Hi guys.
That is quite bizarre, don't you think? It's a first master installation.
Configuring directory server (dirsrv) [1/3]: configuring TLS for DS instance [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n', 'PRIV.COM IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n') CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n', 'PRIV.COM IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n') The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
It's a new install, certainly there is no '/etc/dirsrv/slapd-PRIV-COM' prior to install. regards, L.
Hi, the issue looks similar to https://pagure.io/freeipa/issue/8614. Did you try installation on a node which was previously installed? There may be a remaining cert in /etc/ipa/ca.crt or in the system-wide trust store (for instance check in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem). If the previous installation had the same domain name, the CA cert subject is the same and the installer tries to import a CA cert similar to the previous one but generated with a different key.
If that's the case you need to uninstall ipa with ipa-server-install --uninstall -U, then delete /etc/ipa/ca.crt and run update-ca-trust + ensure the CA has been removed from /etc/pki/ca-trust. flo
On Sat, May 1, 2021 at 7:51 PM lejeczek via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi guys.
That is quite bizarre, don't you think? It's a first master installation.
Configuring directory server (dirsrv) [1/3]: configuring TLS for DS instance [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n', 'PRIV.COM IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n') CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n', 'PRIV.COM IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n') The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
It's a new install, certainly there is no '/etc/dirsrv/slapd-PRIV-COM' prior to install. regards, L. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
On 03/05/2021 08:50, Florence Renaud wrote:
Hi, the issue looks similar to https://pagure.io/freeipa/issue/8614 https://pagure.io/freeipa/issue/8614. Did you try installation on a node which was previously installed? There may be a remaining cert in /etc/ipa/ca.crt or in the system-wide trust store (for instance check in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem). If the previous installation had the same domain name, the CA cert subject is the same and the installer tries to import a CA cert similar to the previous one but generated with a different key.
If that's the case you need to uninstall ipa with ipa-server-install --uninstall -U, then delete /etc/ipa/ca.crt and run update-ca-trust + ensure the CA has been removed from /etc/pki/ca-trust. flo
Yes, there was IPA deployed before on the box but also was IPA uninstalled and uninstaller claimed it was successful. Should that not be enough, uninstaller succeeding? There was, certainly not consciously, no IPA's cert put into system-wide store. Cannot troubleshoot unfortunately as a clean-slate kvm vm rollback was the quick "fix" I did.
On Sat, May 1, 2021 at 7:51 PM lejeczek via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
Hi guys. That is quite bizarre, don't you think? It's a first master installation. Configuring directory server (dirsrv) [1/3]: configuring TLS for DS instance [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n', 'PRIV.COM <http://PRIV.COM> IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n') CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n', 'PRIV.COM <http://PRIV.COM> IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n') The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information It's a new install, certainly there is no '/etc/dirsrv/slapd-PRIV-COM' prior to install. regards, L. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org <https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure>
On Mon, May 3, 2021 at 1:30 PM lejeczek via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
On 03/05/2021 08:50, Florence Renaud wrote:
Hi, the issue looks similar to https://pagure.io/freeipa/issue/8614 https://pagure.io/freeipa/issue/8614. Did you try installation on a node which was previously installed? There may be a remaining cert in /etc/ipa/ca.crt or in the system-wide trust store (for instance check in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem). If the previous installation had the same domain name, the CA cert subject is the same and the installer tries to import a CA cert similar to the previous one but generated with a different key.
If that's the case you need to uninstall ipa with ipa-server-install --uninstall -U, then delete /etc/ipa/ca.crt and run update-ca-trust + ensure the CA has been removed from /etc/pki/ca-trust. flo
Yes, there was IPA deployed before on the box but also was IPA uninstalled and uninstaller claimed it was successful. Should that not be enough, uninstaller succeeding?
Yes, a successful uninstallation should have cleaned up the trust store, but bugs happen... flo
There was, certainly not consciously, no IPA's cert put into
system-wide store. Cannot troubleshoot unfortunately as a clean-slate kvm vm rollback was the quick "fix" I did.
On Sat, May 1, 2021 at 7:51 PM lejeczek via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
Hi guys. That is quite bizarre, don't you think? It's a first master installation. Configuring directory server (dirsrv) [1/3]: configuring TLS for DS instance [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n', 'PRIV.COM <http://PRIV.COM> IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n') CalledProcessError(Command ['/usr/bin/certutil', '-d', 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n', 'PRIV.COM <http://PRIV.COM> IPA CA', '-t', 'CT,C,C', '-a', '-f', '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned non-zero exit status 255: 'certutil: could not decode certificate: SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.\n') The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information It's a new install, certainly there is no '/etc/dirsrv/slapd-PRIV-COM' prior to install. regards, L. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
<
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure>
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
freeipa-users@lists.fedorahosted.org