Hello Rob,
thanks for answering! Please see my answers below.

On 7 Jul 2022, at 17:13, Rob Crittenden <rcritten@redhat.com> wrote:

Ivars Strazdins via FreeIPA-users wrote:
Hi guys,
after upgrading FreeIPA from 4.6.8 to 4.9.8 I was able to run
ipa-healthcheck for the first time.
Now I am facing two errors:

# ipa-healthcheck 
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256

[
{
"source": "pki.server.healthcheck.meta.csconfig",
"check": "CADogtagCertsConfigCheck",
*  "result": "ERROR",*
"uuid": "92710f34-de94-4226-a81c-3e1d116c6410",
"when": "20220707130401Z",
"duration": "0.324141",
"kw": {
"key": "ca_signing",
"nickname": "caSigningCert cert-pki-ca",
"directive": "ca.signing.cert",
"configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg",
"msg": "Certificate 'caSigningCert cert-pki-ca' does not match
the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg"
}
},

This compares the value of the certificate in the NSS database to the
value in CS.cfg. They should match.

{
"source": "ipahealthcheck.ipa.certs",
"check": "IPADogtagCertsMatchCheck",
*  "result": "ERROR",*
"uuid": "b26ad134-e798-4e21-961a-bc17899ac267",
"when": "20220707130408Z",
"duration": "0.162734",
"kw": {
"key": "caSigningCert cert-pki-ca",
"nickname": "caSigningCert cert-pki-ca",
"dbdir": "/etc/pki/pki-tomcat/alias",
"msg": "{nickname} certificate in NSS DB {dbdir} does not
match entry in LDAP"
}
}


I find it unusual that the CA certificate is different in two different
places, both CS.cfg and LDAP. It could be a formatting difference
between the two.

It's also strange that the IPA CA is included twice in the pki database.
The caSigningCert cert-pki-ca and EXAMPLE.COM IPA CA should be the same
certificate. Can you confirm that they are?

Yes I get exactly the same output when I run commands
certutil -L -d /etc/pki/pki-tomcat/alias -a -n ‘DOMAIN.COM IPA CA’

and 
certutil -L -d /etc/pki/pki-tomcat/alias -a -n 'caSigningCert cert-pki-ca’


Did you happen to run ipa-cacert-manage renew some time in the past?

Not that I remember doing that recently, but this particular FreeIPA instance is runnig for 5 years (CA being generated in July 2017) and I may not remember everything.
Then again, I can’t remember any particular reason to run ipa-cacert-manage.

With kind regards,
Ivars


rob


]


certutil output is:

# certutil -L -d /etc/pki/pki-tomcat/alias/

Certificate Nickname  Trust
Attributes

SSL,S/MIME,JAR/XPI

CN=ISRG Root X1,O=Internet Security Research Group,C=US  C,, 
CN=ISRG Root X2,O=Internet Security Research Group,C=US  C,, 
CN=R3,O=Let's Encrypt,C=US  C,, 
CN=E1,O=Let's Encrypt,C=US  C,, 
CN=R4,O=Let's Encrypt,C=US  C,, 
CN=E2,O=Let's Encrypt,C=US  C,, 
caSigningCert cert-pki-ca  CTu,Cu,Cu
ocspSigningCert cert-pki-ca  u,u,u
auditSigningCert cert-pki-ca  u,u,Pu
subsystemCert cert-pki-ca  u,u,u
EXAMPLE.COM <http://EXAMPLE.COM> IPA CA 
CTu,Cu,Cu
Server-Cert cert-pki-ca  u,u,u


How do I fix these errors?
To explain above Letsencrypt certificates - our IPA servers Directory
server and Apache server use Letsencrypt certificates that have been
added to FreeIPA with command “ipa-server-certinstall -w -d ..."