Log isn't cut off, that is where it stops. It never reaches selftests.
From the debug logs, it shows that it is connecting with the cert and
there are no errors there. This leads me to believe the certs are
fine, certmonger is doing what it is supposed to, I think the issue
could be in the LDAP db. We did disable anonymous binds. I've changed
that to allow rootdse, that did not effect anything.
Also replaced the server.xml and CA.cfg with backups, same outcome.
All the certs look good, valid dates, don't expire for another year
certutil -L -d /etc/pki/pki-tomcat/alias/ -n 'caSigningCert cert-pki-ca'
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: "CN=Certificate Authority,O=IPA.EXAMPLE.NET"
Validity:
Not Before: Fri Jan 12 13:25:20 2018
Not After : Tue Jan 12 13:25:20 2038
Subject: "CN=Certificate Authority,O=IPA.EXAMPLE.NET"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
c0:...:5d
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Authority Key Identifier
Key ID:
f1:...:2f
Name: Certificate Basic Constraints
Critical: True
Data: Is a CA with no maximum path length.
Name: Certificate Key Usage
Critical: True
Usages: Digital Signature
Non-Repudiation
Certificate Signing
CRL Signing
Name: Certificate Subject Key ID
Data:
f1:...:2f
Name: Authority Information Access
Method: PKIX Online Certificate Status Protocol
Location:
URI: "http://ipa-ca.IPA.EXAMPLE.NET/ca/ocsp"
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
a8:...:4e
Fingerprint (SHA-256):
6E:...:32
Fingerprint (SHA1):
98:...:0F
Mozilla-CA-Policy: false (attribute missing)
Certificate Trust Flags:
SSL Flags:
Valid CA
Trusted CA
User
Trusted Client CA
Email Flags:
Valid CA
Trusted CA
User
Object Signing Flags:
Valid CA
Trusted CA
User
certutil -L -d /etc/pki/pki-tomcat/alias/ -n 'ocspSigningCert cert-pki-ca'
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 2 (0x2)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: "CN=Certificate Authority,O=IPA.EXAMPLE.NET"
Validity:
Not Before: Fri Jan 12 13:25:20 2018
Not After : Thu Jan 02 13:25:20 2020
Subject: "CN=OCSP Subsystem,O=IPA.EXAMPLE.NET"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
9f:...:5b
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Authority Key Identifier
Key ID:
f1:...:2f
Name: Certificate Key Usage
Critical: True
Usages: Digital Signature
Non-Repudiation
Certificate Signing
CRL Signing
Name: Authority Information Access
Method: PKIX Online Certificate Status Protocol
Location:
URI: "http://ipa-ca.IPA.EXAMPLE.NET/ca/ocsp"
Name: Extended Key Usage
OCSP Responder Certificate
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
2f:...:32
Fingerprint (SHA-256):
85:...:3C
Fingerprint (SHA1):
73:...:9F
Mozilla-CA-Policy: false (attribute missing)
Certificate Trust Flags:
SSL Flags:
User
Email Flags:
User
Object Signing Flags:
User
certutil -L -d /etc/pki/pki-tomcat/alias/ -n 'subsystemCert cert-pki-ca'
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4 (0x4)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: "CN=Certificate Authority,O=IPA.EXAMPLE.NET"
Validity:
Not Before: Fri Jan 12 13:25:20 2018
Not After : Thu Jan 02 13:25:20 2020
Subject: "CN=CA Subsystem,O=IPA.EXAMPLE.NET"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
Modulus:
cc:...:89
Exponent: 65537 (0x10001)
Signed Extensions:
Name: Certificate Authority Key Identifier
Key ID:
f1:...:2f
Name: Authority Information Access
Method: PKIX Online Certificate Status Protocol
Location:
URI: "http://ipa-ca.IPA.EXAMPLE.NET/ca/ocsp"
Name: Certificate Key Usage
Critical: True
Usages: Digital Signature
Non-Repudiation
Key Encipherment
Data Encipherment
Name: Extended Key Usage
TLS Web Server Authentication Certificate
TLS Web Client Authentication Certificate
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Signature:
50:...:49
Fingerprint (SHA-256):
CB:...:E5
Fingerprint (SHA1):
7A:...:CB
Mozilla-CA-Policy: false (attribute missing)
Certificate Trust Flags:
SSL Flags:
User
Email Flags:
User
Object Signing Flags:
User
certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Server-Cert cert-pki-ca u,u,u
auditSigningCert cert-pki-ca u,u,Pu
caSigningCert cert-pki-ca CTu,Cu,Cu
ocspSigningCert cert-pki-ca u,u,u
subsystemCert cert-pki-ca u,u,u
On Thu, Jan 10, 2019 at 6:00 PM Rob Crittenden <rcritten(a)redhat.com> wrote:
Jason Wood via FreeIPA-users wrote:
> So I have an expired cert somewhere. Or something really weird. Setting system
time to 10/01/2018 PKI-Tomcat starts. Restarted certmonger and dirsrv. Moved date to
11/01/2018, restarted certmonger, dirsrv and pki-tomcat. pki-tomcat started. Moved date
to 12/01/2018, restarted services, tomcat fails to start. This is on a replica, not the
master. Hmmmm?
>
> OK. Moved date to 10/17/2018, restarted services. Starting with certmonger. Did
work. did certlist and there were some certs on that systems that were different start/end
dates. I thought, if pki-tomcatd started then I should make this my master, which I did.
tomcat may start, but it gives back 500 errors. Nothing I could do would get it to work.
Moved the time back to current and right back to the same.
>
> The master, didn't work no matter what I did. I keep coming back, that I have
ZERO errors. Nothing. No where. Since the OS update and the ipa-server-update ran without
issue during the OS update, and the issue only happened after the system was rebooted,
then some configuration some where was changed to the point that it effects this. What
that is, I do not know. I have not found any added or removed settings in any system
files comparing it to a system that upgraded fine. Maybe something in the LDAP db that
I'm not seeing. I am very LDAP challenged, so there is a good possibility I missed
something.
>
> At this point I've spent way too much time on this without resolution. Are
there any docs/howto's on replacing a domain. I do not want to lose the config or
anything. Just basically spin up new servers, copy the data, and connect the clients to it
all on the same domain. I would rather fix whatever broke, but that isn't looking
like it will happen.
The debug log looks cut off. Right after that IIRC it should do the
selftest. There should be a selftest log in the same directory as debug,
what does that say?
You might try using certutil to look at each cert in
/etc/pki/pki-tomcat/alias/ to double-check its validity.
rob
--
Jason Wood