Hi Ville,
it seems the same problem I faced some months ago with one of three
nodes. I searched for the issues and find a possible trouble with server
certificate after an upgrade (the field SubjectAltName is not created;
on the other )
try to:
1) check if the attribute is filled: (CLI) `openssl x509 -in
/var/kerberos/krb5kdc/kdc.crt -noout -text` (the value can even be
<unsupported> so it was on the other two nodes where I managed to login
(web GUI)
2) getcert list -f /var/kerberos/krb5kdc/kdc.crt (*note the request Id*
<request id>)
3) getcert resubmit -i <request id>
4) getcert list -i <request id>
5) ipactl restart
cheers
Stefano
On 2/26/22 10:23, Ville Teronen via FreeIPA-users wrote:
So I actually ended up creating a fresh replica with the latest
packages but it would end up 1:1 same state so I am guessing this has something to do with
openssl packages?
Here is a list of packages that dnf would upgrade on the tre-1 ipa-server that is
currently working and which I would prefer not to upgrade atleast before the tku-2 problem
is solved.
389-ds-base.x86_64
2.0.14-1.el9
389-ds-base-libs.x86_64
2.0.14-1.el9
NetworkManager.x86_64
1:1.36.0-0.9.el9
NetworkManager-libnm.x86_64
1:1.36.0-0.9.el9
NetworkManager-team.x86_64
1:1.36.0-0.9.el9
NetworkManager-tui.x86_64
1:1.36.0-0.9.el9
audit.x86_64
3.0.7-101.el9
audit-libs.x86_64
3.0.7-101.el9
bash.x86_64
5.1.8-4.el9
cairo.x86_64
1.17.4-7.el9
cairo-gobject.x86_64
1.17.4-7.el9
centos-gpg-keys.noarch 9.0-9.el9
centos-stream-release.noarch 9.0-9.el9
centos-stream-repos.noarch 9.0-9.el9
crypto-policies.noarch
20220203-1.gitf03e75e.el9
crypto-policies-scripts.noarch
20220203-1.gitf03e75e.el9
cryptsetup-libs.x86_64
2.4.3-4.el9
cups-libs.x86_64
1:2.3.3op2-11.el9
cyrus-sasl-gssapi.x86_64
2.1.27-19.el9
cyrus-sasl-lib.x86_64
2.1.27-19.el9
cyrus-sasl-md5.x86_64
2.1.27-19.el9
cyrus-sasl-plain.x86_64
2.1.27-19.el9
device-mapper.x86_64
9:1.02.183-4.el9
device-mapper-event.x86_64
9:1.02.183-4.el9
device-mapper-event-libs.x86_64
9:1.02.183-4.el9
device-mapper-libs.x86_64
9:1.02.183-4.el9
dnf.noarch
4.10.0-4.el9
dnf-data.noarch
4.10.0-4.el9
dnf-plugins-core.noarch
4.0.24-3.el9
dracut.x86_64
055-30.git20220216.el9
dracut-config-rescue.x86_64
055-30.git20220216.el9
dracut-network.x86_64
055-30.git20220216.el9
dracut-squash.x86_64
055-30.git20220216.el9
e2fsprogs.x86_64
1.46.5-2.el9
e2fsprogs-libs.x86_64
1.46.5-2.el9
expat.x86_64
2.2.10-9.el9
gawk.x86_64
5.1.0-6.el9
gawk-all-langpacks.x86_64
5.1.0-6.el9
glib2.x86_64
2.68.4-5.el9
glibc.x86_64
2.34-25.el9
glibc-common.x86_64
2.34-25.el9
glibc-gconv-extra.x86_64
2.34-25.el9
glibc-langpack-en.x86_64
2.34-25.el9
gnutls.x86_64
3.7.3-6.el9
gpgme.x86_64
1.15.1-6.el9
grub2-common.noarch
1:2.06-23.el9
grub2-pc.x86_64
1:2.06-23.el9
grub2-pc-modules.noarch
1:2.06-23.el9
grub2-tools.x86_64
1:2.06-23.el9
grub2-tools-minimal.x86_64
1:2.06-23.el9
grubby.x86_64
8.40-55.el9
gtk-update-icon-cache.x86_64
3.24.31-2.el9
gtk3.x86_64
3.24.31-2.el9
hwdata.noarch
0.348-9.3.el9
initscripts-service.noarch
10.11.2-1.el9
ipa-client.x86_64
4.9.8-5.el9
ipa-client-common.noarch
4.9.8-5.el9
ipa-common.noarch
4.9.8-5.el9
ipa-selinux.noarch
4.9.8-5.el9
ipa-server.x86_64
4.9.8-5.el9
ipa-server-common.noarch
4.9.8-5.el9
ipa-server-dns.noarch
4.9.8-5.el9
iptables-libs.x86_64
1.8.7-28.el9
iptables-nft.x86_64
1.8.7-28.el9
iwl100-firmware.noarch
39.31.5.1-124.el9
iwl1000-firmware.noarch
1:39.31.5.1-124.el9
iwl105-firmware.noarch
18.168.6.1-124.el9
iwl135-firmware.noarch
18.168.6.1-124.el9
iwl2000-firmware.noarch
18.168.6.1-124.el9
iwl2030-firmware.noarch
18.168.6.1-124.el9
iwl3160-firmware.noarch
1:25.30.13.0-124.el9
iwl5000-firmware.noarch
8.83.5.1_1-124.el9
iwl5150-firmware.noarch
8.24.2.2-124.el9
iwl6000g2a-firmware.noarch
18.168.6.1-124.el9
iwl6050-firmware.noarch
41.28.5.1-124.el9
iwl7260-firmware.noarch
1:25.30.13.0-124.el9
jss.x86_64
5.0.3-1.el9
kernel.x86_64
5.14.0-66.el9
kernel-core.x86_64
5.14.0-66.el9
kernel-modules.x86_64
5.14.0-66.el9
kernel-tools.x86_64
5.14.0-66.el9
kernel-tools-libs.x86_64
5.14.0-66.el9
kexec-tools.x86_64
2.0.23-8.el9
kpartx.x86_64
0.8.7-7.el9
libarchive.x86_64
3.5.3-1.el9 libcap.x86_64
2.48-8.el9
libcap-ng.x86_64
0.8.2-7.el9
libcap-ng-python3.x86_64
0.8.2-7.el9
libcom_err.x86_64
1.46.5-2.el9
libdnf.x86_64
0.65.0-3.el9
libgcc.x86_64
11.2.1-9.4.el9
libgcrypt.x86_64
1.10.0-2.el9
libgomp.x86_64
11.2.1-9.4.el9
libipa_hbac.x86_64
2.6.2-2.el9
libnfsidmap.x86_64
1:2.5.4-9.el9
libnsl2.x86_64
2.0.0-1.el9
libsemanage.x86_64 3.3-2.el9
libss.x86_64
1.46.5-2.el9
libsss_autofs.x86_64
2.6.2-2.el9
libsss_certmap.x86_64
2.6.2-2.el9
libsss_idmap.x86_64
2.6.2-2.el9
libsss_nss_idmap.x86_64
2.6.2-2.el9
libsss_sudo.x86_64
2.6.2-2.el9 libstdc++.x86_64
11.2.1-9.4.el9
libsysfs.x86_64
2.1.1-10.el9
libtool-ltdl.x86_64
2.4.6-45.el9
libusbx.x86_64
1.0.25-2.el9
libwbclient.x86_64
4.15.5-104.el9 libxslt.x86_64
1.1.34-9.el9
libzstd.x86_64
1.5.1-2.el9 linux-firmware.noarch
20211216-124.el9
linux-firmware-whence.noarch
20211216-124.el9
lua-posix.x86_64
35.0-6.el9
lvm2.x86_64
9:2.03.14-4.el9
lvm2-libs.x86_64
9:2.03.14-4.el9
microcode_ctl.noarch
4:20220207-1.el9
nfs-utils.x86_64
1:2.5.4-9.el9
nspr.x86_64
4.32.0-9.el9
nss.x86_64
3.71.0-7.el9
nss-softokn.x86_64
3.71.0-7.el9
nss-softokn-freebl.x86_64
3.71.0-7.el9
nss-sysinit.x86_64
3.71.0-7.el9
nss-tools.x86_64
3.71.0-7.el9
nss-util.x86_64
3.71.0-7.el9
oddjob.x86_64
0.34.7-5.el9
oddjob-mkhomedir.x86_64
0.34.7-5.el9
opencryptoki.x86_64
3.17.0-4.el9
opencryptoki-icsftok.x86_64
3.17.0-4.el9
opencryptoki-libs.x86_64
3.17.0-4.el9
openssh.x86_64
8.7p1-8.el9
openssh-clients.x86_64
8.7p1-8.el9
openssh-server.x86_64
8.7p1-8.el9
openssl.x86_64
1:3.0.1-12.el9
openssl-libs.x86_64
1:3.0.1-12.el9
openssl-perl.x86_64
1:3.0.1-12.el9
p11-kit.x86_64
0.24.1-2.el9
