Hi Rob,
On 7/18/19 3:06 PM, Rob Crittenden wrote:
Look in cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com to see if the
updated certificates are there. If they are then try to manually
resubmit the certmonger tracking for it.
For example, for the subsystem cert you'd do something like:
# getcert resubmit -d/etc/pki/pki-tomcat/alias/ -n 'subsystemCert
cert-pki-ca'
This should cause it to pull the updated cert from LDAP and apply it
locally.
Logging will go to the journal.
rob
AFAICS the new certificates are in ldap on the non-renewal masters (e.g.
ipa0). Here is the output of the suggested getcert session on ipa0:
[root@ipa0 ~]# date
Fri Jul 19 11:21:00 CEST 2019
[root@ipa0 ~]# getcert resubmit -d /etc/pki/pki-tomcat/alias/ -n 'subsystemCert
cert-pki-ca'
Resubmitting "20181031072253" to "dogtag-ipa-ca-renew-agent".
[root@ipa0 ~]# journalctl -xe
Jul 19 11:20:54 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Jul 19 11:20:54 ipa0.example.de server[2612]: at java.lang.Thread.run(Thread.java:748)
Jul 19 11:20:55 ipa0.example.de ns-slapd[2311]: [19/Jul/2019:11:20:55.391823929 +0200] -
ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 19 11:20:58 ipa0.example.de ns-slapd[2311]: [19/Jul/2019:11:20:58.417440591 +0200] -
ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 19 11:21:01 ipa0.example.de ns-slapd[2311]: [19/Jul/2019:11:21:01.443980720 +0200] -
ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 19 11:21:04 ipa0.example.de ns-slapd[2311]: [19/Jul/2019:11:21:04.509715298 +0200] -
ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 19 11:21:04 ipa0.example.de server[2612]: WARNING: Exception processing realm
com.netscape.cms.tomcat.ProxyRealm@775db907 background process
Jul 19 11:21:04 ipa0.example.de server[2612]: javax.ws.rs.ServiceUnavailableException:
Subsystem unavailable
Jul 19 11:21:04 ipa0.example.de server[2612]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Jul 19 11:21:04 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
Jul 19 11:21:04 ipa0.example.de server[2612]: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
Jul 19 11:21:04 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
Jul 19 11:21:04 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Jul 19 11:21:04 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Jul 19 11:21:04 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Jul 19 11:21:04 ipa0.example.de server[2612]: at java.lang.Thread.run(Thread.java:748)
Jul 19 11:21:07 ipa0.example.de ns-slapd[2311]: [19/Jul/2019:11:21:07.532994710 +0200] -
ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 19 11:21:10 ipa0.example.de ns-slapd[2311]: [19/Jul/2019:11:21:10.557979236 +0200] -
ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 19 11:21:13 ipa0.example.de ns-slapd[2311]: [19/Jul/2019:11:21:13.580909790 +0200] -
ERR - slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 19 11:21:14 ipa0.example.de dogtag-ipa-ca-renew-agent-submit[32209]: Updated
certificate not available
Jul 19 11:21:14 ipa0.example.de server[2612]: WARNING: Exception processing realm
com.netscape.cms.tomcat.ProxyRealm@775db907 background process
Jul 19 11:21:14 ipa0.example.de server[2612]: javax.ws.rs.ServiceUnavailableException:
Subsystem unavailable
Jul 19 11:21:14 ipa0.example.de server[2612]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Jul 19 11:21:14 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
Jul 19 11:21:14 ipa0.example.de server[2612]: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
Jul 19 11:21:14 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
Jul 19 11:21:14 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Jul 19 11:21:14 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Jul 19 11:21:14 ipa0.example.de server[2612]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Jul 19 11:21:14 ipa0.example.de server[2612]: at java.lang.Thread.run(Thread.java:748)
Please note the error message "Subsystem unavailable". Is this
pki-tomcatd?
[root@ipa0 ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: STOPPED
pki-tomcatd Service: STOPPED
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
Regards
Harri