Dear all,
we are running a pair of IPA servers.
Our master seems to run fine. It had some certificate expired, but we could solve this by setting the time back, renewing all certificates and getting him back to today.
Now the "slave" server has also some expired certificates:
[root@ipa ca]# getcert list |grep expires expires: 2021-01-14 08:53:15 UTC expires: 2019-01-29 08:07:57 UTC expires: 2019-01-29 08:07:17 UTC expires: 2035-03-19 07:41:20 UTC expires: 2019-01-29 08:06:57 UTC expires: 2020-08-09 11:55:16 UTC expires: 2020-08-31 11:55:19 UTC expires: 2020-08-31 11:55:38 UTC [root@ipa ca]#
So we tried the same receipe and could update the first of those certificates, but now starting the 2nd one, we got stuck.
ipa-cacert-manage renew
failes and also the other certificates cannot be updated with
Request ID '20170505060648': status: MONITORING ca-error: Server at "https://ipa.pleiades.uni-wuppertal.de:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=PLEIADES.UNI-WUPPERTAL.DE subject: CN=OCSP Subsystem,O=PLEIADES.UNI-WUPPERTAL.DE expires: 2019-01-29 08:07:57 UTC eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes
a
getcert resubmit -i 20170505060648
brings up the same error message soon after. In the logs we found:
/var/log/pki/pki-tomcat/ca/debug
[25/Jan/2019:10:12:24][http-bio-8443-exec-7]: CertUserDBAuthentication: cannot map certificate to any user [25/Jan/2019:10:12:24][http-bio-8443-exec-7]: SignedAuditEventFactory: create() message created for eventType=AUTH_FAIL
/var/log/messages
Jan 25 10:12:24 ipa certmonger: 2019-01-25 10:12:24 [2829] Server at "https://ipa.pleiades.uni-wuppertal.de:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential.
Any hint would be really appreciated.
Thanks a lot
Torsten