file shows that the reason for
> this is:
>
> Internal Database Error encountered: Could not connect to LDAP server
> host
freeipaserver-a.ravnalaska.net
> <
http://freeipaserver-a.ravnalaska.net> port 636 Error
> netscape.ldap.LDAPException: Unable to create socket:
> org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
> SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been
> marked as not trusted by the user. (-1)
>
> Ok, sounds simple enough, so how do I mark the Peer's certificate issuer
> as trusted? Thanks.
I think we need more information on your installation. Were you running
with 3rd party certificates for Apache/LDAP already?
Yep, been using our third party wildcard certificate for the past few years.
Why was the issuer
different?
I have no idea. That’s part of the reason it took me a while to get to this point - I
installed the new certificates, and they didn’t work. It wasn’t until I looked at the
intermediate certificate that came with our new certificate and realized *it* was
different, and that its issuer was also different than the previous root I had installed
that I realized there was a difference. As I mentioned, I went ahead and installed both
this new intermediate and the new root, thus leading me to this point.
Are the CA subsystem certificates still valid? `getcert list` should
show you.
As far as I can tell, all certificates on the system are valid, it’s just tomcat that
thinks *something* is MARKED as untrusted:
getcert list
Number of certificates and requests being tracked: 7.
Request ID '20170929183435':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: SelfSign
issuer:
CN=freeipaserver-a.ravnalaska.net,O=RAVNALASKA.NET
subject:
CN=freeipaserver-a.ravnalaska.net,O=RAVNALASKA.NET
expires: 2019-09-01 22:46:51 UTC
principal name: krbtgt/RAVNALASKA.NET(a)RAVNALASKA.NET
certificate template/profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
Request ID '20171107224634':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=RAVNALASKA.NET
subject: CN=CA
Audit,O=RAVNALASKA.NET
expires: 2020-04-21 22:47:49 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171107224635':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=RAVNALASKA.NET
subject: CN=OCSP
Subsystem,O=RAVNALASKA.NET
expires: 2020-04-21 22:46:58 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171107224636':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=RAVNALASKA.NET
subject: CN=CA
Subsystem,O=RAVNALASKA.NET
expires: 2020-04-21 22:47:48 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171107224637':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent-reuse
issuer: CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US
subject: CN=*.ravnalaska.net,OU=IT,O=Ravn Alaska,L=Anchorage,ST=Alaska,C=US
expires: 2020-04-10 12:00:00 UTC
dns: *.ravnalaska.net,ravnalaska.net
key usage: digitalSignature,keyEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171107224638':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=RAVNALASKA.NET
subject: CN=IPA
RA,O=RAVNALASKA.NET
expires: 2020-04-21 22:47:29 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20171107224639':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=RAVNALASKA.NET
subject:
CN=freeipaserver-a.ravnalaska.net,O=RAVNALASKA.NET
expires: 2020-04-21 22:46:50 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert
cert-pki-ca"
track: yes
auto-renew: yes
rob