On 3/19/19 11:08 AM, Marisa Sandhoff via FreeIPA-users wrote:
Dear all,
thank you very much for your help.
After some more searching, I found that this command (from
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...)
[root@ipa2 ~] certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
cert-pki-ca'
shows that there is a valid certificate:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: ...
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: "CN=Certificate Authority,O=PLEIADES.UNI-WUPPERTAL.DE"
Validity:
Not Before: Fri Jan 25 08:55:41 2019
Not After : Thu Jan 14 08:55:41 2021
Subject: "CN=CA Subsystem,O=PLEIADES.UNI-WUPPERTAL.DE"
Subject Public Key Info:
Public Key Algorithm: PKCS #1 RSA Encryption
RSA Public Key:
But then I get:
[root@ipa2 ~]# grep internal /var/lib/pki/pki-tomcat/conf/password.conf
| cut -d= -f2 > /tmp/pwdfile.txt
[root@ipa2 ~]# certutil -K -d /etc/pki/pki-tomcat/alias -f
/tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca'
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
Key and Certificate Services"
certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized
Object Identifier.
[root@ipa2 ~]# certutil -K -d /etc/pki/pki-tomcat/alias -f
/tmp/pwdfile.txt -n 'NSS Certificate DB: subsystemCert cert-pki-ca'
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
Key and Certificate Services"
certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized
Object Identifier.
[root@ipa2 ~]#
What can I do?????
Hi Marisa,
this may be a red herring. Did you try the next steps (comparison of the
uid=pkidbuser,ou=people,o=ipaca usercertificate with the cert stored in
/etc/pki/pki-tomcat/alias)?
flo
Thanks a lot!!!
Best regards,
Marisa