Anush Jayan via FreeIPA-users wrote:
Hi,
ipa: DEBUG: stderr=certutil: could not find certificate named
"Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.
i got this error
You could try adding a cert with this nickname to see if it proceeds.
Take a cert, any cert, and add it using the Server-Cert nickname:
# certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i
/path/to/cert
Then run ipa-server-certinstall again.
rob
Regards,
*Anush Jayan *
*Devops Engineer*
*
*
*TRACKPOINT GPS PVT. LTD.*
On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>> wrote:
Anush Jayan via FreeIPA-users wrote:
> im getting this error when i use the same password which i used for
> directory manager password
>
>
> Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert'
> returned non-zero exit status 255
> The ipa-server-certinstall command failed.
You might try passing -v to the command to get more output.
This particular error in itself isn't treated as fatal.
rob
>
>
> On Thu, Sep 27, 2018, 10:53 PM Anush Jayan
<anush(a)matchpointgps.com <mailto:anush@matchpointgps.com>
> <mailto:anush@matchpointgps.com
<mailto:anush@matchpointgps.com>>>
wrote:
>
> yes it is encrypted but i have created ssl using letsencrypt
and it
> is passwordless i dont know which password i should insert when it
> ask to enter password for private key
> do you know any other way by which i can use letsencrypt
> fullchain.pem chain.pem and privkey pem as ssl
>
> On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden
<rcritten(a)redhat.com <mailto:rcritten@redhat.com>
> <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>
wrote:
>
> Anush Jayan wrote:
> > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
DTSRootCAX3.pem|
> >
> > |
> >
> > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
> >
> > |
> >
> > |ipa-certupdate |
> >
> > |
> >
> > |ipa-server-certinstall -w fullchain.pem privkey.pem|
> >
> > |then it askd me for directory manager password|
> >
> > |then it was asking for something private key unlock
password |
> >
> > |here i got atuck i dont know which password to insert|
>
> I can only assume that the private key is encrypted. You
need to
> provide
> the encryption key for it.
>
> If you look at the contents of privkey.pem and it starts with:
>
> -----BEGIN ENCRYPTED PRIVATE KEY-----
>
> then it is encrypted.
>
> rob
>
> >
> > |
> >
> > |
> >
> > |
> >
> >
> > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
> <rcritten(a)redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>
> > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote:
> >
> > Anush Jayan via FreeIPA-users wrote:
> > > im currently using freeipa 4.3.1 on ubuntu 16.04 im
> having trouble
> > installing letsencrypt ssl key for https can anyone help
> me fix this
> > >
> >
> > It would help if you said what you tried and what
you are
> seeing.
> >
> > rob
> >
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...