On 1/14/20 11:41 PM, Ferdinand Babas via FreeIPA-users wrote:
> On 1/9/20 6:44 AM, Ferdinand Babas via FreeIPA-users wrote:
> Hi,
>
> you need to carefully pick the date in the past. At that given date, all
> your certs must be valid (ie notbefore < date < notafter). It's likely
> that you choose a date before the notbefore date of some of the certs.
>
> flo
Hi flo,
Still working on this and I'm unsure exactly what to do next. Here are the Not
Before and Not After dates of all the certs:
/etc/dirsrv/slapd-CFHT-HAWAII-EDU,nickname='Server-Cert'
Not Before: Sat May 18 19:15:24 2019
Not After : Tue May 18 19:15:24 2021
/etc/httpd/alias,nickname='Server-Cert'
Not Before: Sat May 18 19:15:34 2019
Not After : Tue May 18 19:15:34 2021
/etc/httpd/alias,nickname='ipaCert'
Not Before: Wed Jun 14 06:06:40 2017
Not After : Tue Jun 04 06:06:40 2019
/etc/pki/pki-tomcat/alias,nickname='auditSigningCert cert-pki-ca'
Not Before: Wed Jun 14 20:45:05 2017
Not After : Tue Jun 04 20:45:05 2019
/etc/pki/pki-tomcat/alias,nickname='ocspSigningCert cert-pki-ca'
Not Before: Sat Jun 01 10:29:31 2019
Not After : Fri May 21 10:29:31 2021
/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca
Not Before: Thu Jun 29 04:28:11 2017
Not After : Wed Jun 19 04:28:11 2019
/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca
Not Before: Wed Jul 22 14:25:13 2015
Not After : Sun Jul 22 14:25:13 2035
/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca'
Not Before: Tue May 07 19:15:22 2019
Not After : Mon Apr 26 19:15:22 2021
From what I can tell setting the date to 2019-06-02 should be fine so I did that and
restarted pki-tomcatd (which starts up fine when back dated).
Agreed, any date
between June 1 and June 4 should be ok.
When I restart certmonger I'm getting log messages of:
Jun 3 00:00:24 francolin ns-slapd: [03/Jun/2019:00:00:24.572219961 -1000] csngen_new_csn
- Warning: too much time skew (-19483202 secs). Current seqnum=1
Jun 3 00:00:24 francolin ns-slapd: GSSAPI Error: Unspecified GSS failure. Minor code
may provide more information (Ticket not yet valid)
Jun 3 00:00:24 francolin ns-slapd: [03/Jun/2019:00:00:24.612098416 -1000] csngen_new_csn
- Warning: too much time skew (-19483203 secs). Current seqnum=1
Jun 3 00:00:24 francolin ns-slapd: [03/Jun/2019:00:00:24.628118429 -1000] csngen_new_csn
- Warning: too much time skew (-19483204 secs). Current seqnum=1
And getcert list displays the following:
...
Request ID '20170614061938':
status: NEED_CSR_GEN_TOKEN
ipaCert is the most important cert to renew and should
be handled first.
The man page for getcert-list explains this error as:
NEED_CSR_GEN_TOKEN
The service was unable to find the token in which the
key pair
is supposed to be stored.
So I would check if /etc/httpd/alias has the right permissions, if
/etc/httpd/alias/pwdfile.txt contains the password for /etc/httpd/alias
and has the right permissions.
On a RHEL 7.2 system I can see:
[root ~]# ls -ld /etc/httpd/alias/
drwxr-xr-x. 2 root root 4096 Jan 15 10:48 /etc/httpd/alias/
[root ~]# ls -l /etc/httpd/alias/
total 188
-r--r--r--. 1 root root 1427 Jan 15 10:48 cacert.asc
-r--r--r--. 1 root root 1427 Jan 13 14:19 cacert.asc.orig
-rw-rw----. 1 root apache 65536 Jan 15 10:49 cert8.db
-rw-rw----. 1 root apache 65536 Jan 13 14:27 cert8.db.orig
-rw-------. 1 root root 5872 Nov 16 2018 install.log
-rw-rw----. 1 root apache 16384 Jan 15 10:49 key3.db
-rw-rw----. 1 root apache 16384 Jan 13 14:27 key3.db.orig
-r--r-----. 1 root apache 3481 Jan 15 10:47 kra-agent.pem
lrwxrwxrwx. 1 root root 33 Nov 16 2018 libnssckbi.so ->
../../..//usr/lib64/libnssckbi.so
-rw-rw----. 1 root apache 20 Jan 15 10:47 pwdfile.txt
-rw-rw----. 1 root apache 20 Jan 13 14:18 pwdfile.txt.orig
-rw-rw----. 1 root apache 16384 Jan 15 10:47 secmod.db
-rw-rw----. 1 root apache 16384 Jan 13 14:18 secmod.db.orig
And to check the password:
[root@ ~]# certutil -K -d /etc/httpd/alias/ -f /etc/httpd/alias/pwdfile.txt
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
Key and Certificate Services"
< 0> rsa 1b212c867ebde61fdc295ecd63ef690cd93fc783 NSS Certificate
DB:ipaCert
< 1> rsa da7a2b61ed951d1cfff1309534a3232258da9487 NSS Certificate
DB:Signing-Cert
< 2> rsa e5fdd7ec9d8daa97566695ac562fb1697a811401 NSS Certificate
DB:Server-Cert
(if the password file is wrong, you will see: Incorrect password/PIN
entered)
flo
stuck: yes
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LOCAL
subject: CN=IPA RA,O=LOCAL
expires: 2019-06-04 06:06:40 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20170614062601':
status: MONITORING
ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess"
replied: 1: You did not provide a valid certificate for this operation
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LOCAL
subject: CN=CA Audit,O=LOCAL
expires: 2019-06-04 20:45:05 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert
cert-pki-ca"
track: yes
auto-renew: yes
...
Request ID '20170614062603':
status: MONITORING
ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess"
replied: 1: You did not provide a valid certificate for this operation
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LOCAL
subject: CN=CA Subsystem,O=LOCAL
expires: 2019-06-19 04:28:11 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"
track: yes
auto-renew: yes
...
Thanks for all of your help.
Ferdinand
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...