On 11/18/20 5:23 PM, Corey Devenport via FreeIPA-users wrote:
Hi,
multiple certs have the same validity period and are likely to expire
and get renewed the same day, meaning that 804 is likely a completely
different cert.
I would rather add more debug information in order to understand what is
happening. You can create a file /etc/ipa/server.conf with the following
content:
# cat /etc/ipa/server.conf
[global]
debug=True
Then restart ipa with ipactl restart and check the logs in
/var/log/httpd/error_log. When you run the commands
# kinit admin
# ipa cert-show 1
this should trigger fresh traces in the error_log and may help diagnose.
You may also be able to see more info in /var/log/pki/pki-tomcat/ca/debug.
HTH,
flo
Here are the relevant lines from both /var/log/httpd/error_log and
/var/log/pki/pki-tomcat/ca/debug:
[Mon Nov 23 09:30:19.366663 2020] [ssl:error] [pid 22022:tid 139669164889856] [client
...:33510] AH: verify client post handshake
[Mon Nov 23 09:30:19.366732 2020] [ssl:error] [pid 22022:tid 139669164889856] [client
...:33510] AH02263: Re-negotiation handshake failed: Client certificate missing
[Mon Nov 23 09:30:19.369427 2020] [wsgi:error] [pid 22018:tid 139669101709056] [remote
...:33504] ipa: DEBUG: response status 403
2020-11-23 09:05:08 [ajp-nio-127.0.0.1-8009-exec-9] WARNING: CertProcessor: No
authenticator credentials required
2020-11-23 09:05:08 [ajp-nio-127.0.0.1-8009-exec-9] SEVERE: AgentCertAuthentication: No
SSL Client Certs Found
2020-11-23 09:05:08 [ajp-nio-127.0.0.1-8009-exec-9] SEVERE: CAProcessor: authentication
error: Invalid Credential.
It seems that it can't find the SSL Client Cert (is that the RA cert?) How would I go
about fixing this?