Dear all,
we are running a pair of IPA servers.
Our master seems to run fine. It had some certificate expired, but we
could solve this by setting the time back, renewing all certificates and
getting him back to today.
Now the "slave" server has also some expired certificates:
[root@ipa ca]# getcert list |grep expires
expires: 2021-01-14 08:53:15 UTC
expires: 2019-01-29 08:07:57 UTC
expires: 2019-01-29 08:07:17 UTC
expires: 2035-03-19 07:41:20 UTC
expires: 2019-01-29 08:06:57 UTC
expires: 2020-08-09 11:55:16 UTC
expires: 2020-08-31 11:55:19 UTC
expires: 2020-08-31 11:55:38 UTC
[root@ipa ca]#
So we tried the same receipe and could update the first of those
certificates, but now starting the 2nd one, we got stuck.
ipa-cacert-manage renew
failes and also the other certificates cannot be updated with
Request ID '20170505060648':
status: MONITORING
ca-error: Server at
"https://ipa.pleiades.uni-wuppertal.de:8443/ca/agent/ca/profileProcess"
replied: 1: Invalid Credential.
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=PLEIADES.UNI-WUPPERTAL.DE
subject: CN=OCSP Subsystem,O=PLEIADES.UNI-WUPPERTAL.DE
expires: 2019-01-29 08:07:57 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
a
getcert resubmit -i 20170505060648
brings up the same error message soon after. In the logs we found:
/var/log/pki/pki-tomcat/ca/debug
[25/Jan/2019:10:12:24][http-bio-8443-exec-7]: CertUserDBAuthentication:
cannot map certificate to any user
[25/Jan/2019:10:12:24][http-bio-8443-exec-7]: SignedAuditEventFactory:
create() message created for eventType=AUTH_FAIL
/var/log/messages
Jan 25 10:12:24 ipa certmonger: 2019-01-25 10:12:24 [2829] Server at
"https://ipa.pleiades.uni-wuppertal.de:8443/ca/agent/ca/profileProcess"
replied: 1: Invalid Credential.
Any hint would be really appreciated.
Thanks a lot
Torsten
--
Dr. Torsten Harenberg harenberg(a)physik.uni-wuppertal.de
Bergische Universitaet
Fakultät 4 - Physik Tel.: +49 (0)202 439-3521
Gaussstr. 20 Fax : +49 (0)202 439-2811
42097 Wuppertal