Hi,
let's get an accurate status first:
- how many IPA servers do you have with a CA role? ipa server-role-find
--role "CA server"
- among those, which one is the renewal master? ipa config-show | grep
renewal
- can you provide the full output of "getcert list" executed on the IPA
renewal master
- is the new root CA present in /etc/ipa/ca.crt (this file should contain
IPA CA cert + the new and old root ca)
- is the new root CA present in /etc/ipa/nssdb, /etc/httpd/alias,
/etc/dirsrv/slapd-xx, /etc/pki/pki-tomcat/alias ? Use certutil -L -d
<path/to/nssdb> to check the list of certs
- is the new IPA CA present in the same nss databases?
flo
On Fri, Mar 11, 2022 at 4:05 PM Eric Boisvert via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Good morning everyone,
Unfortunately before being able to renew my clients CA I need to fix an
issue that prevent FreeIPA from starting. With the help of a coworker we
found that pki-tomcatd failed to start.
We then found this documentation about the problem:
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
. If I'm not wrong it was written by Florence.
When I'm trying to read the /var/log/pki/pki-tomcat/ca/debug file it's
empty. From there I'm a bit lost and don't know where I can find useful log
to help me.
Should I start a new thread with this problem?
Also is it possible to do remote debugging, google meet, zoom, etc. with
someone to further help us with our problem?
Thanks again for your help and time.
Eric
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure