Am certainly not sure that the orphan key is the root cause. It just looked
out of place and the log had the following error
Jan 13 17:44:02
ipasvr01.domain.com pki-server[4808]: ERROR:
*/var/lib/pki/pki-tomcat/alias
contains an incomplete NSS database* in SQL format
However, I compared the certificates stored in "subsystemCert cert-pki-ca"
and " uid=pkidbuser,ou=people,o=ipaca userCertificate".but haven't been
able to detect any difference.
On Mon, Jan 14, 2019 at 10:02 AM Florence Blanc-Renaud <flo(a)redhat.com>
wrote:
On 1/14/19 5:30 PM, Uzor Ide via FreeIPA-users wrote:
> Hello All,
>
> I upgraded our ipa server and after the upgrade ipa won't start again.
> further investigation shows that components of ipa starts
> but pki-tomcatd(a)pki-tomcat.service appears to be where the issue lies.
> checking the logs suggested that issue lies in the certificate database.
> on checking the directory /etc/pki/pki-tomcat/alias with certutils
>
> [namead@ipasvr01 alias]$ sudo certutil -K -d . -f pwdfile.txt
> certutil: Checking token "NSS Certificate DB" in slot "NSS User
Private
> Key and Certificate Services"
> < 0> rsa 9bb20dbec9d8dd63e1db53b0662eaf37a1518bf9 ocspSigningCert
> cert-pki-ca
> < 1> rsa 49d9f7a5f5ab3ed93d4037676b1bf9e236b89d0f subsystemCert
> cert-pki-ca
> < 2> rsa df374a636d9a424aaefefc6367dcb868f82f536d Server-Cert
> cert-pki-ca
> *< 3> rsa 7cebd0bbadddd5e581c328a99982e0ef5172d61f (orphan)*
> < 4> rsa 52839be82200bb2a9ff2034629c53cd90a0575a8
> auditSigningCert cert-pki-ca
> < 5> rsa c4a6d42c22a874a69231a2d7446bccfe9ce0cbaa caSigningCert
> cert-pki-ca
>
> Any help in the deleting the key would be appreciated.
The certutil command can delete a key from a NSS database (certutil -F
-k <id> -d /etc/pki/pki-tomcat/alias). But before you delete this
private key, can you explain how you deduced that it was the root cause?
I wouldn't advise to delete a private key if you're not 100% sure you
need to.
Pki failing to start after an upgrade often happens when the certificate
"subsystemCert cert-pki-ca" stored in /etc/pki/pki-tomcat/alias does not
match the content of the usercertificate or description stored in
uid=pkidbuser,ou=people,o=ipaca.
flo
>
> Thanks
>
> _Uz
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>