Jason Wood via FreeIPA-users wrote:
So I have an expired cert somewhere. Or something really weird.
Setting system time to 10/01/2018 PKI-Tomcat starts. Restarted certmonger and dirsrv.
Moved date to 11/01/2018, restarted certmonger, dirsrv and pki-tomcat. pki-tomcat
started. Moved date to 12/01/2018, restarted services, tomcat fails to start. This is on
a replica, not the master. Hmmmm?
OK. Moved date to 10/17/2018, restarted services. Starting with certmonger. Did work.
did certlist and there were some certs on that systems that were different start/end
dates. I thought, if pki-tomcatd started then I should make this my master, which I did.
tomcat may start, but it gives back 500 errors. Nothing I could do would get it to work.
Moved the time back to current and right back to the same.
The master, didn't work no matter what I did. I keep coming back, that I have ZERO
errors. Nothing. No where. Since the OS update and the ipa-server-update ran without
issue during the OS update, and the issue only happened after the system was rebooted,
then some configuration some where was changed to the point that it effects this. What
that is, I do not know. I have not found any added or removed settings in any system
files comparing it to a system that upgraded fine. Maybe something in the LDAP db that
I'm not seeing. I am very LDAP challenged, so there is a good possibility I missed
At this point I've spent way too much time on this without resolution. Are there any
docs/howto's on replacing a domain. I do not want to lose the config or anything.
Just basically spin up new servers, copy the data, and connect the clients to it all on
the same domain. I would rather fix whatever broke, but that isn't looking like it
The debug log looks cut off. Right after that IIRC it should do the
selftest. There should be a selftest log in the same directory as debug,
what does that say?
You might try using certutil to look at each cert in
/etc/pki/pki-tomcat/alias/ to double-check its validity.