I successfully added ISRG Root X1 using ipa-cacert-manage install to
my main ipa server.
I then tried
ipa-certupdate which failed on both the main ipa server and my replica.
trying
https://ipa.example.net/ipa/json
Connection to
https://ipa.example.net/ipa/json failed with [SSL:
CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)
This error may occur if the http cert is expired or the http cert chain
is missing in /etc/ipa/ca.crt. It often happens when the repair
procedure is done after the cert expired: ipa-certupdate connects to IPA
framework, which is using the expired cert for http, and the
verification fails, thus preventing from updating the cert chain.
If you replace the http cert with the new one using
ipa-server-certinstall, you will have to manually add the cert chain in
/etc/ipa/ca.crt. Then ipa-certupdate will be able to connect and place
the cert chain in all the relevant places. /etc/ipa/ca.crt can store
multiple certs in pem format.
On the clients/replicas, you will also need to manually add the cert
chain in /etc/ipa/ca.crt so that ipa-certupdate is able to connect to
the master.
flo
trying
https://replica.example.net/ipa/json
Connection to
https://replica.example.net/ipa/json failed with [Errno 111] Connection
refused
cannot connect to 'any of the configured servers':
https://ipa.example.net/ipa/json,
https://replica.example.net/ipa/json
The ipa-certupdate command failed.
Tried to restart the replica with ipactl restart:
2021-04-19T11:59:16Z DEBUG The CA status is: check interrupted due to error: Retrieving
CA status failed with status 500
2021-04-19T11:59:16Z DEBUG Waiting for CA to start...
2021-04-19T11:59:17Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and
run command ipa-server-upgrade manually.
From the log file:
2021-04-19T11:59:17Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line
56, in run
raise admintool.ScriptError(str(e))
2021-04-19T11:59:17Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError:
CA did not start in 300.0s
2021-04-19T11:59:17Z ERROR CA did not start in 300.0s
2021-04-19T11:59:17Z ERROR The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
Output of keytool -printcert -v -file fullchain.pem
Certificate[1]:
Owner:
CN=ipa.example.net
Issuer: CN=R3, O=Let's Encrypt, C=US
Serial number: 313e7850b8f8bb0617d9b0c5d714e2db2ca
Valid from: Sat Feb 20 21:38:27 CET 2021 until: Fri May 21 22:38:27 CEST 2021
Certificate fingerprints:
MD5: 47:0C:53:90:E1:D4:CC:25:85:CB:57:74:E6:DC:57:CA
SHA1: 7B:71:FC:C5:F2:30:86:0F:BA:94:35:86:3F:F7:E4:D1:63:9B:06:DF
SHA256:
1B:42:90:7F:C6:0D:4A:50:2C:40:F4:56:8C:63:86:77:64:46:AC:F4:D6:6A:ED:1F:23:77:1D:4F:17:38:25:75
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3
Extensions:
#1: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=false
0000: 04 81 F1 00 EF 00 75 00 94 20 BC 1E 8E D5 8D 6C ......u.. .....l
0010: 88 73 1F 82 8B 22 2C 0D D1 DA 4D 5E 6C 4F 94 3D .s...",...M^lO.=
0020: 61 DB 4E 2F 58 4D A2 C2 00 00 01 77 C1 61 2E B3 a.N/XM.....w.a..
0030: 00 00 04 03 00 46 30 44 02 20 65 CB 18 F8 F6 51 .....F0D. e....Q
0040: 75 FE 84 CC 02 FF 15 05 E1 99 AD F2 BA 38 A4 47 u............8.G
0050: 57 06 B1 0D CF 9B 37 6B 00 20 02 20 4B 58 9F AA W.....7k. . KX..
0060: 34 81 B2 B7 C1 1C 11 9C 5D D3 BC D8 73 BE AE 42 4.......]...s..B
0070: 17 DB 82 E3 04 E9 D6 EA 67 DE CA 07 00 76 00 F6 ........g....v..
0080: 5C 94 2F D1 77 30 22 14 54 18 08 30 94 56 8E E3 \./.w0".T..0.V..
0090: 4D 13 19 33 BF DF 0C 2F 20 0B CC 4E F1 64 E3 00 M..3.../ ..N.d..
00A0: 00 01 77 C1 61 2E 90 00 00 04 03 00 47 30 45 02 ..w.a.......G0E.
00B0: 20 66 42 EA 9F 97 DA BA 25 DB BC 0F 46 3A F2 71 fB.....%...F:.q
00C0: 1C 95 7D F2 E7 5E 4F 72 0D 3C 85 BA BD AB AF 00 .....^Or.<......
00D0: 1F 02 21 00 BF E8 C3 B3 48 2D 56 98 E6 EB 21 69 ..!.....H-V...!i
00E0: 39 EA 7D 31 2D 2B 5D 90 F7 F3 CF 04 B8 E3 BD 49 9..1-+]........I
00F0: ED 31 4B 00 .1K.
#2: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
[
accessMethod: ocsp
accessLocation: URIName:
http://r3.o.lencr.org
,
accessMethod: caIssuers
accessLocation: URIName:
http://r3.i.lencr.org/
]
]
#3: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 14 2E B3 17 B7 58 56 CB AE 50 09 40 E6 1F AF 9D .....XV..P.@....
0010: 8B 14 C2 C6 ....
]
]
#4: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
CA:false
PathLen: undefined
]
#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
[CertificatePolicyId: [2.23.140.1.2.1]
[] ]
[CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1]
[PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.1
qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let
0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67
sencrypt.org
]] ]
]
#6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
serverAuth
clientAuth
]
#7: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
DigitalSignature
Key_Encipherment
]
#8: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName:
ipa.example.net
]
#9: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: A5 19 02 C5 18 FB A5 68 30 32 6C 3E A6 2F F8 96 .......h02l>./..
0010: F8 11 DF 6A ...j
]
]
Certificate[2]:
Owner: CN=R3, O=Let's Encrypt, C=US
Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co.
Serial number: 400175048314a4c8218c84a90c16cddf
Valid from: Wed Oct 07 21:21:40 CEST 2020 until: Wed Sep 29 21:21:40 CEST 2021
Certificate fingerprints:
MD5: 31:21:28:F5:A0:ED:7B:A5:4B:65:82:92:87:56:BA:83
SHA1: 48:50:4E:97:4C:0D:AC:5B:5C:D4:76:C8:20:22:74:B2:4C:8C:71:72
SHA256:
73:0C:1B:DC:D8:5F:57:CE:5D:C0:BB:A7:33:E5:F1:BA:5A:92:5B:2A:77:1D:64:0A:26:F7:A4:54:22:4D:AD:3B
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3
Extensions:
#1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
[
accessMethod: caIssuers
accessLocation: URIName:
http://apps.identrust.com/roots/dstrootcax3.p7c
]
]
#2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...
0010: 60 85 89 10 `...
]
]
#3: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
CA:true
PathLen:0
]
#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
[DistributionPoint:
[URIName:
http://crl.identrust.com/DSTROOTCAX3CRL.crl]
]]
#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
[CertificatePolicyId: [2.23.140.1.2.1]
[] ]
[CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1]
[PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.1
qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F
."http://cps.roo
0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt
0020: 2E 6F 72 67 .org
]] ]
]
#6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
serverAuth
clientAuth
]
#7: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
DigitalSignature
Key_CertSign
Crl_Sign
]
#8: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 14 2E B3 17 B7 58 56 CB AE 50 09 40 E6 1F AF 9D .....XV..P.@....
0010: 8B 14 C2 C6 ....
]
]
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure