thanks for answering! Please see my answers below.
Ivars Strazdins via FreeIPA-users wrote:Hi guys,
after upgrading FreeIPA from 4.6.8 to 4.9.8 I was able to run
ipa-healthcheck for the first time.
Now I am facing two errors:
# ipa-healthcheck
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
Unhandler rdtype 256
[
{
"source": "pki.server.healthcheck.meta.csconfig",
"check": "CADogtagCertsConfigCheck",
* "result": "ERROR",*
"uuid": "92710f34-de94-4226-a81c-3e1d116c6410",
"when": "20220707130401Z",
"duration": "0.324141",
"kw": {
"key": "ca_signing",
"nickname": "caSigningCert cert-pki-ca",
"directive": "ca.signing.cert",
"configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg",
"msg": "Certificate 'caSigningCert cert-pki-ca' does not match
the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg"
}
},
This compares the value of the certificate in the NSS database to thevalue in CS.cfg. They should match.{
"source": "ipahealthcheck.ipa.certs",
"check": "IPADogtagCertsMatchCheck",
* "result": "ERROR",*
"uuid": "b26ad134-e798-4e21-961a-bc17899ac267",
"when": "20220707130408Z",
"duration": "0.162734",
"kw": {
"key": "caSigningCert cert-pki-ca",
"nickname": "caSigningCert cert-pki-ca",
"dbdir": "/etc/pki/pki-tomcat/alias",
"msg": "{nickname} certificate in NSS DB {dbdir} does not
match entry in LDAP"
}
}
I find it unusual that the CA certificate is different in two differentplaces, both CS.cfg and LDAP. It could be a formatting differencebetween the two.It's also strange that the IPA CA is included twice in the pki database.The caSigningCert cert-pki-ca and EXAMPLE.COM IPA CA should be the samecertificate. Can you confirm that they are?
Yes I get exactly the same output when I run commands
certutil -L -d /etc/pki/pki-tomcat/alias -a -n ‘
DOMAIN.COM IPA CA’
and
certutil -L -d /etc/pki/pki-tomcat/alias -a -n 'caSigningCert cert-pki-ca’
Did you happen to run ipa-cacert-manage renew some time in the past?
Not that I remember doing that recently, but this particular FreeIPA instance is runnig for 5 years (CA being generated in July 2017) and I may not remember everything.
Then again, I can’t remember any particular reason to run ipa-cacert-manage.
With kind regards,
Ivars
rob]
certutil output is:
# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
CN=ISRG Root X1,O=Internet Security Research Group,C=US C,,
CN=ISRG Root X2,O=Internet Security Research Group,C=US C,,
CN=R3,O=Let's Encrypt,C=US C,,
CN=E1,O=Let's Encrypt,C=US C,,
CN=R4,O=Let's Encrypt,C=US C,,
CN=E2,O=Let's Encrypt,C=US C,,
caSigningCert cert-pki-ca CTu,Cu,Cu
ocspSigningCert cert-pki-ca u,u,u
auditSigningCert cert-pki-ca u,u,Pu
subsystemCert cert-pki-ca u,u,u
EXAMPLE.COM <http://EXAMPLE.COM> IPA CA
CTu,Cu,Cu
Server-Cert cert-pki-ca u,u,u
How do I fix these errors?
To explain above Letsencrypt certificates - our IPA servers Directory
server and Apache server use Letsencrypt certificates that have been
added to FreeIPA with command “ipa-server-certinstall -w -d ..."