Hello,
I'm getting desperate, I'm still unable to fix my expired certificates on my freeIPA master.
Summary:
- I discovered that my web ui SSL certificate had expired.
- the certificate lives in /etc/httpd/alias, is named Server-Cert
- for some reason, it is not tracked by ipa-getcert list
- from the web-ui, Authentication --> certificates fail:
- IPA Error 4301: CertificateOperationError
- Certificate operation cannot be completed: Unable to communicate with CMS (Internal Server Error)
- I tried to set the system time back in time -> was unable to get kinit credentials (revoked)
- I tried to set certmonger to track the expired certificate:
- ipa-getcert start-tracking -d /etc/httpd/alias -n Server-Cert -p /etc/httpd/alias/pwdfile.txt
- status from ipa-getcert list:
- ca-error: Unable to determine principal name for signing request.
- I followed some instructions to manually renew the certificates.
- at one point I need
ipa cert-request
to sign the request. - but the ipa cert commands do not work, e.g.
- ipa cert-find
ipa: ERROR: cert validation failed for "CN=ipa.quartzbio.com,O=QUARTZBIO.COM" ((SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired.)
ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)
What could/should I do !?!?
Is is possible to manually renew the certificate using only certutil ?
Thanks for any help.
Karl
P.S
this runs in a freeipa-server docker container.