Hi,
this is the outputs:
[root@srv107 ipa]# openssl x509 -noout -in /var/lib/ipa/ra-agent.pem -serial -subject
-issuer -nameopt RFC2253
serial=15
subject=CN=IPA
[root@srv107 ipa]# openssl x509 -noout -in ra-agent.pem -serial -subject -issuer -nameopt
RFC2253
serial=15
subject=CN=IPA
[root@srv107 ipa]# ldapsearch -LLL -o ldif-wrap=no -x -D "cn=directory manager"
-W -b uid=ipara,ou=people,o=ipaca dn description usercertificate
Enter LDAP Password:
dn: uid=ipara,ou=people,o=ipaca
description: 2;21;CN=Certificate Authority,O=UNIX.domain.NET;CN=IPA
usercertificate::
MIIDccCCAlqgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA5MRcwFQYDVQQKDA5VTklYLkdPU0lYLk5FVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTE2MDcyODE0MTIyMFoXDTE4MDcxODE0MTIyMFowKjEXMBUGA1UECgwOVU5JWC5HT1NJWC5ORVQxDzANBfNVBAMMBklQQSBSQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMxnrp8441QA/vzIB/0a9kT5IAH9yACEx8lirOspAOmn8ziFYUvB4idMqd4wKpuIeFhl4LDMN++HJGsfAGbon7LQ0lvlxz16ntdMazfmqSCwgSycroDLJEBHZW0vC6NslOVI808nnc7D+xcrOaGFaisDbjWYFn9LQoBHOAACtgGHmLQWszsQyrZhg0zbhzHoBDfSu6UtyCIuDP4lQ3tZdnNygP1x8cEmCUrAzEl3wqY24aQHMF7RglAb+O7/9A8UURXMi6QwIkbyucPA3Wh+RdHy41xhqDI/bmcq7Nas814PIHjhZQJTT02tdEqYYDgmv/dNqfT/OkYUHNah2Jf8ZL0CAwEAAaOBkzCBkDAfBgNVHSMEGDAWgBROuje6JvS5f3aN0Qk0DRDGjOWHRjA+BggrBgEFBQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6Ly9zcnYxMDcuZ29zaXgubmV0OjgwL2NhL29jc3AwDgYDVR0PAQH/BAQDAg6wMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAi8CxlPVaFHi7XlT1sSY74WPy9BlZW/Dt9by94wDCs14pZeMalmwkY8iHkvQtTagoS7y/Nq0p7PTHbcr7y9CisiAP+DykYZHdIyBtjrQ37GIADjyXhbYJ+Y90O/J24M2q2t1X8xbSIhxqQ8eN4ICTDHqzBIn2YkAHxT1QkitNIZWlMSWdEImcpmQB5CIU1q8swaK6u1k5ksC4mNwUxkSzi1nr+ixuuIkSDjuC3f1kGOaJGV92fJRk+TbRvP6hxKMY9ITwy0upwcUvO/Sv8kdJ21pJ/VJmxfZDilHW6ZrZtME6zaMUmVCVmchxIV2jTvJ3PCAqly6fI41oOsEoPSYu1Q==
usercertificate::
MIIadDCCAlygAwIBAgIBFTANBgkqhkiG9w0BAQsFADA5MRcwFQYDVQQKDA5VTklYLkdPU0lYLk5FVDEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTE4MDYyMDE0MTI1MloXDTIwMDYwOTE0MTI1MlowKjEXMBUGA1UEChMOVU5JWC5HT1NJWC5ORVQxDzANBgNVBAMTBklQQSBSQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMxnrp8441QA/vzIB/0a9kT5IAH9yACEx8lirOspAOmn8ziFYUvB4idMqd4wKpuIeFhl4LDMN++HJGsfAGbon7LQ0lvlxz16ntdMazfmqSCwgSycroDLJEBHZW0vC6NslOVI808nnc7D+xcrOaGFaisDbjWYFn9LQoBHOAACtgGHmLQWszsQyrZhg0zbhzHoBDfSu6UtyCIuDP4lQ3tZdnNygP1x8cEmCUrAzEl3wqY24qQHMF7RglAb+O7/9A8UURXMi6QwIkbyucPA3Wh+RdHy41xhqDI/bmcq7Nas814PIHjhZQJTT02tdEqYYDgmv/dNqfT/OkYUHNah2Jf8ZL0CAwEAAaOBlTCBkjAfBgNVHSMEGDAWgBROuje6JvS5f3aN0Qk0DRDGjOWHRjBABggrBgEFBQcBAQQ0MDIwMAYIKwYBBQUHMAGGJGh0dHA6Ly9pcGEtY2EudW5peC5nb3NpeC5uZXQvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBPAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQB+WTlsE5LmEvbfEk/fOlKfwkNv187o/6AtwBxrjvC0D0QobfnxSIgd7R905haHf9fyONYsQKn8mlbghtY3URfGnfYNXJ9ez1pOqoCAlpy5Z5tvDlQMGvVVjk/9pSibTI90noZeMrUE+Tetq45c8ZjFXxcrH4R07xUDRXZg8AXviQMyclUSZbWKsIL7a979Hp13q8sJ8MAod1OhqdP6EOk84AOyRcQuRhv5uEdeDSN4k+4mMSZGnMlKO+0gKnhUIq63/TlW8wp7NhCE+kYdOkF4M0lBYOPE66d/4VdX45soMdp4WphjZMrirarhFJvHpHloUwdoiIFglPvOkvbWndbM
I can see that the serial is different but I cannot compare the usercertificate attributes
since they are not given in the openssl command output.
Shall I just adjust the serial and try again?
Jochen
On Friday, January 31, 2020 10:29 CET, Florence Blanc-Renaud via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
This error occurs when IPA framework tries to authenticate to Dogtag CA
and it fails. It is using the certificate located in
/var/lib/ipa/ra-agent.pem.
According to your getcert output, the cert is valid. You will need to
check if it is consistent with what is stored in LDAP.
Note the values related to the actual certificate:
$ cat /var/lib/ipa/ra-agent.pem
-----BEGIN CERTIFICATE-----
MII...NSF
-----END CERTIFICATE-----
$ openssl x509 -noout -in /var/lib/ipa/ra-agent.pem -serial -subject
-issuer -nameopt RFC2253
serial=<cert serial>
subject= CN=IPA RA,O=<your domain>
issuer= CN=Certificate Authority,O=<your domain>
Then compare the result with the ldapentry:
$ ldapsearch -LLL -o ldif-wrap=no -x -D "cn=directory manager" -W \
-b uid=ipara,ou=people,o=ipaca dn description usercertificate
Enter LDAP Password:
dn: uid=ipara,ou=people,o=ipaca
description: 2;23;CN=Certificate Authority,O=<your domain>;CN=IPA
RA,O=<your domain>
usercertificate:: MII..NSF
usercertificate:: MII...tKR/c
1/ The usercertificate attribute may contain multiple values. Make sure
that one of them corresponds to the value from the file
/var/lib/ipa/ra-agent.pem.
2/ The description attribute must contain 2;<cert serial>;<cert
issuer>;<cert subject>
If it's not the case you can use ldapmodify to update the ldap entry
with what is expected.
HTH,
flo
2020-01-30T22:45:09Z DEBUG The ipa-server-upgrade command failed,
exception: RemoteRetrieveError: Failed to authenticate to CA REST API
2020-01-30T22:45:09Z ERROR Unexpected error - see
/var/log/ipaupgrade.log for details:
RemoteRetrieveError: Failed to authenticate to CA REST API
2020-01-30T22:45:09Z ERROR The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
[root@srv107 ipa]# getcert list
Number of certificates and requests being tracked: 9.
Request ID '20171212100014':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: SelfSign
issuer:
CN=srv107.domain.net,O=UNIX.domain.net
subject:
CN=srv107.domain.net,O=UNIX.domain.net
expires: 2020-10-17 12:00:24 CEST
principal name: krbtgt/UNIX.domain.net(a)UNIX.domain.net
certificate template/profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
Request ID '20190904114922':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=UNIX.domain.net
subject: CN=CA
Audit,O=UNIX.domain.net
expires: 2020-06-09 16:12:06 CEST
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190904114923':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=UNIX.domain.net
subject: CN=OCSP
Subsystem,O=UNIX.domain.net
expires: 2020-06-09 16:12:03 CEST
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190904114924':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=UNIX.domain.net
subject: CN=CA
Subsystem,O=UNIX.domain.net
expires: 2020-06-09 16:12:05 CEST
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190904114925':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=UNIX.domain.net
subject: CN=Certificate
Authority,O=UNIX.domain.net
expires: 2036-07-28 16:11:50 CEST
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190904114926':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=UNIX.domain.net
subject:
CN=srv107.domain.net,O=UNIX.domain.net
expires: 2020-06-09 16:12:14 CEST
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190904114927':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate
Authority,O=UNIX.domain.net
subject: CN=IPA
RA,O=UNIX.domain.net
expires: 2020-06-09 16:12:52 CEST
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20190904114928':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-UNIX-domain.net-NET',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-UNIX-domain.net-NET/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-UNIX-domain.net-NET',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate
Authority,O=UNIX.domain.net
subject:
CN=srv107.domain.net,O=UNIX.domain.net
expires: 2020-07-01 16:13:09 CEST
principal name: ldap/srv107.domain.net(a)UNIX.domain.net
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
UNIX-domain.net-NET
track: yes
auto-renew: yes
Request ID '20190904114929':
status: MONITORING
stuck: no
key pair storage:
type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/srv107.domain.net-443-RSA'
certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt'
CA: IPA
issuer: CN=Certificate
Authority,O=UNIX.domain.net
subject:
CN=srv107.domain.net,O=UNIX.domain.net
expires: 2020-07-01 16:18:01 CEST
principal name: HTTP/srv107.domain.net(a)UNIX.domain.net
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Thank you if you maybe find something I've overlooked.
Jochen
On Monday, January 20, 2020 13:15 CET, Florence Blanc-Renaud
<flo(a)redhat.com> wrote:
> On 1/20/20 9:39 AM, Jochen Demmer via FreeIPA-users wrote:
> > I suffer the exact same problem and already tried to upgrade twice but
> > every time the update fails.
> >
> > The ldap server does not listen when I check with ss or netstat.
> > I reverted back to Fedora 30 with snapshots every time.
> >
> Hi,
>
> can you paste the logs from /var/logs/ipaupgrade.log? We would need the
> full logs as the error may differ between a first run and a second run.
> When the packages are upgraded, the script ipa-server-upgrade is called
> and starts by disabling the LDAP server ports to avoid any LDAP
> operation during the upgrade. Then the script performs its duty, and
> re-enables the port.
> If there is an untrapped failure before the ports are re-enabled, or the
> user repeatedly presses CTRL-C, we sometimes end up in a situation where
> the ports are still disabled (please see ticket
>
https://pagure.io/freeipa/issue/7534) after the ipa-server-upgrade
> script exits. If the user re-runs ipa-server-upgrade at this point, the
> script output will be completely different but will not give us any hint
> related to the original failure root cause. That's why we need the full
> logs.
>
> If you are in a situation where the LDAP server isn't listening:
> 0. stop IPA with ipactl stop
> 1. edit /etc/dirsrv/slapd-EXAMPLE-COM/dse.ldif
> 2. set nsslapd-port to 389
> 3. set nsslapd-security to on
> 4. set nsslapd-global-backend-lock to off (if you have this attribute at
> all)
> 5. restart IPA with ipactl start
>
> If the services are able to restart at this point, try to run
> ipa-server-upgrade and provide full logs.
>
> HTH,
> flo
>
>
> > Can someone help me to work this around. The OP writes of an IP that
> > changed but mine didn't. Where can I find a clue why ldap does not
> listen?
> >
> > Jochen
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct:
> >
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> >
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> >
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: