Thanks for pointing me in the right direction. I created a PKCS#12 file with the
certificate, private key and the full certificate chain and tried to install it, but it
needed to have my CA's cert installed, which it said to do with
"ipa-cacert-manage" and "ipa-certupdate". The install step succeeded
but the certupdate one failed with:
sudo ipa-certupdate --verbose
ipapython.admintool: DEBUG: Not logging to a file
ipalib.rpc: INFO: trying
https://aaa.mgmt.lax4.internal/ipa/json
ipalib.backend: DEBUG: Created connection context.rpcclient_140007360051600
ipalib.rpc: INFO: [try 1]: Forwarding 'schema' to json server
'https://aaa.mgmt.lax4.internal/ipa/json'
ipalib.rpc: DEBUG: New HTTP connection (aaa.mgmt.lax4.internal)
ipalib.rpc: DEBUG: HTTP connection destroyed (aaa.mgmt.lax4.internal)
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in
single_request
self.get_auth_info()
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in
get_auth_info
self._handle_exception(e, service=service)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 608, in
_handle_exception
raise errors.CCacheError()
CCacheError: did not receive Kerberos credentials
ipalib.backend: DEBUG: Destroyed connection context.rpcclient_140007360051600
ipapython.admintool: DEBUG: File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py",
line 59, in run
api.finalize()
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 739, in
finalize
self.__do_if_not_done('load_plugins')
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in
__do_if_not_done
getattr(self, name)()
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in
load_plugins
for package in self.packages:
File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 949, in
packages
ipaclient.remote_plugins.get_package(self),
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py",
line 134, in get_package
plugins = schema.get_package(server_info, client)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 553, in get_package
schema = Schema(client)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 401, in __init__
fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 426, in _fetch
schema = client.forward(u'schema', **kwargs)['result']
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in forward
return self._call_command(command, params)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in
_call_command
return command(*params)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in _call
return self.__request(name, args)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in
__request
verbose=self.__verbose >= 3,
File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request
return self.single_request(host, handler, request_body, verbose)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in
single_request
self.get_auth_info()
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in
get_auth_info
self._handle_exception(e, service=service)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 608, in
_handle_exception
raise errors.CCacheError()
ipapython.admintool: DEBUG: The ipa-certupdate command failed, exception: CCacheError: did
not receive Kerberos credentials
ipapython.admintool: ERROR: did not receive Kerberos credentials
ipapython.admintool: ERROR: The ipa-certupdate command failed.
Not sure what Kerberos has to do with it.