p11-kit-trust.x86_64
0.24.1-2.el9
perl-Net-SSLeay.x86_64
1.92-1.el9
policycoreutils.x86_64 3.3-5.el9
policycoreutils-python-utils.noarch 3.3-5.el9
protobuf-c.x86_64
1.3.3-12.el9
publicsuffix-list.noarch
20210518-3.el9
publicsuffix-list-dafsa.noarch
20210518-3.el9
python-unversioned-command.noarch
3.9.10-2.el9
python3.x86_64
3.9.10-2.el9
python3-audit.x86_64
3.0.7-101.el9
python3-cffi.x86_64
1.14.5-5.el9
python3-chardet.noarch
4.0.0-5.el9
python3-cryptography.x86_64
3.4.7-8.el9
python3-dnf.noarch
4.10.0-4.el9
python3-dnf-plugins-core.noarch
4.0.24-3.el9
python3-gpg.x86_64
1.15.1-6.el9
python3-hawkey.x86_64
0.65.0-3.el9
python3-idna.noarch
2.10-7.el9
python3-ipaclient.noarch
4.9.8-5.el9
python3-ipalib.noarch
4.9.8-5.el9
python3-ipaserver.noarch
4.9.8-5.el9
python3-lib389.noarch
2.0.14-1.el9
python3-libdnf.x86_64
0.65.0-3.el9
python3-libipa_hbac.x86_64
2.6.2-2.el9
python3-libs.x86_64
3.9.10-2.el9
python3-libsemanage.x86_64 3.3-2.el9
python3-lxml.x86_64
4.6.5-2.el9
python3-mod_wsgi.x86_64
4.7.1-9.el9
python3-pip-wheel.noarch
21.2.3-6.el9
python3-ply.noarch
3.11-14.el9
python3-policycoreutils.noarch 3.3-5.el9
python3-psutil.x86_64
5.8.0-12.el9
python3-pycparser.noarch
2.20-6.el9
python3-pysocks.noarch
1.7.1-12.el9
python3-pyyaml.x86_64
5.4.1-6.el9
python3-requests.noarch
2.25.1-6.el9
python3-rpm.x86_64
4.16.1.3-11.el9
python3-setuptools.noarch
53.0.0-10.el9
python3-setuptools-wheel.noarch
53.0.0-10.el9
python3-six.noarch
1.15.0-9.el9
python3-sss.x86_64
2.6.2-2.el9
python3-sss-murmur.x86_64
2.6.2-2.el9
python3-sssdconfig.noarch
2.6.2-2.el9
python3-unbound.x86_64
1.13.1-12.el9
python3-urllib3.noarch
1.26.5-3.el9
qemu-guest-agent.x86_64
17:6.2.0-9.el9
rpm.x86_64
4.16.1.3-11.el9 rpm-build-libs.x86_64
4.16.1.3-11.el9
rpm-libs.x86_64
4.16.1.3-11.el9
rpm-plugin-audit.x86_64
4.16.1.3-11.el9
rpm-plugin-selinux.x86_64
4.16.1.3-11.el9
rpm-plugin-systemd-inhibit.x86_64
4.16.1.3-11.el9
rpm-sign-libs.x86_64
4.16.1.3-11.el9
samba-client-libs.x86_64
4.15.5-104.el9
samba-common.noarch
4.15.5-104.el9
samba-common-libs.x86_64
4.15.5-104.el9
selinux-policy.noarch
34.1.26-1.el9
selinux-policy-targeted.noarch
34.1.26-1.el9
sg3_utils.x86_64
1.47-8.el9
sg3_utils-libs.x86_64
1.47-8.el9
slapi-nis.x86_64
0.56.7-4.el9
sssd-client.x86_64
2.6.2-2.el9
sssd-common.x86_64
2.6.2-2.el9
sssd-common-pac.x86_64
2.6.2-2.el9
sssd-dbus.x86_64
2.6.2-2.el9
sssd-ipa.x86_64
2.6.2-2.el9
sssd-kcm.x86_64
2.6.2-2.el9
sssd-krb5-common.x86_64
2.6.2-2.el9
sssd-nfs-idmap.x86_64
2.6.2-2.el9
sssd-tools.x86_64
2.6.2-2.el9
systemd.x86_64 250-3.el9
systemd-libs.x86_64 250-3.el9
systemd-pam.x86_64 250-3.el9
systemd-rpm-macros.noarch 250-3.el9
systemd-udev.x86_64 250-3.el9
tpm2-tss.x86_64
3.0.3-7.el9
unbound-libs.x86_64
1.13.1-12.el9
vim-minimal.x86_64
2:8.2.2637-14.el9
xfsprogs.x86_64
5.14.2-1.el9
yum.noarch
4.10.0-4.el9
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure