I recently had the certificates I use on my FreeIPA server expire, preventing ipa from
starting. So I replaced them with the new ones, and IPA still wouldn't start,
whereupon after some digging I discovered the new certificates came with new Intermediate
and root certificates. So I installed those using ipa-cacert-manage, ran ipa-certupdate,
and then re-installed my certificates using ipa-server-certinstall, all of which appeared
to work. However, the IPA service still won't start, with the issue apparently being
that pki-tomcat isn't starting properly. Looking at the
/var/log/pki/pki-tomcat/ca/debug file shows that the reason for this is:
Internal Database Error encountered: Could not connect to LDAP server host
freeipaserver-a.ravnalaska.net<http://freeipaserver-a.ravnalaska.net> port 636 Error
netscape.ldap.LDAPException: Unable to create socket:
org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been marked as not
trusted by the user. (-1)
Ok, sounds simple enough, so how do I mark the Peer's certificate issuer as trusted?
Thanks.
-----------------------------------------------
Israel Brewster
Systems Analyst II
5245 Airport Industrial Rd
Fairbanks, AK 99709
(907) 450-7293
-----------------------------------------------
[cid:bbb3ec17-fa02-4086-bd73-424320375dec@flyravn.com]
[cid:87ffc6bc-252a-4547-aad0-730f4e1b9a16@flyravn.com]
Show replies by thread