Hi Rob,
On 7/19/19 7:25 PM, Rob Crittenden wrote:
The log doesn't seem to say which cert isn't found. You could try again
and see what is being logged to find out what cert can't be found, and
potentially why.
This might be interesting. An ipactl restart gave me this in /var/log/messages:
Jul 22 16:58:25 ipa0 pkidaemon: ----------------------
Jul 22 16:58:25 ipa0 pkidaemon: Enabled all subsystems
Jul 22 16:58:25 ipa0 pkidaemon: ----------------------
Jul 22 16:58:25 ipa0 systemd: Started PKI Tomcat Server pki-tomcat.
Jul 22 16:58:25 ipa0 systemd: Reached target PKI Tomcat Server.
Jul 22 16:58:25 ipa0 server: Java virtual machine used:
/usr/lib/jvm/jre-1.8.0-openjdk/bin/java
Jul 22 16:58:25 ipa0 server: classpath used:
/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar
Jul 22 16:58:25 ipa0 server: main class used: org.apache.catalina.startup.Bootstrap
Jul 22 16:58:25 ipa0 server: flags used: -DRESTEASY_LIB=/usr/share/java/resteasy-base
-Djava.library.path=/usr/lib64/nuxwdog-jni
Jul 22 16:58:25 ipa0 server: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat
-Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs=
-Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp
-Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-Djava.security.manager
-Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy
Jul 22 16:58:25 ipa0 server: arguments used: start
Jul 22 16:58:26 ipa0 server: WARNING: Problem with JAR file
[/usr/share/pki/server/common/lib/symkey.jar], exists: [false], canRead: [false]
Jul 22 16:58:27 ipa0 ns-slapd: [22/Jul/2019:16:58:27.296160288 +0200] - ERR -
slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'enableOCSP' to 'false' did not find a matching
property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'ocspResponderURL' to
'http://ipa0.example.de:8080/ca/ocsp' did not find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'ocspResponderCertNickname' to 'ocspSigningCert
cert-pki-ca' did not find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'ocspCacheSize' to '1000' did not find a matching
property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'ocspMinCacheEntryDuration' to '60' did not find a
matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'ocspMaxCacheEntryDuration' to '120' did not find a
matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'ocspTimeout' to '10' did not find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'strictCiphers' to 'true' did not find a matching
property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not
find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'ssl2Ciphers' to
'-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5'
did not find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'ssl3Ciphers' to
'-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA'
did not find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'tlsCiphers' to
'-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA'
did not find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a
matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find
a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'sslRangeCiphers' to
'-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_AES_128_CBC_SHA256,-TLS_RSA_WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA'
did not find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'serverCertNickFile' to
'/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a matching
property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'passwordFile' to
'/var/lib/pki/pki-tomcat/conf/password.conf' did not find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'passwordClass' to
'org.apache.tomcat.util.net.jss.PlainPasswordFile' did not find a matching
property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector}
Setting property 'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not
find a matching property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host}
Setting property 'xmlValidation' to 'false' did not find a matching
property.
Jul 22 16:58:27 ipa0 server: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host}
Setting property 'xmlNamespaceAware' to 'false' did not find a matching
property.
Jul 22 16:58:30 ipa0 ns-slapd: [22/Jul/2019:16:58:30.317442644 +0200] - ERR -
slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 22 16:58:31 ipa0 server: CMSEngine.initializePasswordStore() begins
Jul 22 16:58:31 ipa0 server: CMSEngine.initializePasswordStore(): tag=internaldb
Jul 22 16:58:31 ipa0 server: CMSEngine.initializePasswordStore(): tag=replicationdb
Jul 22 16:58:31 ipa0 server: Internal Database Error encountered: Could not connect to
LDAP server host ipa0.example.de port 636 Error netscape.ldap.LDAPException:
Authentication failed (49)
Jul 22 16:58:33 ipa0 ns-slapd: [22/Jul/2019:16:58:33.340725283 +0200] - ERR -
slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 22 16:58:36 ipa0 ns-slapd: [22/Jul/2019:16:58:36.356496571 +0200] - ERR -
slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 22 16:58:39 ipa0 ns-slapd: [22/Jul/2019:16:58:39.370806472 +0200] - ERR -
slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Jul 22 16:58:42 ipa0 ns-slapd: [22/Jul/2019:16:58:42.555182393 +0200] - ERR -
slapi_ldap_bind - Error: could not send startTLS request: error -11 (Connect error)
Please note the internal database error. Obviously pki-tomcatd is not permitted to talk
with
the ldap server.
???
Regards
Harri