Thanks Flo.
[1] Service pki-tomcatd(a)pki-tomcat.service is active (running)
[2] /var/log/pki/pki-tomcat/ca/debug reads among others:
- SSL handshake happened
- Could not connect to LDAP server host
ca-ldap03.us.domain.com port 636 Error
netscape.ldap.LDAPException: Authentication failed (48)
- Internal Database Error encountered: Could not connect to LDAP server host
ca-ldap03.us.domain.com port 636 Error netscape.ldap.LDAPException: Authentication failed
(48)
I believe 48 is LDAP_INAPPROPRIATE_AUTH
[3] /var/log/ipa/ipactl.log reads:
-Failed to check CA status: cannot connect to 'http://ca-ldap03.us.domain.com:8080
/ca/admin/ca/getStatus': [Errno 111] Connection refused
-Waiting until the CA is running
-request POST
http://ca-ldap03.us.domain.com:8080/ca/admin/ca/getStatus
-request body ''
-The CA status is: check interrupted due to error: cannot connect to 'http://ca-ld
ap03.us.domain.com:8080/ca/admin/ca/getStatus': [Errno 111] Connection refused
- Waiting for CA to start...
- request POST
http://ca-ldap03.us.domain.com:8080/ca/admin/ca/getStatus
-request body ''
- The CA status is: check interrupted due to error: cannot connect to 'http://ca-ld
ap03.us.domain.com:8080/ca/admin/ca/getStatus': [Errno 111] Connection refused
[4] list of certificates
# getcert list | egrep -e status -e expire -e certificate
Number of certificates and requests being tracked: 6.
status: CA_WORKING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:38 UTC
status: CA_WORKING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:35 UTC
status: CA_WORKING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:36 UTC
status: MONITORING
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2036-08-24 20:49:35 UTC
status: CA_UNREACHABLE
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-11-02 14:48:48 UTC
status: CA_WORKING
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
expires: 2018-08-14 20:50:00 UTC
[5] journalctl -u certmonger --since yesterday
ca-ldap03.us.domain.com ipa-submit[1435]: GSSAPI client step 2
ca-ldap03.us.domain.com certmonger[963]: 2018-10-18 16:25:52 [963] Error 7 connecting to
https://ca-ldap03.us.domain.com:8443/ca/agent/ca/pro
ca-ldap03.us.domain.com python2[1409]: GSSAPI client step 1
[6] LDAP and HTTPD certs are issued by DigiCert, if that matters here.
So I guess something needs to be done to resolve [4] ?
thanks in advance. Zarko