Sean McLennan via FreeIPA-users wrote:
I swear I have been reading and trying everything I can find on here
and elsewhere today and I'm still having problems fixing my certs.
As appears to be a common problem, certmonger didn't auto-renew any of them.
IPA v4.6.9 running on Ubuntu 18.04; only the one server
Did you build this yourself? What is the history of this installation?
Were there other servers at some point?
IPA RA is fine
ldap and krbtgt are "CA UNREACHABLE": Server at
https://ipa01.simplyws.com/ipa/xml failed request, will retry: 903 (RPC failed at server.
an internal error has occurred).
Check the Apache error log.
Everything else is NEED_CSR_GEN_PIN including HTTP
This suggests the tracking is really messed up. Can you provide the
output of getcert list?
Possibly ipa-cert-fix or pki-server cert-fix would take care of it, but they aren't
in this version and I'm reluctant to upgrade the distro without proper preparation.
It wouldn't fix the 389 or Apache certs.
Everything starts without any problems. With the date set, everything is functioning like
normal as far as I can tell.
I have rolled back the date successfully making sure to respect the 'notbefore'
on ra-agent.pem
Does this suggest that the RA agent cert was renewed at some point?
I've tried both manually: getcert resubmit -i xxx and restarting certmonger to no
avail...
cn=ipa,cn=cas,cn=ca,$BASEDN and ou=authorities,ou=ca,o=ipaca appear to be fine.
Everything in /var/log/pki/pki-tomcat/ca/debug is FINE
There are some errors about missing .jar files in /var/log/pki/pki-tomcat/pki/debug
/var/log/ipa and /var/log/dirsrv don't seem to have anything of note.
Any thoughts would be greatly appreciated!
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...