I successfully added ISRG Root X1 using ipa-cacert-manage install to my main ipa server.
I then tried
ipa-certupdate which failed on both the main ipa server and my replica.
trying
https://ipa.example.net/ipa/json
Connection to
https://ipa.example.net/ipa/json failed with [SSL:
CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)
trying
https://replica.example.net/ipa/json
Connection to
https://replica.example.net/ipa/json failed with [Errno 111] Connection
refused
cannot connect to 'any of the configured servers':
https://ipa.example.net/ipa/json,
https://replica.example.net/ipa/json
The ipa-certupdate command failed.
Tried to restart the replica with ipactl restart:
2021-04-19T11:59:16Z DEBUG The CA status is: check interrupted due to error: Retrieving CA
status failed with status 500
2021-04-19T11:59:16Z DEBUG Waiting for CA to start...
2021-04-19T11:59:17Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and
run command ipa-server-upgrade manually.
From the log file:
2021-04-19T11:59:17Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line
56, in run
raise admintool.ScriptError(str(e))
2021-04-19T11:59:17Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError:
CA did not start in 300.0s
2021-04-19T11:59:17Z ERROR CA did not start in 300.0s
2021-04-19T11:59:17Z ERROR The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
Output of keytool -printcert -v -file fullchain.pem
Certificate[1]:
Owner:
CN=ipa.example.net
Issuer: CN=R3, O=Let's Encrypt, C=US
Serial number: 313e7850b8f8bb0617d9b0c5d714e2db2ca
Valid from: Sat Feb 20 21:38:27 CET 2021 until: Fri May 21 22:38:27 CEST 2021
Certificate fingerprints:
MD5: 47:0C:53:90:E1:D4:CC:25:85:CB:57:74:E6:DC:57:CA
SHA1: 7B:71:FC:C5:F2:30:86:0F:BA:94:35:86:3F:F7:E4:D1:63:9B:06:DF
SHA256:
1B:42:90:7F:C6:0D:4A:50:2C:40:F4:56:8C:63:86:77:64:46:AC:F4:D6:6A:ED:1F:23:77:1D:4F:17:38:25:75
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3
Extensions:
#1: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=false
0000: 04 81 F1 00 EF 00 75 00 94 20 BC 1E 8E D5 8D 6C ......u.. .....l
0010: 88 73 1F 82 8B 22 2C 0D D1 DA 4D 5E 6C 4F 94 3D .s...",...M^lO.=
0020: 61 DB 4E 2F 58 4D A2 C2 00 00 01 77 C1 61 2E B3 a.N/XM.....w.a..
0030: 00 00 04 03 00 46 30 44 02 20 65 CB 18 F8 F6 51 .....F0D. e....Q
0040: 75 FE 84 CC 02 FF 15 05 E1 99 AD F2 BA 38 A4 47 u............8.G
0050: 57 06 B1 0D CF 9B 37 6B 00 20 02 20 4B 58 9F AA W.....7k. . KX..
0060: 34 81 B2 B7 C1 1C 11 9C 5D D3 BC D8 73 BE AE 42 4.......]...s..B
0070: 17 DB 82 E3 04 E9 D6 EA 67 DE CA 07 00 76 00 F6 ........g....v..
0080: 5C 94 2F D1 77 30 22 14 54 18 08 30 94 56 8E E3 \./.w0".T..0.V..
0090: 4D 13 19 33 BF DF 0C 2F 20 0B CC 4E F1 64 E3 00 M..3.../ ..N.d..
00A0: 00 01 77 C1 61 2E 90 00 00 04 03 00 47 30 45 02 ..w.a.......G0E.
00B0: 20 66 42 EA 9F 97 DA BA 25 DB BC 0F 46 3A F2 71 fB.....%...F:.q
00C0: 1C 95 7D F2 E7 5E 4F 72 0D 3C 85 BA BD AB AF 00 .....^Or.<......
00D0: 1F 02 21 00 BF E8 C3 B3 48 2D 56 98 E6 EB 21 69 ..!.....H-V...!i
00E0: 39 EA 7D 31 2D 2B 5D 90 F7 F3 CF 04 B8 E3 BD 49 9..1-+]........I
00F0: ED 31 4B 00 .1K.
#2: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
[
accessMethod: ocsp
accessLocation: URIName:
http://r3.o.lencr.org
,
accessMethod: caIssuers
accessLocation: URIName:
http://r3.i.lencr.org/
]
]
#3: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 14 2E B3 17 B7 58 56 CB AE 50 09 40 E6 1F AF 9D .....XV..P.@....
0010: 8B 14 C2 C6 ....
]
]
#4: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
CA:false
PathLen: undefined
]
#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
[CertificatePolicyId: [2.23.140.1.2.1]
[] ]
[CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1]
[PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.1
qualifier: 0000: 16 1A 68 74 74 70 3A 2F 2F 63 70 73 2E 6C 65 74 ..http://cps.let
0010: 73 65 6E 63 72 79 70 74 2E 6F 72 67
sencrypt.org
]] ]
]
#6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
serverAuth
clientAuth
]
#7: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
DigitalSignature
Key_Encipherment
]
#8: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName:
ipa.example.net
]
#9: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: A5 19 02 C5 18 FB A5 68 30 32 6C 3E A6 2F F8 96 .......h02l>./..
0010: F8 11 DF 6A ...j
]
]
Certificate[2]:
Owner: CN=R3, O=Let's Encrypt, C=US
Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co.
Serial number: 400175048314a4c8218c84a90c16cddf
Valid from: Wed Oct 07 21:21:40 CEST 2020 until: Wed Sep 29 21:21:40 CEST 2021
Certificate fingerprints:
MD5: 31:21:28:F5:A0:ED:7B:A5:4B:65:82:92:87:56:BA:83
SHA1: 48:50:4E:97:4C:0D:AC:5B:5C:D4:76:C8:20:22:74:B2:4C:8C:71:72
SHA256:
73:0C:1B:DC:D8:5F:57:CE:5D:C0:BB:A7:33:E5:F1:BA:5A:92:5B:2A:77:1D:64:0A:26:F7:A4:54:22:4D:AD:3B
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3
Extensions:
#1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
[
accessMethod: caIssuers
accessLocation: URIName:
http://apps.identrust.com/roots/dstrootcax3.p7c
]
]
#2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B 90 75 FF C4 15 .....,q...K.u...
0010: 60 85 89 10 `...
]
]
#3: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
CA:true
PathLen:0
]
#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
[DistributionPoint:
[URIName:
http://crl.identrust.com/DSTROOTCAX3CRL.crl]
]]
#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
[CertificatePolicyId: [2.23.140.1.2.1]
[] ]
[CertificatePolicyId: [1.3.6.1.4.1.44947.1.1.1]
[PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.1
qualifier: 0000: 16 22 68 74 74 70 3A 2F 2F 63 70 73 2E 72 6F 6F
."http://cps.roo
0010: 74 2D 78 31 2E 6C 65 74 73 65 6E 63 72 79 70 74 t-x1.letsencrypt
0020: 2E 6F 72 67 .org
]] ]
]
#6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
serverAuth
clientAuth
]
#7: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
DigitalSignature
Key_CertSign
Crl_Sign
]
#8: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 14 2E B3 17 B7 58 56 CB AE 50 09 40 E6 1F AF 9D .....XV..P.@....
0010: 8B 14 C2 C6 ....
]
]