Hi,
start by checking the certificates stored in the LDAP database (replace
$SUFFIX with your actual suffix):
# ldapsearch -D "cn=directory manager" -W -b
cn=certificates,cn=ipa,cn=etc,$SUFFIX
You will get a list of entries, one for each CA cert, each entry may
contain multiple values for the attribute "cACertificate;binary".
You need to make sure that the expected certs are present, and the
conflicting one (the cross-signed) is absent (otherwise it will get
re-added by ipa-certupdate on the other places).
Then look at the file /etc/ipa/ca.crt. You should make a backup copy of
this file and then edit it in order to remove the wrong CA cert and add the
right one. The file must contain the whole certificate chain.
The other places where the CA chain is needed are NSS databases,
/etc/ipa/nssdb, /etc/httpd/alias, /etc/dirsrv/slapd-$DOMAIN but IIRC they
can be updated later by re-running ipa-certupdate once the /etc/ipa/ca.crt
file is fixed.
Let me know if it solves your issue.
flo
On Fri, Oct 8, 2021 at 10:51 AM Stefan Fleischmann via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
I've tried that actually, but then I'm also getting an error
cannot connect to 'https://XXXX/ipa/json': [SSL:
CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has
expired (_ssl.c:1131)
The ipa-certupdate command failed.
My certificate is still valid, so this must also be related to the expired
root CA. Is there a manual way to update the NSS database? Our FreeIPA
version is 4.8.10 by the way. I remember fixing the NSS db on an older
installation at some time, but I haven't found the db location on this new
installation yet.
I guess I could reconfigure Apache to use a different certificate or even
a self-signed one to get `ipa-certupdate` working again.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure