The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list.
Hello
[root@prod-us-freeipa backup]# getcert list | grep expires expires: 2026-08-25 10:47:09 WEST expires: 2026-08-25 10:46:16 WEST expires: 2026-08-25 10:46:05 WEST expires: 2026-08-25 10:46:12 WEST expires: 2044-09-04 10:46:01 WEST expires: 2026-08-25 10:46:09 WEST expires: 2026-09-05 10:47:42 WEST
Request ID '20240904094741': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=prod-us-freeipa.example.com,O=EXAMPLE.COM issued: 2024-09-04 10:47:42 WEST expires: 2026-09-05 10:47:42 WEST dns: prod-us-freeipa.example.com principal name: krbtgt/EXAMPLE.COM@EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes
I think the problem is related with some certificate that is included in the backup with "--data". If I do a full restore it brokes de PKI and seems to be impossible to restore. The "--data" flag maybe have some certificate injected different else than dn: uid=pkidbuser,ou=people,o=ipaca. On the dashboard the error is: Your session has expired. Please log in again.
on the logs [Wed Sep 04 10:09:13.645078 2024] [wsgi:error] [pid 254:tid 438] [remote 172.21.0.1:48490] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials [Wed Sep 04 10:09:13.819864 2024] [:warn] [pid 257:tid 325] [client 172.21.0.1:48500] failed to set perms (3140) on file (/run/ipa/ccaches/duarte.petiz@EXAMPLE.COM-DcoTto)!, referer: https://prod-us-freeipa.example.com/ipa/ui [Wed Sep 04 10:09:14.045869 2024] [wsgi:error] [pid 253:tid 432] [remote 172.21.0.1:48504] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials
But i cannot find what is really causing the issue
On Wed, Sep 4, 2024 at 8:55 AM Florence Blanc-Renaud flo@redhat.com wrote:
Hi,
can you check if you have any expired certificates (especially the one for pkinit in /var/kerberos/krb5kdc/kdc.crt)? # getcert list and check the "expires" dates.
flo
On Mon, Sep 2, 2024 at 1:11 PM Duarte Petiz duarte.petiz@jscrambler.com wrote:
Thank you for your help! I'm following your guide, and in fact the certificate is different. So i'm updated the certificate to use the same as the server
Steps: 1- install fresh server 2- restore data
[root@prod-us-freeipa backup]# ipa-restore --data ipa-full-2024-09-02-04-02-13/ Directory Manager (existing master) password:
Preparing restore from /var/lib/ipa/backup/ipa-full-2024-09-02-04-02-13/ on prod-us-freeipa.example.com Performing DATA restore from FULL backup Temporary setting umask to 022 Restoring data will overwrite existing live data. Continue to restore? [no]: yes Each master will individually need to be re-initialized or re-created from this one. The replication agreements on masters running IPA 3.1 or earlier will need to be manually re-enabled. See the man page for details. Disabling all replication. Stopping Directory Server Restoring from userRoot in EXAMPLE-COM Restoring from ipaca in EXAMPLE-COM Starting Directory Server Restoring umask to 18 The ipa-restore command was successful
3- fix the certificate
[root@prod-us-freeipa backup]# ldapmodify -D "cn=directory manager" -W -f updatecert.ldif Enter LDAP Password: modifying entry "uid=pkidbuser,ou=people,o=ipaca"
4- restart freeipa
[root@prod-us-freeipa backup]# ipactl restart Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting httpd Service Restarting ipa-custodia Service Restarting pki-tomcatd Service Restarting ipa-otpd Service ipa: INFO: The ipactl command was successful
Expected result:
- Freeipa running with all services UP (check, PKI is back online)
[root@prod-us-freeipa /]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa: INFO: The ipactl command was successful
Problem logging in the dashboard "Login failed due to an unknown reason"
[root@prod-us-freeipa /]# tail -f /var/log/httpd/error_log
[Mon Sep 02 10:33:37.100922 2024] [auth_gssapi:error] [pid 661:tid 665]
[client 192.168.32.2:58200] GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [No credentials were supplied, or the credentials were unavailable or inaccessible ( SPNEGO cannot find mechanisms to negotiate)]
[Mon Sep 02 10:33:37.102384 2024] [wsgi:error] [pid 254:tid 429] [remote
37.27.47.71:50740] ipa: INFO: 401 Unauthorized: No session cookie found
to try to Fixit i've done: ipa-getkeytab -D "cn=directory manager" -w Password -s prod-us-freeipa.example.com -p 'HTTP/ prod-us-freeipa.example.com' -r -k /var/lib/ipa/gssproxy/http.keytab
Now Try to login into dashboard: Error message "Your session has expired. Please log in again."
On the logs
[root@prod-us-freeipa /]# tail -f /var/log/httpd/error_log
[Mon Sep 02 11:01:18.503915 2024] [wsgi:error] [pid 270:tid 450] [remote
37.27.47.71:50893] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials [Mon Sep 02 11:01:18.682533 2024] [:warn] [pid 274:tid 321] [client 37.27.47.71:50893] failed to set perms (3140) on file (/run/ipa/ccaches/duarte.petiz@JSCRAMBLER.COM-nHgKeH)!, referer: https://prod-us-freeipa.jscrambler.com/ipa/ui/ [Mon Sep 02 11:01:18.905861 2024] [wsgi:error] [pid 271:tid 456] [remote 37.27.47.71:50893] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials
On Mon, Sep 2, 2024 at 11:34 AM Duarte Petiz duarte.petiz@jscrambler.com wrote:
Thank you for your help! I'm following your guide, and in fact the certificate is different. So i'm updated the certificate to use the same as the server
Steps: 1- install fresh server 2- restore data
[root@prod-us-freeipa backup]# ipa-restore --data ipa-full-2024-09-02-04-02-13/ Directory Manager (existing master) password:
Preparing restore from /var/lib/ipa/backup/ipa-full-2024-09-02-04-02-13/ on prod-us-freeipa.example.com Performing DATA restore from FULL backup Temporary setting umask to 022 Restoring data will overwrite existing live data. Continue to restore? [no]: yes Each master will individually need to be re-initialized or re-created from this one. The replication agreements on masters running IPA 3.1 or earlier will need to be manually re-enabled. See the man page for details. Disabling all replication. Stopping Directory Server Restoring from userRoot in JSCRAMBLER-COM Restoring from ipaca in JSCRAMBLER-COM Starting Directory Server Restoring umask to 18 The ipa-restore command was successful
3- fix the certificate
[root@prod-us-freeipa backup]# ldapmodify -D "cn=directory manager" -W -f updatecert.ldif Enter LDAP Password: modifying entry "uid=pkidbuser,ou=people,o=ipaca"
4- restart freeipa
[root@prod-us-freeipa backup]# ipactl restart Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting httpd Service Restarting ipa-custodia Service Restarting pki-tomcatd Service Restarting ipa-otpd Service ipa: INFO: The ipactl command was successful
Expected result:
- Freeipa running with all services UP (check, PKI is back online)
[root@prod-us-freeipa /]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa: INFO: The ipactl command was successful
Problem logging in the dashboard [image: image.png]
[root@prod-us-freeipa /]# tail -f /var/log/httpd/error_log
[Mon Sep 02 10:33:37.100922 2024] [auth_gssapi:error] [pid 661:tid 665]
[client 192.168.32.2:58200] GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [No credentials were supplied, or the credentials were unavailable or inaccessible ( SPNEGO cannot find mechanisms to negotiate)]
[Mon Sep 02 10:33:37.102384 2024] [wsgi:error] [pid 254:tid 429] [remote
37.27.47.71:50740] ipa: INFO: 401 Unauthorized: No session cookie found
Any idea?
On Fri, Aug 30, 2024 at 2:10 PM Florence Blanc-Renaud flo@redhat.com wrote:
Hi,
On Fri, Aug 30, 2024 at 11:59 AM Duarte Petiz via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Steps to reproduce:
1- Execute a docker-compose of freeipa with a clean volume (fresh install). 2- Wait until it boots (after 2/3 minutes) everything is ok
[root@prod-us-freeipa /]# curl http://prod-us-freeipa.example.com:8080/ca/admin/ca/getStatus { "Response" : { "State" : "1", "Type" : "CA", "Status" : "running", "Version" : "11.3.0-1" }
3- Restore data (backup data only and full tested)
ipa-restore /var/lib/ipa/backup/ipa-data-2024-08-30-10-28-58/ Directory Manager (existing master) password:
Preparing restore from
/var/lib/ipa/backup/ipa-data-2024-08-30-10-28-58/ on prod-us-freeipa.example.com Performing DATA restore from DATA backup Temporary setting umask to 022 Restoring data will overwrite existing live data. Continue to restore? [no]: yes Each master will individually need to be re-initialized or re-created from this one. The replication agreements on masters running IPA 3.1 or earlier will need to be manually re-enabled. See the man page for details. Disabling all replication. Stopping Directory Server Restoring from userRoot in EXAMPLE-COM Restoring from ipaca in EXAMPLE-COM Starting Directory Server Restoring umask to 18
*The ipa-restore command was successful *
4- Freeipa restart 5- pki no more boots
[root@prod-us-freeipa pki]# curl http://prod-us-freeipa.example.com:8080/ca/admin/ca/getStatus curl: (7) Failed to connect to prod-us-freeipa.example.com port 8080: Connection refused
I'm getting really frustrated with this error... I don't have replicas so I really need to have this fixed. Does anyone have any ideas?
cat /var/log/pki/pki-tomcat/ca/debug.2024-08-30.log 2024-08-30 09:48:12 [main] INFO: Shutting down CA subsystem 2024-08-30 09:48:12 [main] INFO: RequestSubsystem: Request subsystem stopped 2024-08-30 09:48:12 [main] INFO: Destroying LogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) 2024-08-30 09:48:12 [main] SEVERE: Exception sending context initialized event to listener instance of class [org.dogtagpki.server.ca.CAWebListener] com.netscape.certsrv.base.PKIException: Unable to start CA engine: Unable to connect to LDAP server: Authentication failed at com.netscape.cmscore.apps.PKIWebListener.contextInitialized(PKIWebListener.java:44) at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4768) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5230) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:728) at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:150) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140) at java.base/java.security.AccessController.doPrivileged(AccessController.java:318) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:698) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:696) at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:690) at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1889) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:123) at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:583) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:473) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1618) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:319) at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:123) at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:423) at org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:366) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:948) at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:835) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1388) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:145) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:921) at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:263) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardService.startInternal(StandardService.java:437) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:934) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.startup.Catalina.start(Catalina.java:772) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:345) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:476) Caused by: Unable to connect to LDAP server: Authentication failed at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeNewConnection(LdapBoundConnFactory.java:321) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:278) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:262) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:224) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:193) at org.dogtagpki.server.ca.CAEngine.initDatabase(CAEngine.java:192) at com.netscape.cmscore.apps.CMSEngine.start(CMSEngine.java:1160) at com.netscape.cmscore.apps.PKIWebListener.contextInitialized(PKIWebListener.java:39) ... 45 more Caused by: netscape.ldap.LDAPException: Authentication failed (49)
When the PKI server starts, it tries to establish a connection to the LDAP server and authenticates with a certificate. The error 49 means invalid credentials. You can find troubleshooting tips in https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomcat...
flo
at netscape.ldap.LDAPSaslBind.checkForSASLBindCompletion(Unknown Source)
at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.checkClientAuth(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:108) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeNewConnection(LdapBoundConnFactory.java:303) ... 52 more
2024-08-30 09:48:12 [main] INFO: Shutting down CA subsystem 2024-08-30 09:48:12 [main] INFO: RequestSubsystem: Request subsystem stopped 2024-08-30 09:48:12 [main] INFO: Destroying LogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
On Wed, Aug 28, 2024 at 6:51 PM Rob Crittenden via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Luis Correia via FreeIPA-users wrote: > I looked at those logs, and saw that we're getting a lot of these: > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL socket for <my-freeipa-hostname>:636 > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! org.dogtagpki.server.PKIClientSocketListener@79ac50fe > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL socket for <my-freeipa-hostname>:636 > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! org.dogtagpki.server.PKIClientSocketListener@79ac50fe > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL socket for <my-freeipa-hostname>:636 > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! org.dogtagpki.server.PKIClientSocketListener@79ac50fe > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL socket for <my-freeipa-hostname>:636 > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! org.dogtagpki.server.PKIClientSocketListener@79ac50fe > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL socket for <my-freeipa-hostname>:636 > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! org.dogtagpki.server.PKIClientSocketListener@79ac50fe > 2024-08-28 09:05:10 [main] SEVERE: Exception sending context initialized event to listener instance of class [ org.dogtagpki.server.ca.CAWebListener] > java.lang.StackOverflowError: java.lang.StackOverflowError > at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) > at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77) > at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) > at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) > at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481) > at org.mozilla.jss.ssl.SocketBase.processExceptions(SocketBase.java:448) > at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native Method) > at com.netscape.cmscore.ldapconn.PKISocketFactory.makeSSLSocket(PKISocketFactory.java:240) > at com.netscape.cmscore.ldapconn.PKISocketFactory.makeSocket(PKISocketFactory.java:256) > at netscape.ldap.LDAPConnSetupMgr.connectServer(LDAPConnSetupMgr.java:525) > at netscape.ldap.LDAPConnSetupMgr.openSerial(LDAPConnSetupMgr.java:451) > at netscape.ldap.LDAPConnSetupMgr.connect(LDAPConnSetupMgr.java:290) > at netscape.ldap.LDAPConnSetupMgr.openConnection(LDAPConnSetupMgr.java:215) > at netscape.ldap.LDAPConnThread.connect(LDAPConnThread.java:136) > at netscape.ldap.LDAPConnection.connect(LDAPConnection.java:1126) > at netscape.ldap.LDAPConnection.restoreConnection(LDAPConnection.java:1905) > at netscape.ldap.LDAPConnection.sendRequest(LDAPConnection.java:1870) > at netscape.ldap.LDAPSaslBind.saslBind(LDAPSaslBind.java:276) > at netscape.ldap.LDAPSaslBind.bind(LDAPSaslBind.java:194) > at netscape.ldap.LDAPSaslBind.bind(LDAPSaslBind.java:115) > at netscape.ldap.LDAPConnection.authenticate(LDAPConnection.java:1446) > at netscape.ldap.LDAPConnection.authenticate(LDAPConnection.java:1406) > at netscape.ldap.LDAPConnection.checkClientAuth(LDAPConnection.java:1170) > at netscape.ldap.LDAPConnection.connect(LDAPConnection.java:1128) > > I'm not sure what it could mean though. Do you have any idea? >
There isn't really enough information. Probably need more context above this. PKI tends to continue past failures so bottom-up debugging isn't always fruitful. It also has some red herring warnings so it can be difficult, even for experienced admins, to tell what is going on.
It looks like it is having troubles reaching LDAP though. I guess what I'd suggest is:
ipactl start --skip-version-check --ignore-service-failures
That should bring the services up without trying the upgrade and without failing if PKI fails to start.
Then you can try starting PKI alone to see if that makes a difference.
And/or check on your certificates: getcert list
And see if any are expired or expiring.
rob
-- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- *Kind Regards*
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com
-- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- *Kind Regards*
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com
-- *Kind Regards*
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com
If I do a full-restore with the following procedure I can login into the web portal, but the PKI goes broken.
1º install new freeipa 2º restore /var/lib/ipa/private/httpd.key 3º restore /var/lib/ipa/gssproxy/http.keytab 5º docker exec -ti ipa-freeipa-1 bash 6º ipa-restore /var/lib/ipa/backup/backup
There is some way to do a new "pki" install in an existing installed/restored freeipa? I cannot let the PKI down, it will break the upgrades for future versions. That's why I tried to restore data-only.
On Wed, Sep 4, 2024 at 11:10 AM Duarte Petiz duarte.petiz@jscrambler.com wrote:
Hello
[root@prod-us-freeipa backup]# getcert list | grep expires expires: 2026-08-25 10:47:09 WEST expires: 2026-08-25 10:46:16 WEST expires: 2026-08-25 10:46:05 WEST expires: 2026-08-25 10:46:12 WEST expires: 2044-09-04 10:46:01 WEST expires: 2026-08-25 10:46:09 WEST expires: 2026-09-05 10:47:42 WEST
Request ID '20240904094741': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=prod-us-freeipa.example.com,O=EXAMPLE.COM issued: 2024-09-04 10:47:42 WEST expires: 2026-09-05 10:47:42 WEST dns: prod-us-freeipa.example.com principal name: krbtgt/EXAMPLE.COM@EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes
I think the problem is related with some certificate that is included in the backup with "--data". If I do a full restore it brokes de PKI and seems to be impossible to restore. The "--data" flag maybe have some certificate injected different else than dn: uid=pkidbuser,ou=people,o=ipaca. On the dashboard the error is: Your session has expired. Please log in again.
on the logs [Wed Sep 04 10:09:13.645078 2024] [wsgi:error] [pid 254:tid 438] [remote 172.21.0.1:48490] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials [Wed Sep 04 10:09:13.819864 2024] [:warn] [pid 257:tid 325] [client 172.21.0.1:48500] failed to set perms (3140) on file (/run/ipa/ccaches/duarte.petiz@EXAMPLE.COM-DcoTto)!, referer: https://prod-us-freeipa.example.com/ipa/ui [Wed Sep 04 10:09:14.045869 2024] [wsgi:error] [pid 253:tid 432] [remote 172.21.0.1:48504] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials
But i cannot find what is really causing the issue
On Wed, Sep 4, 2024 at 8:55 AM Florence Blanc-Renaud flo@redhat.com wrote:
Hi,
can you check if you have any expired certificates (especially the one for pkinit in /var/kerberos/krb5kdc/kdc.crt)? # getcert list and check the "expires" dates.
flo
On Mon, Sep 2, 2024 at 1:11 PM Duarte Petiz duarte.petiz@jscrambler.com wrote:
Thank you for your help! I'm following your guide, and in fact the certificate is different. So i'm updated the certificate to use the same as the server
Steps: 1- install fresh server 2- restore data
[root@prod-us-freeipa backup]# ipa-restore --data ipa-full-2024-09-02-04-02-13/ Directory Manager (existing master) password:
Preparing restore from /var/lib/ipa/backup/ipa-full-2024-09-02-04-02-13/ on prod-us-freeipa.example.com Performing DATA restore from FULL backup Temporary setting umask to 022 Restoring data will overwrite existing live data. Continue to restore? [no]: yes Each master will individually need to be re-initialized or re-created from this one. The replication agreements on masters running IPA 3.1 or earlier will need to be manually re-enabled. See the man page for details. Disabling all replication. Stopping Directory Server Restoring from userRoot in EXAMPLE-COM Restoring from ipaca in EXAMPLE-COM Starting Directory Server Restoring umask to 18 The ipa-restore command was successful
3- fix the certificate
[root@prod-us-freeipa backup]# ldapmodify -D "cn=directory manager" -W -f updatecert.ldif Enter LDAP Password: modifying entry "uid=pkidbuser,ou=people,o=ipaca"
4- restart freeipa
[root@prod-us-freeipa backup]# ipactl restart Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting httpd Service Restarting ipa-custodia Service Restarting pki-tomcatd Service Restarting ipa-otpd Service ipa: INFO: The ipactl command was successful
Expected result:
- Freeipa running with all services UP (check, PKI is back online)
[root@prod-us-freeipa /]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa: INFO: The ipactl command was successful
Problem logging in the dashboard "Login failed due to an unknown reason"
[root@prod-us-freeipa /]# tail -f /var/log/httpd/error_log
[Mon Sep 02 10:33:37.100922 2024] [auth_gssapi:error] [pid 661:tid 665]
[client 192.168.32.2:58200] GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [No credentials were supplied, or the credentials were unavailable or inaccessible ( SPNEGO cannot find mechanisms to negotiate)]
[Mon Sep 02 10:33:37.102384 2024] [wsgi:error] [pid 254:tid 429] [remote
37.27.47.71:50740] ipa: INFO: 401 Unauthorized: No session cookie found
to try to Fixit i've done: ipa-getkeytab -D "cn=directory manager" -w Password -s prod-us-freeipa.example.com -p 'HTTP/ prod-us-freeipa.example.com' -r -k /var/lib/ipa/gssproxy/http.keytab
Now Try to login into dashboard: Error message "Your session has expired. Please log in again."
On the logs
[root@prod-us-freeipa /]# tail -f /var/log/httpd/error_log
[Mon Sep 02 11:01:18.503915 2024] [wsgi:error] [pid 270:tid 450] [remote
37.27.47.71:50893] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials [Mon Sep 02 11:01:18.682533 2024] [:warn] [pid 274:tid 321] [client 37.27.47.71:50893] failed to set perms (3140) on file (/run/ipa/ccaches/duarte.petiz@JSCRAMBLER.COM-nHgKeH)!, referer: https://prod-us-freeipa.jscrambler.com/ipa/ui/ [Mon Sep 02 11:01:18.905861 2024] [wsgi:error] [pid 271:tid 456] [remote 37.27.47.71:50893] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials
On Mon, Sep 2, 2024 at 11:34 AM Duarte Petiz < duarte.petiz@jscrambler.com> wrote:
Thank you for your help! I'm following your guide, and in fact the certificate is different. So i'm updated the certificate to use the same as the server
Steps: 1- install fresh server 2- restore data
[root@prod-us-freeipa backup]# ipa-restore --data ipa-full-2024-09-02-04-02-13/ Directory Manager (existing master) password:
Preparing restore from /var/lib/ipa/backup/ipa-full-2024-09-02-04-02-13/ on prod-us-freeipa.example.com Performing DATA restore from FULL backup Temporary setting umask to 022 Restoring data will overwrite existing live data. Continue to restore? [no]: yes Each master will individually need to be re-initialized or re-created from this one. The replication agreements on masters running IPA 3.1 or earlier will need to be manually re-enabled. See the man page for details. Disabling all replication. Stopping Directory Server Restoring from userRoot in JSCRAMBLER-COM Restoring from ipaca in JSCRAMBLER-COM Starting Directory Server Restoring umask to 18 The ipa-restore command was successful
3- fix the certificate
[root@prod-us-freeipa backup]# ldapmodify -D "cn=directory manager" -W -f updatecert.ldif Enter LDAP Password: modifying entry "uid=pkidbuser,ou=people,o=ipaca"
4- restart freeipa
[root@prod-us-freeipa backup]# ipactl restart Restarting Directory Service Restarting krb5kdc Service Restarting kadmin Service Restarting httpd Service Restarting ipa-custodia Service Restarting pki-tomcatd Service Restarting ipa-otpd Service ipa: INFO: The ipactl command was successful
Expected result:
- Freeipa running with all services UP (check, PKI is back online)
[root@prod-us-freeipa /]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa: INFO: The ipactl command was successful
Problem logging in the dashboard [image: image.png]
[root@prod-us-freeipa /]# tail -f /var/log/httpd/error_log
[Mon Sep 02 10:33:37.100922 2024] [auth_gssapi:error] [pid 661:tid
665] [client 192.168.32.2:58200] GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [No credentials were supplied, or the credentials were unavailable or inaccessible ( SPNEGO cannot find mechanisms to negotiate)]
[Mon Sep 02 10:33:37.102384 2024] [wsgi:error] [pid 254:tid 429]
[remote 37.27.47.71:50740] ipa: INFO: 401 Unauthorized: No session cookie found
Any idea?
On Fri, Aug 30, 2024 at 2:10 PM Florence Blanc-Renaud flo@redhat.com wrote:
Hi,
On Fri, Aug 30, 2024 at 11:59 AM Duarte Petiz via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Steps to reproduce:
1- Execute a docker-compose of freeipa with a clean volume (fresh install). 2- Wait until it boots (after 2/3 minutes) everything is ok
> [root@prod-us-freeipa /]# curl > http://prod-us-freeipa.example.com:8080/ca/admin/ca/getStatus > { > "Response" : { > "State" : "1", > "Type" : "CA", > "Status" : "running", > "Version" : "11.3.0-1" > } > 3- Restore data (backup data only and full tested)
> ipa-restore /var/lib/ipa/backup/ipa-data-2024-08-30-10-28-58/ > Directory Manager (existing master) password:
Preparing restore from > /var/lib/ipa/backup/ipa-data-2024-08-30-10-28-58/ on > prod-us-freeipa.example.com > Performing DATA restore from DATA backup > Temporary setting umask to 022 > Restoring data will overwrite existing live data. Continue to > restore? [no]: yes > Each master will individually need to be re-initialized or > re-created from this one. The replication agreements on > masters running IPA 3.1 or earlier will need to be manually > re-enabled. See the man page for details. > Disabling all replication. > Stopping Directory Server > Restoring from userRoot in EXAMPLE-COM > Restoring from ipaca in EXAMPLE-COM > Starting Directory Server > Restoring umask to 18
*The ipa-restore command was successful *
4- Freeipa restart 5- pki no more boots
> [root@prod-us-freeipa pki]# curl > http://prod-us-freeipa.example.com:8080/ca/admin/ca/getStatus > curl: (7) Failed to connect to prod-us-freeipa.example.com port > 8080: Connection refused >
I'm getting really frustrated with this error... I don't have replicas so I really need to have this fixed. Does anyone have any ideas?
cat /var/log/pki/pki-tomcat/ca/debug.2024-08-30.log 2024-08-30 09:48:12 [main] INFO: Shutting down CA subsystem 2024-08-30 09:48:12 [main] INFO: RequestSubsystem: Request subsystem stopped 2024-08-30 09:48:12 [main] INFO: Destroying LogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) 2024-08-30 09:48:12 [main] SEVERE: Exception sending context initialized event to listener instance of class [org.dogtagpki.server.ca.CAWebListener] com.netscape.certsrv.base.PKIException: Unable to start CA engine: Unable to connect to LDAP server: Authentication failed at com.netscape.cmscore.apps.PKIWebListener.contextInitialized(PKIWebListener.java:44) at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4768) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5230) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:728) at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:150) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140) at java.base/java.security.AccessController.doPrivileged(AccessController.java:318) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:698) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:696) at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:690) at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1889) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:123) at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:583) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:473) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1618) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:319) at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:123) at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:423) at org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:366) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:948) at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:835) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1388) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:145) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:921) at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:263) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardService.startInternal(StandardService.java:437) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:934) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.startup.Catalina.start(Catalina.java:772) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:345) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:476) Caused by: Unable to connect to LDAP server: Authentication failed at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeNewConnection(LdapBoundConnFactory.java:321) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:278) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:262) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:224) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:193) at org.dogtagpki.server.ca.CAEngine.initDatabase(CAEngine.java:192) at com.netscape.cmscore.apps.CMSEngine.start(CMSEngine.java:1160) at com.netscape.cmscore.apps.PKIWebListener.contextInitialized(PKIWebListener.java:39) ... 45 more Caused by: netscape.ldap.LDAPException: Authentication failed (49)
When the PKI server starts, it tries to establish a connection to the LDAP server and authenticates with a certificate. The error 49 means invalid credentials. You can find troubleshooting tips in https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomcat...
flo
at netscape.ldap.LDAPSaslBind.checkForSASLBindCompletion(Unknown
Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.checkClientAuth(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:108) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeNewConnection(LdapBoundConnFactory.java:303) ... 52 more
2024-08-30 09:48:12 [main] INFO: Shutting down CA subsystem 2024-08-30 09:48:12 [main] INFO: RequestSubsystem: Request subsystem stopped 2024-08-30 09:48:12 [main] INFO: Destroying LogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
On Wed, Aug 28, 2024 at 6:51 PM Rob Crittenden via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
> Luis Correia via FreeIPA-users wrote: > > I looked at those logs, and saw that we're getting a lot of these: > > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL > socket for <my-freeipa-hostname>:636 > > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! > org.dogtagpki.server.PKIClientSocketListener@79ac50fe > > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL > socket for <my-freeipa-hostname>:636 > > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! > org.dogtagpki.server.PKIClientSocketListener@79ac50fe > > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL > socket for <my-freeipa-hostname>:636 > > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! > org.dogtagpki.server.PKIClientSocketListener@79ac50fe > > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL > socket for <my-freeipa-hostname>:636 > > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! > org.dogtagpki.server.PKIClientSocketListener@79ac50fe > > 2024-08-28 09:05:10 [main] INFO: PKISocketFactory: Creating SSL > socket for <my-freeipa-hostname>:636 > > 2024-08-28 09:05:10 [main] SEVERE: Add listener!!! > org.dogtagpki.server.PKIClientSocketListener@79ac50fe > > 2024-08-28 09:05:10 [main] SEVERE: Exception sending context > initialized event to listener instance of class [ > org.dogtagpki.server.ca.CAWebListener] > > java.lang.StackOverflowError: java.lang.StackOverflowError > > at > java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native > Method) > > at > java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77) > > at > java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) > > at > java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) > > at > java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481) > > at > org.mozilla.jss.ssl.SocketBase.processExceptions(SocketBase.java:448) > > at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native > Method) > > at > com.netscape.cmscore.ldapconn.PKISocketFactory.makeSSLSocket(PKISocketFactory.java:240) > > at > com.netscape.cmscore.ldapconn.PKISocketFactory.makeSocket(PKISocketFactory.java:256) > > at > netscape.ldap.LDAPConnSetupMgr.connectServer(LDAPConnSetupMgr.java:525) > > at > netscape.ldap.LDAPConnSetupMgr.openSerial(LDAPConnSetupMgr.java:451) > > at > netscape.ldap.LDAPConnSetupMgr.connect(LDAPConnSetupMgr.java:290) > > at > netscape.ldap.LDAPConnSetupMgr.openConnection(LDAPConnSetupMgr.java:215) > > at > netscape.ldap.LDAPConnThread.connect(LDAPConnThread.java:136) > > at > netscape.ldap.LDAPConnection.connect(LDAPConnection.java:1126) > > at > netscape.ldap.LDAPConnection.restoreConnection(LDAPConnection.java:1905) > > at > netscape.ldap.LDAPConnection.sendRequest(LDAPConnection.java:1870) > > at > netscape.ldap.LDAPSaslBind.saslBind(LDAPSaslBind.java:276) > > at netscape.ldap.LDAPSaslBind.bind(LDAPSaslBind.java:194) > > at netscape.ldap.LDAPSaslBind.bind(LDAPSaslBind.java:115) > > at > netscape.ldap.LDAPConnection.authenticate(LDAPConnection.java:1446) > > at > netscape.ldap.LDAPConnection.authenticate(LDAPConnection.java:1406) > > at > netscape.ldap.LDAPConnection.checkClientAuth(LDAPConnection.java:1170) > > at > netscape.ldap.LDAPConnection.connect(LDAPConnection.java:1128) > > > > I'm not sure what it could mean though. Do you have any idea? > > > > There isn't really enough information. Probably need more context > above > this. PKI tends to continue past failures so bottom-up debugging > isn't > always fruitful. It also has some red herring warnings so it can be > difficult, even for experienced admins, to tell what is going on. > > It looks like it is having troubles reaching LDAP though. I guess > what > I'd suggest is: > > ipactl start --skip-version-check --ignore-service-failures > > That should bring the services up without trying the upgrade and > without > failing if PKI fails to start. > > Then you can try starting PKI alone to see if that makes a > difference. > > And/or check on your certificates: getcert list > > And see if any are expired or expiring. > > rob > > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org > To unsubscribe send an email to > freeipa-users-leave@lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >
-- *Kind Regards*
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com
-- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- *Kind Regards*
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com
-- *Kind Regards*
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com
-- *Kind Regards*
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com
I will copy/paste it so:
Hello
[root@prod-us-freeipa backup]# getcert list | grep expires expires: 2026-08-25 10:47:09 WEST expires: 2026-08-25 10:46:16 WEST expires: 2026-08-25 10:46:05 WEST expires: 2026-08-25 10:46:12 WEST expires: 2044-09-04 10:46:01 WEST expires: 2026-08-25 10:46:09 WEST expires: 2026-09-05 10:47:42 WEST
Request ID '20240904094741': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM http://example.com/ subject: CN=prod-us-freeipa.example.com,O=EXAMPLE.COM http://example.com/ issued: 2024-09-04 10:47:42 WEST expires: 2026-09-05 10:47:42 WEST dns: prod-us-freeipa.example.com principal name: krbtgt/EXAMPLE.COM@EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes
I think the problem is related with some certificate that is included in the backup with "--data". If I do a full restore it brokes de PKI and seems to be impossible to restore. The "--data" flag maybe have some certificate injected different else than dn: uid=pkidbuser,ou=people,o=ipaca. On the dashboard the error is: Your session has expired. Please log in again.
on the logs [Wed Sep 04 10:09:13.645078 2024] [wsgi:error] [pid 254:tid 438] [remote 172.21.0.1:48490] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials [Wed Sep 04 10:09:13.819864 2024] [:warn] [pid 257:tid 325] [client 172.21.0.1:48500] failed to set perms (3140) on file (/run/ipa/ccaches/duarte.petiz@EXAMPLE.COM-DcoTto)!, referer: https://prod-us-freeipa.example.com/ipa/ui [Wed Sep 04 10:09:14.045869 2024] [wsgi:error] [pid 253:tid 432] [remote 172.21.0.1:48504] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials
But i cannot find what is really causing the issue...
If I do a full-restore with the following procedure I can login into the web portal, but the PKI goes broken.
1º install new freeipa 2º restore /var/lib/ipa/private/httpd.key 3º restore /var/lib/ipa/gssproxy/http.keytab 5º docker exec -ti ipa-freeipa-1 bash 6º ipa-restore /var/lib/ipa/backup/backup
There is some way to do a new "pki" install in an existing installed/restored freeipa? I cannot let the PKI down, it will break the upgrades for future versions. That's why I tried to restore data-only.
On Wed, Sep 4, 2024 at 1:35 PM flo--- via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list. -- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Duarte Petiz via FreeIPA-users wrote:
I will copy/paste it so:
Hello
[root@prod-us-freeipa backup]# getcert list | grep expires expires: 2026-08-25 10:47:09 WEST expires: 2026-08-25 10:46:16 WEST expires: 2026-08-25 10:46:05 WEST expires: 2026-08-25 10:46:12 WEST expires: 2044-09-04 10:46:01 WEST expires: 2026-08-25 10:46:09 WEST expires: 2026-09-05 10:47:42 WEST
Request ID '20240904094741': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM http://example.com/ subject: CN=prod-us-freeipa.example.com http://prod-us-freeipa.example.com/,O=EXAMPLE.COM http://example.com/ issued: 2024-09-04 10:47:42 WEST expires: 2026-09-05 10:47:42 WEST dns: prod-us-freeipa.example.com http://prod-us-freeipa.example.com/ principal name: krbtgt/EXAMPLE.COM@EXAMPLE.COM mailto:EXAMPLE.COM@EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes
I think the problem is related with some certificate that is included in the backup with "--data". If I do a full restore it brokes de PKI and seems to be impossible to restore. The "--data" flag maybe have some certificate injected different else than dn: uid=pkidbuser,ou=people,o=ipaca. On the dashboard the error is: Your session has expired. Please log in again.
on the logs [Wed Sep 04 10:09:13.645078 2024] [wsgi:error] [pid 254:tid 438] [remote 172.21.0.1:48490 http://172.21.0.1:48490/] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials [Wed Sep 04 10:09:13.819864 2024] [:warn] [pid 257:tid 325] [client 172.21.0.1:48500 http://172.21.0.1:48500/] failed to set perms (3140) on file (/run/ipa/ccaches/duarte.petiz@EXAMPLE.COM-DcoTto)!, referer: https://prod-us-freeipa.example.com/ipa/ui [Wed Sep 04 10:09:14.045869 2024] [wsgi:error] [pid 253:tid 432] [remote 172.21.0.1:48504 http://172.21.0.1:48504/] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials
But i cannot find what is really causing the issue...
If I do a full-restore with the following procedure I can login into the web portal, but the PKI goes broken.
1º install new freeipa 2º restore /var/lib/ipa/private/httpd.key 3º restore /var/lib/ipa/gssproxy/http.keytab 5º docker exec -ti ipa-freeipa-1 bash 6º ipa-restore /var/lib/ipa/backup/backup
There is some way to do a new "pki" install in an existing installed/restored freeipa? I cannot let the PKI down, it will break the upgrades for future versions. That's why I tried to restore data-only.
There is no supported way to replace the CA.
Can you install the {free}ipa-healthcheck package and run ipa-healthcheck? It is likely to return a slew of errors because the CA will be unresponsive but it will also check a number of things that could lead to a root cause.
rob
On Wed, Sep 4, 2024 at 1:35 PM flo--- via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list. -- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- /Kind Regards/
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com http://jscrambler.com/
Hello, thank you Rob [root@prod-us-freeipa /]# ipa-healthcheck [ { "source": "ipahealthcheck.ipa.certs", "check": "IPACertMatchCheck", "result": "ERROR", "uuid": "4bb93268-3bee-4c0c-8dc9-c1bd03293d34", "when": "20240905082820Z", "duration": "0.011836", "kw": { "key": "cn=JSCRAMBLER.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=jscrambler,dc=com", "dn": "cn=JSCRAMBLER.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=jscrambler,dc=com", "serial_number": 1, "msg": "CA Certificate serial number {serial} is in LDAP '{dn}' but is not in /etc/ipa/ca.crt" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "f2f7f0e4-5d46-4e45-9ca6-56ae855e56e9", "when": "20240905082820Z", "duration": "0.070035", "kw": { "key": "caSigningCert cert-pki-ca", "nickname": "caSigningCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "8c591194-50d3-489e-a078-7f9fadb6c2fd", "when": "20240905082820Z", "duration": "0.399892", "kw": { "key": "ocspSigningCert cert-pki-ca", "nickname": "ocspSigningCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "10a1cb1c-c08c-4f05-87ea-ee1aac253692", "when": "20240905082820Z", "duration": "0.448749", "kw": { "key": "subsystemCert cert-pki-ca", "nickname": "subsystemCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "ac4edfc6-c254-45c5-8ec6-63cbd653f010", "when": "20240905082820Z", "duration": "0.496190", "kw": { "key": "auditSigningCert cert-pki-ca", "nickname": "auditSigningCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "edf86d59-2a47-4af8-a97c-bcaf8613897d", "when": "20240905082820Z", "duration": "0.568801", "kw": { "key": "Server-Cert cert-pki-ca", "nickname": "Server-Cert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPARAAgent", "result": "ERROR", "uuid": "bfb90711-9ab8-4b86-be1c-7fce8a0c673c", "when": "20240905082820Z", "duration": "0.006922", "kw": { "key": "ldap_mismatch", "certfile": "/var/lib/ipa/ra-agent.pem", "dn": "uid=ipara,ou=people,o=ipaca", "msg": "RA agent certificate in {certfile} not found in LDAP userCertificate attribute for the entry {dn}" } }, { "source": "ipahealthcheck.ipa.dna", "check": "IPADNARangeCheck", "result": "CRITICAL", "uuid": "f9e6c147-ef0d-4a80-b19d-cbb3cbe4ce1d", "when": "20240905082822Z", "duration": "0.074268", "kw": { "exception": "Insufficient access: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Preauthentication failed)", "traceback": "Traceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1087, in error_handler\n yield\n File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1258, in gssapi_bind\n self.conn.sasl_interactive_bind_s(\n File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 270, in sasl_interactive_bind_s\n return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)\n File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call\n result = func(*args,**kwargs)\nldap.LOCAL_ERROR: {'result': -2, 'desc': 'Local error', 'ctrls': [], 'info': 'SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Preauthentication failed)'}\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/ipahealthcheck/core/core.py", line 56, in run_plugin\n for result in plugin.check():\n File "/usr/lib/python3.9/site-packages/ipahealthcheck/core/plugin.py", line 18, in wrapper\n for result in f(*args, **kwds):\n File "/usr/lib/python3.9/site-packages/ipahealthcheck/ipa/dna.py", line 32, in check\n agmt = replication.ReplicationManager(api.env.realm, api.env.host)\n File "/usr/lib/python3.9/site-packages/ipaserver/install/replication.py", line 268, in __init__\n self.conn.gssapi_bind()\n File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1258, in gssapi_bind\n self.conn.sasl_interactive_bind_s(\n File "/usr/lib64/python3.9/contextlib.py", line 137, in __exit__\n self.gen.throw(typ, value, traceback)\n File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1143, in error_handler\n raise errors.ACIError(info=info)\nipalib.errors.ACIError: Insufficient access: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Preauthentication failed)\n" } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "5c105f14-6f10-4931-8986-5effd0be9b27", "when": "20240905082822Z", "duration": "0.070505", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.jscrambler.com.:prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "50e2ccb5-7d62-4edb-a9e4-691e49c6966d", "when": "20240905082822Z", "duration": "0.077283", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.jscrambler.com.:prod-us-freeipa.jscrambler.com ." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "ddbd6ec8-de76-4b1d-a3df-bbf45e1669e4", "when": "20240905082822Z", "duration": "0.098272", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.jscrambler.com.:prod-us-freeipa.jscrambler.com ." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "be3790d6-158e-40ae-b1d2-c0b5b532be96", "when": "20240905082822Z", "duration": "0.105748", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._tcp.jscrambler.com.: prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "b3fbd679-4906-4ad8-889b-923426ec9bc2", "when": "20240905082822Z", "duration": "0.121375", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._udp.jscrambler.com.: prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "550ed58a-309d-4756-8e20-61d8e2a7ea60", "when": "20240905082822Z", "duration": "0.129817", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._tcp.jscrambler.com.:prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "e22c24d3-e1d1-4db8-9640-332fb3c3d901", "when": "20240905082822Z", "duration": "0.139263", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._udp.jscrambler.com.:prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "265a4ab3-fb2e-4f2b-b83d-0264e11a13d7", "when": "20240905082822Z", "duration": "0.146888", "kw": { "msg": "Expected URI record missing", "key": "_kerberos.jscrambler.com.:krb5srv:m:tcp: prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "df8e8a86-69c7-4d6d-a850-597c017ad9da", "when": "20240905082822Z", "duration": "0.146902", "kw": { "msg": "Expected URI record missing", "key": "_kerberos.jscrambler.com.:krb5srv:m:udp: prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "591655a6-fddc-42e9-9cdd-b310cddd912e", "when": "20240905082822Z", "duration": "0.152359", "kw": { "msg": "Expected URI record missing", "key": "_kpasswd.jscrambler.com.:krb5srv:m:tcp: prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "82727f16-ba22-4696-b542-1479ac8ffa3f", "when": "20240905082822Z", "duration": "0.152373", "kw": { "msg": "Expected URI record missing", "key": "_kpasswd.jscrambler.com.:krb5srv:m:udp: prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "1ab64a7e-0381-4fe3-a38b-301826551f6e", "when": "20240905082822Z", "duration": "0.174484", "kw": { "key": "ipa_ca_missing_prod-us-freeipa.jscrambler.com", "server": "prod-us-freeipa.jscrambler.com", "ipaddr": "172.18.0.2", "msg": "expected ipa-ca to contain {ipaddr} for {server}" } }, { "source": "ipahealthcheck.ipa.host", "check": "IPAHostKeytab", "result": "ERROR", "uuid": "34eea407-73ae-46be-849c-71dddd4c01a4", "when": "20240905082822Z", "duration": "0.014935", "kw": { "msg": "Failed to obtain host TGT: Major (458752): No credentials were supplied, or the credentials were unavailable or inaccessible, Minor (2529638936): Preauthentication failed" } } ]
On Wed, Sep 4, 2024 at 6:41 PM Rob Crittenden rcritten@redhat.com wrote:
Duarte Petiz via FreeIPA-users wrote:
I will copy/paste it so:
Hello
[root@prod-us-freeipa backup]# getcert list | grep expires expires: 2026-08-25 10:47:09 WEST expires: 2026-08-25 10:46:16 WEST expires: 2026-08-25 10:46:05 WEST expires: 2026-08-25 10:46:12 WEST expires: 2044-09-04 10:46:01 WEST expires: 2026-08-25 10:46:09 WEST expires: 2026-09-05 10:47:42 WEST
Request ID '20240904094741': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM http://example.com/ subject: CN=prod-us-freeipa.example.com http://prod-us-freeipa.example.com/,O=EXAMPLE.COM <http://example.com/
issued: 2024-09-04 10:47:42 WEST expires: 2026-09-05 10:47:42 WEST dns: prod-us-freeipa.example.com http://prod-us-freeipa.example.com/ principal name: krbtgt/EXAMPLE.COM@EXAMPLE.COM mailto:EXAMPLE.COM@EXAMPLE.COM key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes
I think the problem is related with some certificate that is included in the backup with "--data". If I do a full restore it brokes de PKI and seems to be impossible to restore. The "--data" flag maybe have some certificate injected different else than dn: uid=pkidbuser,ou=people,o=ipaca. On the dashboard the error is: Your session has expired. Please log in again.
on the logs [Wed Sep 04 10:09:13.645078 2024] [wsgi:error] [pid 254:tid 438] [remote 172.21.0.1:48490 http://172.21.0.1:48490/] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials [Wed Sep 04 10:09:13.819864 2024] [:warn] [pid 257:tid 325] [client 172.21.0.1:48500 http://172.21.0.1:48500/] failed to set perms (3140) on file (/run/ipa/ccaches/duarte.petiz@EXAMPLE.COM-DcoTto)!, referer: https://prod-us-freeipa.example.com/ipa/ui [Wed Sep 04 10:09:14.045869 2024] [wsgi:error] [pid 253:tid 432] [remote 172.21.0.1:48504 http://172.21.0.1:48504/] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials
But i cannot find what is really causing the issue...
If I do a full-restore with the following procedure I can login into the web portal, but the PKI goes broken.
1º install new freeipa 2º restore /var/lib/ipa/private/httpd.key 3º restore /var/lib/ipa/gssproxy/http.keytab 5º docker exec -ti ipa-freeipa-1 bash 6º ipa-restore /var/lib/ipa/backup/backup
There is some way to do a new "pki" install in an existing installed/restored freeipa? I cannot let the PKI down, it will break the upgrades for future versions. That's why I tried to restore data-only.
There is no supported way to replace the CA.
Can you install the {free}ipa-healthcheck package and run ipa-healthcheck? It is likely to return a slew of errors because the CA will be unresponsive but it will also check a number of things that could lead to a root cause.
rob
On Wed, Sep 4, 2024 at 1:35 PM flo--- via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list. -- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- /Kind Regards/
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com http://jscrambler.com/
Responses in-line.
Duarte Petiz wrote:
Hello, thank you Rob [root@prod-us-freeipa /]# ipa-healthcheck [ { "source": "ipahealthcheck.ipa.certs", "check": "IPACertMatchCheck", "result": "ERROR", "uuid": "4bb93268-3bee-4c0c-8dc9-c1bd03293d34", "when": "20240905082820Z", "duration": "0.011836", "kw": { "key": "cn=JSCRAMBLER.COM http://JSCRAMBLER.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=jscrambler,dc=com", "dn": "cn=JSCRAMBLER.COM http://JSCRAMBLER.COM IPA CA,cn=certificates,cn=ipa,cn=etc,dc=jscrambler,dc=com", "serial_number": 1, "msg": "CA Certificate serial number {serial} is in LDAP '{dn}' but is not in /etc/ipa/ca.crt" } },
Run this and see what certificate(s) are currently in /etc/ipa/ca.crt:
openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt | openssl pkcs7 -print_certs -text -noout
It is unexpected that the IPA CA cert is not present in /etc/ipa/ca.crt.
{ "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "f2f7f0e4-5d46-4e45-9ca6-56ae855e56e9", "when": "20240905082820Z", "duration": "0.070035", "kw": { "key": "caSigningCert cert-pki-ca", "nickname": "caSigningCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "8c591194-50d3-489e-a078-7f9fadb6c2fd", "when": "20240905082820Z", "duration": "0.399892", "kw": { "key": "ocspSigningCert cert-pki-ca", "nickname": "ocspSigningCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "10a1cb1c-c08c-4f05-87ea-ee1aac253692", "when": "20240905082820Z", "duration": "0.448749", "kw": { "key": "subsystemCert cert-pki-ca", "nickname": "subsystemCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "ac4edfc6-c254-45c5-8ec6-63cbd653f010", "when": "20240905082820Z", "duration": "0.496190", "kw": { "key": "auditSigningCert cert-pki-ca", "nickname": "auditSigningCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "edf86d59-2a47-4af8-a97c-bcaf8613897d", "when": "20240905082820Z", "duration": "0.568801", "kw": { "key": "Server-Cert cert-pki-ca", "nickname": "Server-Cert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPARAAgent", "result": "ERROR", "uuid": "bfb90711-9ab8-4b86-be1c-7fce8a0c673c", "when": "20240905082820Z", "duration": "0.006922", "kw": { "key": "ldap_mismatch", "certfile": "/var/lib/ipa/ra-agent.pem", "dn": "uid=ipara,ou=people,o=ipaca", "msg": "RA agent certificate in {certfile} not found in LDAP userCertificate attribute for the entry {dn}" } },
So it's strange that the certs don't match. I imagine they all have the same issue so let's pick just one to examine further.
ldapsearch -LLL -x -D 'cn=directory manager' -W -b ou=certificateRepository,ou=ca,o=ipaca '(subjectName=CN=CA Audit,O=EXAMPLE.TEST)' cn
Then certutil -L -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' | grep 'Serial Number'
The cn should match the serial number. If not what is the LDAP serial number? It's possible it got written to LDAP and not to the NSS db.
The remaining issues shouldn't cause the CA to not function so let's focus on this.
rob
{ "source": "ipahealthcheck.ipa.dna", "check": "IPADNARangeCheck", "result": "CRITICAL", "uuid": "f9e6c147-ef0d-4a80-b19d-cbb3cbe4ce1d", "when": "20240905082822Z", "duration": "0.074268", "kw": { "exception": "Insufficient access: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Preauthentication failed)", "traceback": "Traceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1087, in error_handler\n yield\n File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1258, in gssapi_bind\n self.conn.sasl_interactive_bind_s(\n File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 270, in sasl_interactive_bind_s\n return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags)\n File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call\n result = func(*args,**kwargs)\nldap.LOCAL_ERROR: {'result': -2, 'desc': 'Local error', 'ctrls': [], 'info': 'SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Preauthentication failed)'}\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/ipahealthcheck/core/core.py", line 56, in run_plugin\n for result in plugin.check():\n File "/usr/lib/python3.9/site-packages/ipahealthcheck/core/plugin.py", line 18, in wrapper\n for result in f(*args, **kwds):\n File "/usr/lib/python3.9/site-packages/ipahealthcheck/ipa/dna.py", line 32, in check\n agmt = replication.ReplicationManager(api.env.realm, api.env.host)\n File "/usr/lib/python3.9/site-packages/ipaserver/install/replication.py", line 268, in __init__\n self.conn.gssapi_bind()\n File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1258, in gssapi_bind\n self.conn.sasl_interactive_bind_s(\n File "/usr/lib64/python3.9/contextlib.py", line 137, in __exit__\n self.gen.throw(typ, value, traceback)\n File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1143, in error_handler\n raise errors.ACIError(info=info)\nipalib.errors.ACIError: Insufficient access: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Preauthentication failed)\n" } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "5c105f14-6f10-4931-8986-5effd0be9b27", "when": "20240905082822Z", "duration": "0.070505", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.jscrambler.com http://tcp.jscrambler.com.:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "50e2ccb5-7d62-4edb-a9e4-691e49c6966d", "when": "20240905082822Z", "duration": "0.077283", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.jscrambler.com http://tcp.jscrambler.com.:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "ddbd6ec8-de76-4b1d-a3df-bbf45e1669e4", "when": "20240905082822Z", "duration": "0.098272", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.jscrambler.com http://udp.jscrambler.com.:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "be3790d6-158e-40ae-b1d2-c0b5b532be96", "when": "20240905082822Z", "duration": "0.105748", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._tcp.jscrambler.com http://tcp.jscrambler.com.:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "b3fbd679-4906-4ad8-889b-923426ec9bc2", "when": "20240905082822Z", "duration": "0.121375", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._udp.jscrambler.com http://udp.jscrambler.com.:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "550ed58a-309d-4756-8e20-61d8e2a7ea60", "when": "20240905082822Z", "duration": "0.129817", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._tcp.jscrambler.com http://tcp.jscrambler.com.:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "e22c24d3-e1d1-4db8-9640-332fb3c3d901", "when": "20240905082822Z", "duration": "0.139263", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._udp.jscrambler.com http://udp.jscrambler.com.:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "265a4ab3-fb2e-4f2b-b83d-0264e11a13d7", "when": "20240905082822Z", "duration": "0.146888", "kw": { "msg": "Expected URI record missing", "key": "_kerberos.jscrambler.com.:krb5srv:m:tcp:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "df8e8a86-69c7-4d6d-a850-597c017ad9da", "when": "20240905082822Z", "duration": "0.146902", "kw": { "msg": "Expected URI record missing", "key": "_kerberos.jscrambler.com.:krb5srv:m:udp:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "591655a6-fddc-42e9-9cdd-b310cddd912e", "when": "20240905082822Z", "duration": "0.152359", "kw": { "msg": "Expected URI record missing", "key": "_kpasswd.jscrambler.com.:krb5srv:m:tcp:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "82727f16-ba22-4696-b542-1479ac8ffa3f", "when": "20240905082822Z", "duration": "0.152373", "kw": { "msg": "Expected URI record missing", "key": "_kpasswd.jscrambler.com.:krb5srv:m:udp:prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "1ab64a7e-0381-4fe3-a38b-301826551f6e", "when": "20240905082822Z", "duration": "0.174484", "kw": { "key": "ipa_ca_missing_prod-us-freeipa.jscrambler.com http://ipa_ca_missing_prod-us-freeipa.jscrambler.com", "server": "prod-us-freeipa.jscrambler.com http://prod-us-freeipa.jscrambler.com", "ipaddr": "172.18.0.2", "msg": "expected ipa-ca to contain {ipaddr} for {server}" } }, { "source": "ipahealthcheck.ipa.host", "check": "IPAHostKeytab", "result": "ERROR", "uuid": "34eea407-73ae-46be-849c-71dddd4c01a4", "when": "20240905082822Z", "duration": "0.014935", "kw": { "msg": "Failed to obtain host TGT: Major (458752): No credentials were supplied, or the credentials were unavailable or inaccessible, Minor (2529638936): Preauthentication failed" } } ]
On Wed, Sep 4, 2024 at 6:41 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Duarte Petiz via FreeIPA-users wrote: > I will copy/paste it so: > > Hello > > [root@prod-us-freeipa backup]# getcert list | grep expires > expires: 2026-08-25 10:47:09 WEST > expires: 2026-08-25 10:46:16 WEST > expires: 2026-08-25 10:46:05 WEST > expires: 2026-08-25 10:46:12 WEST > expires: 2044-09-04 10:46:01 WEST > expires: 2026-08-25 10:46:09 WEST > expires: 2026-09-05 10:47:42 WEST > > Request ID '20240904094741': > status: MONITORING > stuck: no > key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > CA: IPA > issuer: CN=Certificate Authority,O=EXAMPLE.COM <http://EXAMPLE.COM> <http://example.com/> > subject: CN=prod-us-freeipa.example.com <http://prod-us-freeipa.example.com> > <http://prod-us-freeipa.example.com/>,O=EXAMPLE.COM <http://EXAMPLE.COM> <http://example.com/> > issued: 2024-09-04 10:47:42 WEST > expires: 2026-09-05 10:47:42 WEST > dns: prod-us-freeipa.example.com <http://prod-us-freeipa.example.com> <http://prod-us-freeipa.example.com/> > principal name: krbtgt/EXAMPLE.COM@EXAMPLE.COM <mailto:EXAMPLE.COM@EXAMPLE.COM> > <mailto:EXAMPLE.COM@EXAMPLE.COM <mailto:EXAMPLE.COM@EXAMPLE.COM>> > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-pkinit-KPKdc > profile: KDCs_PKINIT_Certs > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > track: yes > auto-renew: yes > > > I think the problem is related with some certificate that is included in > the backup with "--data". > If I do a full restore it brokes de PKI and seems to be impossible to > restore. > The "--data" flag maybe have some certificate injected different else > than dn: uid=pkidbuser,ou=people,o=ipaca. > On the dashboard the error is: Your session has expired. Please log in > again. > > on the logs > [Wed Sep 04 10:09:13.645078 2024] [wsgi:error] [pid 254:tid 438] > [remote 172.21.0.1:48490 <http://172.21.0.1:48490> <http://172.21.0.1:48490/>] ipa: INFO: 401 > Unauthorized: Insufficient access: Invalid credentials > [Wed Sep 04 10:09:13.819864 2024] [:warn] [pid 257:tid 325] > [client 172.21.0.1:48500 <http://172.21.0.1:48500> <http://172.21.0.1:48500/>] failed to set perms > (3140) on file (/run/ipa/ccaches/duarte.petiz@EXAMPLE.COM-DcoTto)!, > referer: https://prod-us-freeipa.example.com/ipa/ui > [Wed Sep 04 10:09:14.045869 2024] [wsgi:error] [pid 253:tid 432] > [remote 172.21.0.1:48504 <http://172.21.0.1:48504> <http://172.21.0.1:48504/>] ipa: INFO: 401 > Unauthorized: Insufficient access: Invalid credentials > > > But i cannot find what is really causing the issue... > > > If I do a full-restore with the following procedure I can login into > the web portal, but the PKI goes broken. > > 1º install new freeipa 2º restore /var/lib/ipa/private/httpd.key 3º > restore /var/lib/ipa/gssproxy/http.keytab 5º docker exec -ti > ipa-freeipa-1 bash 6º ipa-restore /var/lib/ipa/backup/backup > > There is some way to do a new "pki" install in an existing > installed/restored freeipa? > I cannot let the PKI down, it will break the upgrades for future > versions. That's why I tried to restore data-only. There is no supported way to replace the CA. Can you install the {free}ipa-healthcheck package and run ipa-healthcheck? It is likely to return a slew of errors because the CA will be unresponsive but it will also check a number of things that could lead to a root cause. rob > > > On Wed, Sep 4, 2024 at 1:35 PM flo--- via FreeIPA-users > <freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> > <mailto:freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>>> wrote: > > The content of this message was lost. It was probably cross-posted to > multiple lists and previously handled on another list. > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> > <mailto:freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>> > To unsubscribe send an email to > freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> > <mailto:freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org>> > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > > > -- > /Kind Regards/ > > *Duarte Petiz* > *DevOps Team Lead *| jscrambler.com <http://jscrambler.com> <http://jscrambler.com/> > * > * > * > * > >
-- /Kind Regards/
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com http://jscrambler.com/
Hello Rob Thank you a lot for your help.
Answers: openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt | openssl pkcs7 -print_certs -text -noout
Certificate:
Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: O=JSCRAMBLER.COM, CN=Certificate Authority Validity Not Before: Sep 4 09:46:01 2024 GMT Not After : Sep 4 09:46:01 2044 GMT Subject: O=JSCRAMBLER.COM, CN=Certificate Authority Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (3072 bit) Modulus: 00:a7:73:8a:1d:06:fa:c2:2e:ca:f2:c1:6b:ec:9a: e2:19:1b:20:8c:ab:8f:d5:51:b2:87:e1:32:a8:8c: fc:e3:a6:58:a2:91:51:4d:03:c8:05:c3:6a:a1:94: d1:77:ce:bf:6f:5b:c3:d9:c0:4f:da:29:a8:9a:bf: f2:a4:b2:fc:b4:8b:a2:5e:47:20:74:23:12:2d:8e: 67:d4:a3:17:0c:8f:e8:d4:de:75:62:cc:f3:5d:c1: 6a:ed:28:16:3c:57:a6:f1:8d:51:15:d9:a3:8a:90: 04:94:72:7c:3a:fa:dd:50:d3:fb:82:21:1f:84:d2: 3e:5e:75:c4:12:23:89:ae:34:c7:b8:fc:c0:c8:b7: 38:1f:e7:2f:71:21:96:4f:98:a3:6f:53:d5:a0:73: c4:9e:78:1b:59:d9:ec:6f:4f:d8:84:fa:b2:af:55: 7a:8a:93:12:a4:50:f6:cd:9d:7f:3c:39:23:4b:62: 0f:a6:31:30:61:d8:95:08:e9:3a:a7:6f:f7:91:29: f4:67:14:40:59:ff:98:1f:54:13:f0:f3:c1:76:f4: ff:1c:b9:18:e6:c1:3d:44:2a:8c:59:0d:9d:70:c0: 5a:eb:84:e7:ec:be:b2:b5:9d:42:cd:fc:4c:33:8b: 0d:65:01:7f:59:0f:fe:59:bc:2b:60:7d:36:0d:f3: b1:e6:91:e0:d6:c5:a0:ae:61:9d:bb:20:b6:42:5b: 99:5b:a7:28:e4:e7:4a:35:17:3d:22:67:61:e2:c0: 99:a5:bb:0f:b1:82:04:cf:55:ab:94:c7:54:d0:6d: 1a:0a:b2:3d:bc:b8:c2:bc:c8:7e:e2:59:eb:f8:4c: b3:3c:f7:c0:94:44:39:3f:6a:93:b2:36:e3:43:dc: 8f:16:5f:3a:dc:2c:0a:74:a0:8c:c6:b2:af:a5:f4: 2a:e1:36:38:bf:bf:29:98:13:a8:04:5e:79:f4:8e: 28:c7:01:d8:7b:51:84:10:d8:3b:7a:8b:b4:91:e6: 2c:a9:69:50:10:98:2a:54:8e:25 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: 22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, Non Repudiation, Certificate Sign, CRL
Sign X509v3 Subject Key Identifier: 22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 Authority Information Access: OCSP - URI:http://ipa-ca.jscrambler.com/ca/ocsp Signature Algorithm: sha256WithRSAEncryption Signature Value: a4:14:11:b4:c5:ba:7b:3a:41:08:ea:69:92:41:e7:1b:71:2e: 45:30:f0:0d:92:c7:b0:a4:bc:83:4b:b5:ff:1d:78:ae:52:c7: cd:f4:9c:f6:92:01:c8:f0:aa:8e:0a:9a:36:81:53:45:06:d3: 1a:2c:7a:27:6d:00:d0:08:47:d8:2f:0b:2b:67:14:1f:76:13: 62:2a:0c:b9:24:91:f4:55:50:7b:0b:a2:b8:d7:66:68:49:cf: 76:25:18:3e:4d:71:6a:10:1a:4e:33:c3:44:2d:75:6c:c8:73: 62:03:06:44:5d:1d:68:a1:a7:7f:91:9d:33:c0:7f:76:50:6f: 73:5b:6a:2c:91:3b:e8:9f:5a:d6:61:61:f6:44:85:45:8e:a1: f0:8d:a8:07:4d:24:70:73:c7:91:54:e2:99:0b:cc:04:fd:b3: 1b:ed:f2:8a:fc:d2:cf:18:76:18:87:45:3e:f9:cf:58:f0:5b: da:23:b1:51:b9:23:1a:f0:b2:be:3a:6e:c0:c6:13:17:ea:ca: 2d:a6:09:fa:17:04:a2:44:e6:35:9c:6a:d9:4e:e8:37:67:38: 00:69:35:9f:9c:57:2b:01:51:eb:f8:ce:ac:18:d7:87:93:a1: e8:24:fd:fc:c3:9e:21:0a:9f:27:79:6a:00:0b:83:ca:dc:cd: 8e:b2:7c:95:99:ad:3c:4a:81:a1:d7:5f:e9:20:3e:75:ab:cb: ab:46:c3:19:e2:55:9b:ea:5c:79:e1:80:36:84:03:a8:37:89: 2a:d8:45:b3:ba:7c:49:74:a4:ad:8f:09:90:35:32:c6:07:42: 65:28:7b:d8:ec:f6:40:88:38:74:1b:6f:79:f3:0a:67:4f:c0: d3:37:3b:c9:8e:bb:9e:28:e0:0d:ac:49:a3:e9:97:bf:40:b3: 7d:4f:71:22:be:cb:b6:64:8b:41:12:f3:f0:76:c7:a1:18:17: 3d:fc:75:2b:cd:7f:84:09:31:78:4c:b2:c1:9a:ba:3a:f8:44: 02:81:75:9c:57:c2 Certificate: Data: Version: 3 (0x2) Serial Number: 09:0e:e8:c5:de:5b:fa:62:d2:ae:2f:f7:09:7c:48:57 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2 Validity Not Before: Nov 2 12:24:25 2017 GMT Not After : Nov 2 12:24:25 2027 GMT Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c6:39:e0:98:f8:55:7a:d0:b4:6f:fa:33:6d:82: 5d:cc:e0:54:03:5b:0c:a2:0e:3b:d3:7d:1c:00:ff: 8f:db:70:0d:50:df:20:ad:71:02:2f:c3:61:0c:41: 78:17:54:7d:b4:bd:30:63:49:9c:cc:76:91:d1:ae: e5:61:a9:e5:c6:dc:16:a3:5b:36:b8:69:e7:c8:3b: 3a:98:e0:ac:eb:a7:b0:db:0d:d8:11:3a:fa:4d:bd: 78:c6:08:e9:bb:58:06:16:d0:1e:7b:06:a2:90:ef: 45:b9:df:21:c4:62:53:4b:09:fc:c5:e3:64:7c:a5: 56:a4:3d:8b:e2:f1:4d:df:a1:4d:83:17:a2:94:ae: 9a:13:8c:a4:80:60:33:36:5a:24:4e:9e:a1:34:e2: c0:62:90:f2:49:d2:c0:3c:ac:ee:25:24:3b:24:21: 19:e8:ef:92:0c:ac:b0:21:d5:cb:a0:c4:e7:a7:1b: 81:28:64:86:f3:c3:56:4e:8d:c2:1c:23:86:99:01: 02:89:ad:b2:a9:d3:c3:8e:02:ea:9c:48:98:36:3c: 10:2f:cb:8c:aa:3f:2b:3a:f9:4c:82:f8:81:70:70: 3b:c6:dc:be:ef:fb:98:2c:de:99:4b:b5:6a:d7:f1: 7f:95:58:55:39:fe:5e:8f:a8:d9:76:60:7c:e6:cc: c5:6d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: A5:8C:FE:32:CC:EB:0F:2C:D4:19:C6:08:B8:00:24:88:5D:C3:C5:B7 X509v3 Authority Key Identifier: 4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Authority Information Access: OCSP - URI:http://ocsp.digicert.com X509v3 CRL Distribution Points: Full Name: URI:http://crl3.digicert.com/DigiCertGlobalRootG2.crl X509v3 Certificate Policies: Policy: X509v3 Any Policy CPS: https://www.digicert.com/CPS Signature Algorithm: sha256WithRSAEncryption Signature Value: ba:92:6d:0a:03:8b:13:6f:65:58:a4:40:66:fe:e2:f6:1c:bf: e9:65:7f:41:ec:bf:e1:6c:9e:0d:72:80:5e:ed:5e:7a:a0:29: ed:ed:a7:88:a3:cb:0c:8c:24:56:4c:25:99:0f:57:58:d3:ed: 8a:64:e0:b5:74:a8:fc:77:55:57:5c:0b:67:8f:2b:43:0e:e3: cf:7f:af:e2:a3:0d:26:61:04:ce:fc:60:20:fc:c2:f2:2f:a0: 83:9b:71:73:0c:1f:15:b6:c1:ff:69:e3:20:3f:aa:60:0f:55: d0:ab:3f:a1:68:39:df:9c:94:ca:06:ec:61:72:99:f1:dc:07: 5b:95:eb:9e:fd:09:cf:7f:58:47:61:af:0b:f9:1b:fc:3e:2e: 54:87:85:7d:17:01:ce:7e:98:5d:31:73:b1:8b:5e:0e:aa:6b: 22:4d:b7:39:70:eb:3d:fe:eb:a4:1f:e6:15:b2:e1:5d:59:39: da:e8:85:70:d6:a8:7e:b4:4b:72:1f:5e:91:be:68:bb:a6:4a: b2:65:85:0b:38:f3:08:13:b6:af:ae:58:d5:54:16:6e:8a:4c: 00:46:d6:3c:b4:25:55:e8:fa:7d:97:75:5e:6a:00:6a:6f:67: df:82:a3:49:b7:70:b4:4d:83:58:40:8f:81:5c:6d:51:d5:c0: 01:96:89:5d
Certificate: Data: Version: 3 (0x2) Serial Number: 03:3a:f1:e6:a7:11:a9:a0:bb:28:64:b1:1d:09:fa:e5 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2 Validity Not Before: Aug 1 12:00:00 2013 GMT Not After : Jan 15 12:00:00 2038 GMT Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:bb:37:cd:34:dc:7b:6b:c9:b2:68:90:ad:4a:75: ff:46:ba:21:0a:08:8d:f5:19:54:c9:fb:88:db:f3: ae:f2:3a:89:91:3c:7a:e6:ab:06:1a:6b:cf:ac:2d: e8:5e:09:24:44:ba:62:9a:7e:d6:a3:a8:7e:e0:54: 75:20:05:ac:50:b7:9c:63:1a:6c:30:dc:da:1f:19: b1:d7:1e:de:fd:d7:e0:cb:94:83:37:ae:ec:1f:43: 4e:dd:7b:2c:d2:bd:2e:a5:2f:e4:a9:b8:ad:3a:d4: 99:a4:b6:25:e9:9b:6b:00:60:92:60:ff:4f:21:49: 18:f7:67:90:ab:61:06:9c:8f:f2:ba:e9:b4:e9:92: 32:6b:b5:f3:57:e8:5d:1b:cd:8c:1d:ab:95:04:95: 49:f3:35:2d:96:e3:49:6d:dd:77:e3:fb:49:4b:b4: ac:55:07:a9:8f:95:b3:b4:23:bb:4c:6d:45:f0:f6: a9:b2:95:30:b4:fd:4c:55:8c:27:4a:57:14:7c:82: 9d:cd:73:92:d3:16:4a:06:0c:8c:50:d1:8f:1e:09: be:17:a1:e6:21:ca:fd:83:e5:10:bc:83:a5:0a:c4: 67:28:f6:73:14:14:3d:46:76:c3:87:14:89:21:34: 4d:af:0f:45:0c:a6:49:a1:ba:bb:9c:c5:b1:33:83: 29:85 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Subject Key Identifier: 4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 Signature Algorithm: sha256WithRSAEncryption Signature Value: 60:67:28:94:6f:0e:48:63:eb:31:dd:ea:67:18:d5:89:7d:3c: c5:8b:4a:7f:e9:be:db:2b:17:df:b0:5f:73:77:2a:32:13:39: 81:67:42:84:23:f2:45:67:35:ec:88:bf:f8:8f:b0:61:0c:34: a4:ae:20:4c:84:c6:db:f8:35:e1:76:d9:df:a6:42:bb:c7:44: 08:86:7f:36:74:24:5a:da:6c:0d:14:59:35:bd:f2:49:dd:b6: 1f:c9:b3:0d:47:2a:3d:99:2f:bb:5c:bb:b5:d4:20:e1:99:5f: 53:46:15:db:68:9b:f0:f3:30:d5:3e:31:e2:8d:84:9e:e3:8a: da:da:96:3e:35:13:a5:5f:f0:f9:70:50:70:47:41:11:57:19: 4e:c0:8f:ae:06:c4:95:13:17:2f:1b:25:9f:75:f2:b1:8e:99: a1:6f:13:b1:41:71:fe:88:2a:c8:4f:10:20:55:d7:f3:14:45: e5:e0:44:f4:ea:87:95:32:93:0e:fe:53:46:fa:2c:9d:ff:8b: 22:b9:4b:d9:09:45:a4:de:a4:b8:9a:58:dd:1b:7d:52:9f:8e: 59:43:88:81:a4:9e:26:d5:6f:ad:dd:0d:c6:37:7d:ed:03:92: 1b:e5:77:5f:76:ee:3c:8d:c4:5d:56:5b:a2:d9:66:6e:b3:35: 37:e5:32:b6
[root@prod-us-freeipa /]# ldapsearch -LLL -x -D 'cn=directory manager' -W -b ou=certificateRepository,ou=ca,o=ipaca '(subjectName=CN=CA Audit,O= JSCRAMBLER.COM)' cn Enter LDAP Password: dn: cn=5,ou=certificateRepository,ou=ca,o=ipaca cn: 5
[root@prod-us-freeipa /]# certutil -L -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' | grep 'Serial Number' Serial Number: 5 (0x5)
Hello, Everything fine? Did you had availability to check it? Regards
On Fri, Sep 6, 2024 at 9:58 AM Duarte Petiz duarte.petiz@jscrambler.com wrote:
Hello Rob Thank you a lot for your help.
Answers: openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt | openssl pkcs7 -print_certs -text -noout
Certificate:
Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: O=JSCRAMBLER.COM, CN=Certificate Authority Validity Not Before: Sep 4 09:46:01 2024 GMT Not After : Sep 4 09:46:01 2044 GMT Subject: O=JSCRAMBLER.COM, CN=Certificate Authority Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (3072 bit) Modulus: 00:a7:73:8a:1d:06:fa:c2:2e:ca:f2:c1:6b:ec:9a: e2:19:1b:20:8c:ab:8f:d5:51:b2:87:e1:32:a8:8c: fc:e3:a6:58:a2:91:51:4d:03:c8:05:c3:6a:a1:94: d1:77:ce:bf:6f:5b:c3:d9:c0:4f:da:29:a8:9a:bf: f2:a4:b2:fc:b4:8b:a2:5e:47:20:74:23:12:2d:8e: 67:d4:a3:17:0c:8f:e8:d4:de:75:62:cc:f3:5d:c1: 6a:ed:28:16:3c:57:a6:f1:8d:51:15:d9:a3:8a:90: 04:94:72:7c:3a:fa:dd:50:d3:fb:82:21:1f:84:d2: 3e:5e:75:c4:12:23:89:ae:34:c7:b8:fc:c0:c8:b7: 38:1f:e7:2f:71:21:96:4f:98:a3:6f:53:d5:a0:73: c4:9e:78:1b:59:d9:ec:6f:4f:d8:84:fa:b2:af:55: 7a:8a:93:12:a4:50:f6:cd:9d:7f:3c:39:23:4b:62: 0f:a6:31:30:61:d8:95:08:e9:3a:a7:6f:f7:91:29: f4:67:14:40:59:ff:98:1f:54:13:f0:f3:c1:76:f4: ff:1c:b9:18:e6:c1:3d:44:2a:8c:59:0d:9d:70:c0: 5a:eb:84:e7:ec:be:b2:b5:9d:42:cd:fc:4c:33:8b: 0d:65:01:7f:59:0f:fe:59:bc:2b:60:7d:36:0d:f3: b1:e6:91:e0:d6:c5:a0:ae:61:9d:bb:20:b6:42:5b: 99:5b:a7:28:e4:e7:4a:35:17:3d:22:67:61:e2:c0: 99:a5:bb:0f:b1:82:04:cf:55:ab:94:c7:54:d0:6d: 1a:0a:b2:3d:bc:b8:c2:bc:c8:7e:e2:59:eb:f8:4c: b3:3c:f7:c0:94:44:39:3f:6a:93:b2:36:e3:43:dc: 8f:16:5f:3a:dc:2c:0a:74:a0:8c:c6:b2:af:a5:f4: 2a:e1:36:38:bf:bf:29:98:13:a8:04:5e:79:f4:8e: 28:c7:01:d8:7b:51:84:10:d8:3b:7a:8b:b4:91:e6: 2c:a9:69:50:10:98:2a:54:8e:25 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier:
22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, Non Repudiation, Certificate Sign, CRL Sign X509v3 Subject Key Identifier:
22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 Authority Information Access: OCSP - URI:http://ipa-ca.jscrambler.com/ca/ocsp Signature Algorithm: sha256WithRSAEncryption Signature Value: a4:14:11:b4:c5:ba:7b:3a:41:08:ea:69:92:41:e7:1b:71:2e: 45:30:f0:0d:92:c7:b0:a4:bc:83:4b:b5:ff:1d:78:ae:52:c7: cd:f4:9c:f6:92:01:c8:f0:aa:8e:0a:9a:36:81:53:45:06:d3: 1a:2c:7a:27:6d:00:d0:08:47:d8:2f:0b:2b:67:14:1f:76:13: 62:2a:0c:b9:24:91:f4:55:50:7b:0b:a2:b8:d7:66:68:49:cf: 76:25:18:3e:4d:71:6a:10:1a:4e:33:c3:44:2d:75:6c:c8:73: 62:03:06:44:5d:1d:68:a1:a7:7f:91:9d:33:c0:7f:76:50:6f: 73:5b:6a:2c:91:3b:e8:9f:5a:d6:61:61:f6:44:85:45:8e:a1: f0:8d:a8:07:4d:24:70:73:c7:91:54:e2:99:0b:cc:04:fd:b3: 1b:ed:f2:8a:fc:d2:cf:18:76:18:87:45:3e:f9:cf:58:f0:5b: da:23:b1:51:b9:23:1a:f0:b2:be:3a:6e:c0:c6:13:17:ea:ca: 2d:a6:09:fa:17:04:a2:44:e6:35:9c:6a:d9:4e:e8:37:67:38: 00:69:35:9f:9c:57:2b:01:51:eb:f8:ce:ac:18:d7:87:93:a1: e8:24:fd:fc:c3:9e:21:0a:9f:27:79:6a:00:0b:83:ca:dc:cd: 8e:b2:7c:95:99:ad:3c:4a:81:a1:d7:5f:e9:20:3e:75:ab:cb: ab:46:c3:19:e2:55:9b:ea:5c:79:e1:80:36:84:03:a8:37:89: 2a:d8:45:b3:ba:7c:49:74:a4:ad:8f:09:90:35:32:c6:07:42: 65:28:7b:d8:ec:f6:40:88:38:74:1b:6f:79:f3:0a:67:4f:c0: d3:37:3b:c9:8e:bb:9e:28:e0:0d:ac:49:a3:e9:97:bf:40:b3: 7d:4f:71:22:be:cb:b6:64:8b:41:12:f3:f0:76:c7:a1:18:17: 3d:fc:75:2b:cd:7f:84:09:31:78:4c:b2:c1:9a:ba:3a:f8:44: 02:81:75:9c:57:c2 Certificate: Data: Version: 3 (0x2) Serial Number: 09:0e:e8:c5:de:5b:fa:62:d2:ae:2f:f7:09:7c:48:57 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2 Validity Not Before: Nov 2 12:24:25 2017 GMT Not After : Nov 2 12:24:25 2027 GMT Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=Thawte TLS RSA CA G1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c6:39:e0:98:f8:55:7a:d0:b4:6f:fa:33:6d:82: 5d:cc:e0:54:03:5b:0c:a2:0e:3b:d3:7d:1c:00:ff: 8f:db:70:0d:50:df:20:ad:71:02:2f:c3:61:0c:41: 78:17:54:7d:b4:bd:30:63:49:9c:cc:76:91:d1:ae: e5:61:a9:e5:c6:dc:16:a3:5b:36:b8:69:e7:c8:3b: 3a:98:e0:ac:eb:a7:b0:db:0d:d8:11:3a:fa:4d:bd: 78:c6:08:e9:bb:58:06:16:d0:1e:7b:06:a2:90:ef: 45:b9:df:21:c4:62:53:4b:09:fc:c5:e3:64:7c:a5: 56:a4:3d:8b:e2:f1:4d:df:a1:4d:83:17:a2:94:ae: 9a:13:8c:a4:80:60:33:36:5a:24:4e:9e:a1:34:e2: c0:62:90:f2:49:d2:c0:3c:ac:ee:25:24:3b:24:21: 19:e8:ef:92:0c:ac:b0:21:d5:cb:a0:c4:e7:a7:1b: 81:28:64:86:f3:c3:56:4e:8d:c2:1c:23:86:99:01: 02:89:ad:b2:a9:d3:c3:8e:02:ea:9c:48:98:36:3c: 10:2f:cb:8c:aa:3f:2b:3a:f9:4c:82:f8:81:70:70: 3b:c6:dc:be:ef:fb:98:2c:de:99:4b:b5:6a:d7:f1: 7f:95:58:55:39:fe:5e:8f:a8:d9:76:60:7c:e6:cc: c5:6d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier:
A5:8C:FE:32:CC:EB:0F:2C:D4:19:C6:08:B8:00:24:88:5D:C3:C5:B7 X509v3 Authority Key Identifier:
4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Authority Information Access: OCSP - URI:http://ocsp.digicert.com X509v3 CRL Distribution Points: Full Name: URI:http://crl3.digicert.com/DigiCertGlobalRootG2.crl X509v3 Certificate Policies: Policy: X509v3 Any Policy CPS: https://www.digicert.com/CPS Signature Algorithm: sha256WithRSAEncryption Signature Value: ba:92:6d:0a:03:8b:13:6f:65:58:a4:40:66:fe:e2:f6:1c:bf: e9:65:7f:41:ec:bf:e1:6c:9e:0d:72:80:5e:ed:5e:7a:a0:29: ed:ed:a7:88:a3:cb:0c:8c:24:56:4c:25:99:0f:57:58:d3:ed: 8a:64:e0:b5:74:a8:fc:77:55:57:5c:0b:67:8f:2b:43:0e:e3: cf:7f:af:e2:a3:0d:26:61:04:ce:fc:60:20:fc:c2:f2:2f:a0: 83:9b:71:73:0c:1f:15:b6:c1:ff:69:e3:20:3f:aa:60:0f:55: d0:ab:3f:a1:68:39:df:9c:94:ca:06:ec:61:72:99:f1:dc:07: 5b:95:eb:9e:fd:09:cf:7f:58:47:61:af:0b:f9:1b:fc:3e:2e: 54:87:85:7d:17:01:ce:7e:98:5d:31:73:b1:8b:5e:0e:aa:6b: 22:4d:b7:39:70:eb:3d:fe:eb:a4:1f:e6:15:b2:e1:5d:59:39: da:e8:85:70:d6:a8:7e:b4:4b:72:1f:5e:91:be:68:bb:a6:4a: b2:65:85:0b:38:f3:08:13:b6:af:ae:58:d5:54:16:6e:8a:4c: 00:46:d6:3c:b4:25:55:e8:fa:7d:97:75:5e:6a:00:6a:6f:67: df:82:a3:49:b7:70:b4:4d:83:58:40:8f:81:5c:6d:51:d5:c0: 01:96:89:5d
Certificate: Data: Version: 3 (0x2) Serial Number: 03:3a:f1:e6:a7:11:a9:a0:bb:28:64:b1:1d:09:fa:e5 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2 Validity Not Before: Aug 1 12:00:00 2013 GMT Not After : Jan 15 12:00:00 2038 GMT Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:bb:37:cd:34:dc:7b:6b:c9:b2:68:90:ad:4a:75: ff:46:ba:21:0a:08:8d:f5:19:54:c9:fb:88:db:f3: ae:f2:3a:89:91:3c:7a:e6:ab:06:1a:6b:cf:ac:2d: e8:5e:09:24:44:ba:62:9a:7e:d6:a3:a8:7e:e0:54: 75:20:05:ac:50:b7:9c:63:1a:6c:30:dc:da:1f:19: b1:d7:1e:de:fd:d7:e0:cb:94:83:37:ae:ec:1f:43: 4e:dd:7b:2c:d2:bd:2e:a5:2f:e4:a9:b8:ad:3a:d4: 99:a4:b6:25:e9:9b:6b:00:60:92:60:ff:4f:21:49: 18:f7:67:90:ab:61:06:9c:8f:f2:ba:e9:b4:e9:92: 32:6b:b5:f3:57:e8:5d:1b:cd:8c:1d:ab:95:04:95: 49:f3:35:2d:96:e3:49:6d:dd:77:e3:fb:49:4b:b4: ac:55:07:a9:8f:95:b3:b4:23:bb:4c:6d:45:f0:f6: a9:b2:95:30:b4:fd:4c:55:8c:27:4a:57:14:7c:82: 9d:cd:73:92:d3:16:4a:06:0c:8c:50:d1:8f:1e:09: be:17:a1:e6:21:ca:fd:83:e5:10:bc:83:a5:0a:c4: 67:28:f6:73:14:14:3d:46:76:c3:87:14:89:21:34: 4d:af:0f:45:0c:a6:49:a1:ba:bb:9c:c5:b1:33:83: 29:85 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Subject Key Identifier:
4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 Signature Algorithm: sha256WithRSAEncryption Signature Value: 60:67:28:94:6f:0e:48:63:eb:31:dd:ea:67:18:d5:89:7d:3c: c5:8b:4a:7f:e9:be:db:2b:17:df:b0:5f:73:77:2a:32:13:39: 81:67:42:84:23:f2:45:67:35:ec:88:bf:f8:8f:b0:61:0c:34: a4:ae:20:4c:84:c6:db:f8:35:e1:76:d9:df:a6:42:bb:c7:44: 08:86:7f:36:74:24:5a:da:6c:0d:14:59:35:bd:f2:49:dd:b6: 1f:c9:b3:0d:47:2a:3d:99:2f:bb:5c:bb:b5:d4:20:e1:99:5f: 53:46:15:db:68:9b:f0:f3:30:d5:3e:31:e2:8d:84:9e:e3:8a: da:da:96:3e:35:13:a5:5f:f0:f9:70:50:70:47:41:11:57:19: 4e:c0:8f:ae:06:c4:95:13:17:2f:1b:25:9f:75:f2:b1:8e:99: a1:6f:13:b1:41:71:fe:88:2a:c8:4f:10:20:55:d7:f3:14:45: e5:e0:44:f4:ea:87:95:32:93:0e:fe:53:46:fa:2c:9d:ff:8b: 22:b9:4b:d9:09:45:a4:de:a4:b8:9a:58:dd:1b:7d:52:9f:8e: 59:43:88:81:a4:9e:26:d5:6f:ad:dd:0d:c6:37:7d:ed:03:92: 1b:e5:77:5f:76:ee:3c:8d:c4:5d:56:5b:a2:d9:66:6e:b3:35: 37:e5:32:b6
[root@prod-us-freeipa /]# ldapsearch -LLL -x -D 'cn=directory manager' -W -b ou=certificateRepository,ou=ca,o=ipaca '(subjectName=CN=CA Audit,O= JSCRAMBLER.COM)' cn Enter LDAP Password: dn: cn=5,ou=certificateRepository,ou=ca,o=ipaca cn: 5
[root@prod-us-freeipa /]# certutil -L -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' | grep 'Serial Number' Serial Number: 5 (0x5)
-- *Kind Regards*
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com
Duarte Petiz wrote:
Hello, Everything fine? Did you had availability to check it? Regards
On Fri, Sep 6, 2024 at 9:58 AM Duarte Petiz <duarte.petiz@jscrambler.com mailto:duarte.petiz@jscrambler.com> wrote:
Hello Rob Thank you a lot for your help. Answers: openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt | openssl pkcs7 -print_certs -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: O=JSCRAMBLER.COM <http://JSCRAMBLER.COM>, CN=Certificate Authority Validity Not Before: Sep 4 09:46:01 2024 GMT Not After : Sep 4 09:46:01 2044 GMT Subject: O=JSCRAMBLER.COM <http://JSCRAMBLER.COM>, CN=Certificate Authority Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (3072 bit) Modulus: 00:a7:73:8a:1d:06:fa:c2:2e:ca:f2:c1:6b:ec:9a: e2:19:1b:20:8c:ab:8f:d5:51:b2:87:e1:32:a8:8c: fc:e3:a6:58:a2:91:51:4d:03:c8:05:c3:6a:a1:94: d1:77:ce:bf:6f:5b:c3:d9:c0:4f:da:29:a8:9a:bf: f2:a4:b2:fc:b4:8b:a2:5e:47:20:74:23:12:2d:8e: 67:d4:a3:17:0c:8f:e8:d4:de:75:62:cc:f3:5d:c1: 6a:ed:28:16:3c:57:a6:f1:8d:51:15:d9:a3:8a:90: 04:94:72:7c:3a:fa:dd:50:d3:fb:82:21:1f:84:d2: 3e:5e:75:c4:12:23:89:ae:34:c7:b8:fc:c0:c8:b7: 38:1f:e7:2f:71:21:96:4f:98:a3:6f:53:d5:a0:73: c4:9e:78:1b:59:d9:ec:6f:4f:d8:84:fa:b2:af:55: 7a:8a:93:12:a4:50:f6:cd:9d:7f:3c:39:23:4b:62: 0f:a6:31:30:61:d8:95:08:e9:3a:a7:6f:f7:91:29: f4:67:14:40:59:ff:98:1f:54:13:f0:f3:c1:76:f4: ff:1c:b9:18:e6:c1:3d:44:2a:8c:59:0d:9d:70:c0: 5a:eb:84:e7:ec:be:b2:b5:9d:42:cd:fc:4c:33:8b: 0d:65:01:7f:59:0f:fe:59:bc:2b:60:7d:36:0d:f3: b1:e6:91:e0:d6:c5:a0:ae:61:9d:bb:20:b6:42:5b: 99:5b:a7:28:e4:e7:4a:35:17:3d:22:67:61:e2:c0: 99:a5:bb:0f:b1:82:04:cf:55:ab:94:c7:54:d0:6d: 1a:0a:b2:3d:bc:b8:c2:bc:c8:7e:e2:59:eb:f8:4c: b3:3c:f7:c0:94:44:39:3f:6a:93:b2:36:e3:43:dc: 8f:16:5f:3a:dc:2c:0a:74:a0:8c:c6:b2:af:a5:f4: 2a:e1:36:38:bf:bf:29:98:13:a8:04:5e:79:f4:8e: 28:c7:01:d8:7b:51:84:10:d8:3b:7a:8b:b4:91:e6: 2c:a9:69:50:10:98:2a:54:8e:25 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: 22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, Non Repudiation, Certificate Sign, CRL Sign X509v3 Subject Key Identifier: 22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 Authority Information Access: OCSP - URI:http://ipa-ca.jscrambler.com/ca/ocsp Signature Algorithm: sha256WithRSAEncryption Signature Value: a4:14:11:b4:c5:ba:7b:3a:41:08:ea:69:92:41:e7:1b:71:2e: 45:30:f0:0d:92:c7:b0:a4:bc:83:4b:b5:ff:1d:78:ae:52:c7: cd:f4:9c:f6:92:01:c8:f0:aa:8e:0a:9a:36:81:53:45:06:d3: 1a:2c:7a:27:6d:00:d0:08:47:d8:2f:0b:2b:67:14:1f:76:13: 62:2a:0c:b9:24:91:f4:55:50:7b:0b:a2:b8:d7:66:68:49:cf: 76:25:18:3e:4d:71:6a:10:1a:4e:33:c3:44:2d:75:6c:c8:73: 62:03:06:44:5d:1d:68:a1:a7:7f:91:9d:33:c0:7f:76:50:6f: 73:5b:6a:2c:91:3b:e8:9f:5a:d6:61:61:f6:44:85:45:8e:a1: f0:8d:a8:07:4d:24:70:73:c7:91:54:e2:99:0b:cc:04:fd:b3: 1b:ed:f2:8a:fc:d2:cf:18:76:18:87:45:3e:f9:cf:58:f0:5b: da:23:b1:51:b9:23:1a:f0:b2:be:3a:6e:c0:c6:13:17:ea:ca: 2d:a6:09:fa:17:04:a2:44:e6:35:9c:6a:d9:4e:e8:37:67:38: 00:69:35:9f:9c:57:2b:01:51:eb:f8:ce:ac:18:d7:87:93:a1: e8:24:fd:fc:c3:9e:21:0a:9f:27:79:6a:00:0b:83:ca:dc:cd: 8e:b2:7c:95:99:ad:3c:4a:81:a1:d7:5f:e9:20:3e:75:ab:cb: ab:46:c3:19:e2:55:9b:ea:5c:79:e1:80:36:84:03:a8:37:89: 2a:d8:45:b3:ba:7c:49:74:a4:ad:8f:09:90:35:32:c6:07:42: 65:28:7b:d8:ec:f6:40:88:38:74:1b:6f:79:f3:0a:67:4f:c0: d3:37:3b:c9:8e:bb:9e:28:e0:0d:ac:49:a3:e9:97:bf:40:b3: 7d:4f:71:22:be:cb:b6:64:8b:41:12:f3:f0:76:c7:a1:18:17: 3d:fc:75:2b:cd:7f:84:09:31:78:4c:b2:c1:9a:ba:3a:f8:44: 02:81:75:9c:57:c2 Certificate: Data: Version: 3 (0x2) Serial Number: 09:0e:e8:c5:de:5b:fa:62:d2:ae:2f:f7:09:7c:48:57 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com>, CN=DigiCert Global Root G2 Validity Not Before: Nov 2 12:24:25 2017 GMT Not After : Nov 2 12:24:25 2027 GMT Subject: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com>, CN=Thawte TLS RSA CA G1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c6:39:e0:98:f8:55:7a:d0:b4:6f:fa:33:6d:82: 5d:cc:e0:54:03:5b:0c:a2:0e:3b:d3:7d:1c:00:ff: 8f:db:70:0d:50:df:20:ad:71:02:2f:c3:61:0c:41: 78:17:54:7d:b4:bd:30:63:49:9c:cc:76:91:d1:ae: e5:61:a9:e5:c6:dc:16:a3:5b:36:b8:69:e7:c8:3b: 3a:98:e0:ac:eb:a7:b0:db:0d:d8:11:3a:fa:4d:bd: 78:c6:08:e9:bb:58:06:16:d0:1e:7b:06:a2:90:ef: 45:b9:df:21:c4:62:53:4b:09:fc:c5:e3:64:7c:a5: 56:a4:3d:8b:e2:f1:4d:df:a1:4d:83:17:a2:94:ae: 9a:13:8c:a4:80:60:33:36:5a:24:4e:9e:a1:34:e2: c0:62:90:f2:49:d2:c0:3c:ac:ee:25:24:3b:24:21: 19:e8:ef:92:0c:ac:b0:21:d5:cb:a0:c4:e7:a7:1b: 81:28:64:86:f3:c3:56:4e:8d:c2:1c:23:86:99:01: 02:89:ad:b2:a9:d3:c3:8e:02:ea:9c:48:98:36:3c: 10:2f:cb:8c:aa:3f:2b:3a:f9:4c:82:f8:81:70:70: 3b:c6:dc:be:ef:fb:98:2c:de:99:4b:b5:6a:d7:f1: 7f:95:58:55:39:fe:5e:8f:a8:d9:76:60:7c:e6:cc: c5:6d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: A5:8C:FE:32:CC:EB:0F:2C:D4:19:C6:08:B8:00:24:88:5D:C3:C5:B7 X509v3 Authority Key Identifier: 4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Authority Information Access: OCSP - URI:http://ocsp.digicert.com X509v3 CRL Distribution Points: Full Name: URI:http://crl3.digicert.com/DigiCertGlobalRootG2.crl X509v3 Certificate Policies: Policy: X509v3 Any Policy CPS: https://www.digicert.com/CPS Signature Algorithm: sha256WithRSAEncryption Signature Value: ba:92:6d:0a:03:8b:13:6f:65:58:a4:40:66:fe:e2:f6:1c:bf: e9:65:7f:41:ec:bf:e1:6c:9e:0d:72:80:5e:ed:5e:7a:a0:29: ed:ed:a7:88:a3:cb:0c:8c:24:56:4c:25:99:0f:57:58:d3:ed: 8a:64:e0:b5:74:a8:fc:77:55:57:5c:0b:67:8f:2b:43:0e:e3: cf:7f:af:e2:a3:0d:26:61:04:ce:fc:60:20:fc:c2:f2:2f:a0: 83:9b:71:73:0c:1f:15:b6:c1:ff:69:e3:20:3f:aa:60:0f:55: d0:ab:3f:a1:68:39:df:9c:94:ca:06:ec:61:72:99:f1:dc:07: 5b:95:eb:9e:fd:09:cf:7f:58:47:61:af:0b:f9:1b:fc:3e:2e: 54:87:85:7d:17:01:ce:7e:98:5d:31:73:b1:8b:5e:0e:aa:6b: 22:4d:b7:39:70:eb:3d:fe:eb:a4:1f:e6:15:b2:e1:5d:59:39: da:e8:85:70:d6:a8:7e:b4:4b:72:1f:5e:91:be:68:bb:a6:4a: b2:65:85:0b:38:f3:08:13:b6:af:ae:58:d5:54:16:6e:8a:4c: 00:46:d6:3c:b4:25:55:e8:fa:7d:97:75:5e:6a:00:6a:6f:67: df:82:a3:49:b7:70:b4:4d:83:58:40:8f:81:5c:6d:51:d5:c0: 01:96:89:5d Certificate: Data: Version: 3 (0x2) Serial Number: 03:3a:f1:e6:a7:11:a9:a0:bb:28:64:b1:1d:09:fa:e5 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com>, CN=DigiCert Global Root G2 Validity Not Before: Aug 1 12:00:00 2013 GMT Not After : Jan 15 12:00:00 2038 GMT Subject: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com>, CN=DigiCert Global Root G2 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:bb:37:cd:34:dc:7b:6b:c9:b2:68:90:ad:4a:75: ff:46:ba:21:0a:08:8d:f5:19:54:c9:fb:88:db:f3: ae:f2:3a:89:91:3c:7a:e6:ab:06:1a:6b:cf:ac:2d: e8:5e:09:24:44:ba:62:9a:7e:d6:a3:a8:7e:e0:54: 75:20:05:ac:50:b7:9c:63:1a:6c:30:dc:da:1f:19: b1:d7:1e:de:fd:d7:e0:cb:94:83:37:ae:ec:1f:43: 4e:dd:7b:2c:d2:bd:2e:a5:2f:e4:a9:b8:ad:3a:d4: 99:a4:b6:25:e9:9b:6b:00:60:92:60:ff:4f:21:49: 18:f7:67:90:ab:61:06:9c:8f:f2:ba:e9:b4:e9:92: 32:6b:b5:f3:57:e8:5d:1b:cd:8c:1d:ab:95:04:95: 49:f3:35:2d:96:e3:49:6d:dd:77:e3:fb:49:4b:b4: ac:55:07:a9:8f:95:b3:b4:23:bb:4c:6d:45:f0:f6: a9:b2:95:30:b4:fd:4c:55:8c:27:4a:57:14:7c:82: 9d:cd:73:92:d3:16:4a:06:0c:8c:50:d1:8f:1e:09: be:17:a1:e6:21:ca:fd:83:e5:10:bc:83:a5:0a:c4: 67:28:f6:73:14:14:3d:46:76:c3:87:14:89:21:34: 4d:af:0f:45:0c:a6:49:a1:ba:bb:9c:c5:b1:33:83: 29:85 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Subject Key Identifier: 4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 Signature Algorithm: sha256WithRSAEncryption Signature Value: 60:67:28:94:6f:0e:48:63:eb:31:dd:ea:67:18:d5:89:7d:3c: c5:8b:4a:7f:e9:be:db:2b:17:df:b0:5f:73:77:2a:32:13:39: 81:67:42:84:23:f2:45:67:35:ec:88:bf:f8:8f:b0:61:0c:34: a4:ae:20:4c:84:c6:db:f8:35:e1:76:d9:df:a6:42:bb:c7:44: 08:86:7f:36:74:24:5a:da:6c:0d:14:59:35:bd:f2:49:dd:b6: 1f:c9:b3:0d:47:2a:3d:99:2f:bb:5c:bb:b5:d4:20:e1:99:5f: 53:46:15:db:68:9b:f0:f3:30:d5:3e:31:e2:8d:84:9e:e3:8a: da:da:96:3e:35:13:a5:5f:f0:f9:70:50:70:47:41:11:57:19: 4e:c0:8f:ae:06:c4:95:13:17:2f:1b:25:9f:75:f2:b1:8e:99: a1:6f:13:b1:41:71:fe:88:2a:c8:4f:10:20:55:d7:f3:14:45: e5:e0:44:f4:ea:87:95:32:93:0e:fe:53:46:fa:2c:9d:ff:8b: 22:b9:4b:d9:09:45:a4:de:a4:b8:9a:58:dd:1b:7d:52:9f:8e: 59:43:88:81:a4:9e:26:d5:6f:ad:dd:0d:c6:37:7d:ed:03:92: 1b:e5:77:5f:76:ee:3c:8d:c4:5d:56:5b:a2:d9:66:6e:b3:35: 37:e5:32:b6
So the certificate is there. I wonder if the check is not able to retriever serial #1 and mis-reporting that as a different issue.
[root@prod-us-freeipa /]# ldapsearch -LLL -x -D 'cn=directory manager' -W -b ou=certificateRepository,ou=ca,o=ipaca '(subjectName=CN=CA Audit,O=JSCRAMBLER.COM <http://JSCRAMBLER.COM>)' cn Enter LDAP Password: dn: cn=5,ou=certificateRepository,ou=ca,o=ipaca cn: 5 [root@prod-us-freeipa /]# certutil -L -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' | grep 'Serial Number' Serial Number: 5 (0x5)
So there is only one copy of the audit signing cert and the serial numbers match.
Nothing conclusive here for either issue unfortunately.
So why are you trying to use ipa-restore at all?
rob
-- /Kind Regards/ *Duarte Petiz* *DevOps Team Lead *| jscrambler.com <http://jscrambler.com/> * * * *
-- /Kind Regards/
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com http://jscrambler.com/
Because we had this installed in baremetal and we moved it to a different server. The old server was destroyed and we wanted to recover the data. It is normal to have disaster recovery procedures and we would like to have one for freeipa :/
On Mon, Sep 16, 2024 at 6:49 PM Rob Crittenden rcritten@redhat.com wrote:
Duarte Petiz wrote:
Hello, Everything fine? Did you had availability to check it? Regards
On Fri, Sep 6, 2024 at 9:58 AM Duarte Petiz <duarte.petiz@jscrambler.com mailto:duarte.petiz@jscrambler.com> wrote:
Hello Rob Thank you a lot for your help. Answers: openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt | openssl pkcs7 -print_certs -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: O=JSCRAMBLER.COM <http://JSCRAMBLER.COM>, CN=Certificate Authority Validity Not Before: Sep 4 09:46:01 2024 GMT Not After : Sep 4 09:46:01 2044 GMT Subject: O=JSCRAMBLER.COM <http://JSCRAMBLER.COM>, CN=Certificate Authority Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (3072 bit) Modulus: 00:a7:73:8a:1d:06:fa:c2:2e:ca:f2:c1:6b:ec:9a: e2:19:1b:20:8c:ab:8f:d5:51:b2:87:e1:32:a8:8c: fc:e3:a6:58:a2:91:51:4d:03:c8:05:c3:6a:a1:94: d1:77:ce:bf:6f:5b:c3:d9:c0:4f:da:29:a8:9a:bf: f2:a4:b2:fc:b4:8b:a2:5e:47:20:74:23:12:2d:8e: 67:d4:a3:17:0c:8f:e8:d4:de:75:62:cc:f3:5d:c1: 6a:ed:28:16:3c:57:a6:f1:8d:51:15:d9:a3:8a:90: 04:94:72:7c:3a:fa:dd:50:d3:fb:82:21:1f:84:d2: 3e:5e:75:c4:12:23:89:ae:34:c7:b8:fc:c0:c8:b7: 38:1f:e7:2f:71:21:96:4f:98:a3:6f:53:d5:a0:73: c4:9e:78:1b:59:d9:ec:6f:4f:d8:84:fa:b2:af:55: 7a:8a:93:12:a4:50:f6:cd:9d:7f:3c:39:23:4b:62: 0f:a6:31:30:61:d8:95:08:e9:3a:a7:6f:f7:91:29: f4:67:14:40:59:ff:98:1f:54:13:f0:f3:c1:76:f4: ff:1c:b9:18:e6:c1:3d:44:2a:8c:59:0d:9d:70:c0: 5a:eb:84:e7:ec:be:b2:b5:9d:42:cd:fc:4c:33:8b: 0d:65:01:7f:59:0f:fe:59:bc:2b:60:7d:36:0d:f3: b1:e6:91:e0:d6:c5:a0:ae:61:9d:bb:20:b6:42:5b: 99:5b:a7:28:e4:e7:4a:35:17:3d:22:67:61:e2:c0: 99:a5:bb:0f:b1:82:04:cf:55:ab:94:c7:54:d0:6d: 1a:0a:b2:3d:bc:b8:c2:bc:c8:7e:e2:59:eb:f8:4c: b3:3c:f7:c0:94:44:39:3f:6a:93:b2:36:e3:43:dc: 8f:16:5f:3a:dc:2c:0a:74:a0:8c:c6:b2:af:a5:f4: 2a:e1:36:38:bf:bf:29:98:13:a8:04:5e:79:f4:8e: 28:c7:01:d8:7b:51:84:10:d8:3b:7a:8b:b4:91:e6: 2c:a9:69:50:10:98:2a:54:8e:25 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Authority Key Identifier: 22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, Non Repudiation, Certificate Sign, CRL Sign X509v3 Subject Key Identifier: 22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 Authority Information Access: OCSP - URI:
http://ipa-ca.jscrambler.com/ca/ocsp
Signature Algorithm: sha256WithRSAEncryption Signature Value:
a4:14:11:b4:c5:ba:7b:3a:41:08:ea:69:92:41:e7:1b:71:2e:
45:30:f0:0d:92:c7:b0:a4:bc:83:4b:b5:ff:1d:78:ae:52:c7:
cd:f4:9c:f6:92:01:c8:f0:aa:8e:0a:9a:36:81:53:45:06:d3:
1a:2c:7a:27:6d:00:d0:08:47:d8:2f:0b:2b:67:14:1f:76:13:
62:2a:0c:b9:24:91:f4:55:50:7b:0b:a2:b8:d7:66:68:49:cf:
76:25:18:3e:4d:71:6a:10:1a:4e:33:c3:44:2d:75:6c:c8:73:
62:03:06:44:5d:1d:68:a1:a7:7f:91:9d:33:c0:7f:76:50:6f:
73:5b:6a:2c:91:3b:e8:9f:5a:d6:61:61:f6:44:85:45:8e:a1:
f0:8d:a8:07:4d:24:70:73:c7:91:54:e2:99:0b:cc:04:fd:b3:
1b:ed:f2:8a:fc:d2:cf:18:76:18:87:45:3e:f9:cf:58:f0:5b:
da:23:b1:51:b9:23:1a:f0:b2:be:3a:6e:c0:c6:13:17:ea:ca:
2d:a6:09:fa:17:04:a2:44:e6:35:9c:6a:d9:4e:e8:37:67:38:
00:69:35:9f:9c:57:2b:01:51:eb:f8:ce:ac:18:d7:87:93:a1:
e8:24:fd:fc:c3:9e:21:0a:9f:27:79:6a:00:0b:83:ca:dc:cd:
8e:b2:7c:95:99:ad:3c:4a:81:a1:d7:5f:e9:20:3e:75:ab:cb:
ab:46:c3:19:e2:55:9b:ea:5c:79:e1:80:36:84:03:a8:37:89:
2a:d8:45:b3:ba:7c:49:74:a4:ad:8f:09:90:35:32:c6:07:42:
65:28:7b:d8:ec:f6:40:88:38:74:1b:6f:79:f3:0a:67:4f:c0:
d3:37:3b:c9:8e:bb:9e:28:e0:0d:ac:49:a3:e9:97:bf:40:b3:
7d:4f:71:22:be:cb:b6:64:8b:41:12:f3:f0:76:c7:a1:18:17:
3d:fc:75:2b:cd:7f:84:09:31:78:4c:b2:c1:9a:ba:3a:f8:44:
02:81:75:9c:57:c2 Certificate: Data: Version: 3 (0x2) Serial Number: 09:0e:e8:c5:de:5b:fa:62:d2:ae:2f:f7:09:7c:48:57 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com>, CN=DigiCert Global Root G2 Validity Not Before: Nov 2 12:24:25 2017 GMT Not After : Nov 2 12:24:25 2027 GMT Subject: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com>, CN=Thawte TLS RSA CA G1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:c6:39:e0:98:f8:55:7a:d0:b4:6f:fa:33:6d:82: 5d:cc:e0:54:03:5b:0c:a2:0e:3b:d3:7d:1c:00:ff: 8f:db:70:0d:50:df:20:ad:71:02:2f:c3:61:0c:41: 78:17:54:7d:b4:bd:30:63:49:9c:cc:76:91:d1:ae: e5:61:a9:e5:c6:dc:16:a3:5b:36:b8:69:e7:c8:3b: 3a:98:e0:ac:eb:a7:b0:db:0d:d8:11:3a:fa:4d:bd: 78:c6:08:e9:bb:58:06:16:d0:1e:7b:06:a2:90:ef: 45:b9:df:21:c4:62:53:4b:09:fc:c5:e3:64:7c:a5: 56:a4:3d:8b:e2:f1:4d:df:a1:4d:83:17:a2:94:ae: 9a:13:8c:a4:80:60:33:36:5a:24:4e:9e:a1:34:e2: c0:62:90:f2:49:d2:c0:3c:ac:ee:25:24:3b:24:21: 19:e8:ef:92:0c:ac:b0:21:d5:cb:a0:c4:e7:a7:1b: 81:28:64:86:f3:c3:56:4e:8d:c2:1c:23:86:99:01: 02:89:ad:b2:a9:d3:c3:8e:02:ea:9c:48:98:36:3c: 10:2f:cb:8c:aa:3f:2b:3a:f9:4c:82:f8:81:70:70: 3b:c6:dc:be:ef:fb:98:2c:de:99:4b:b5:6a:d7:f1: 7f:95:58:55:39:fe:5e:8f:a8:d9:76:60:7c:e6:cc: c5:6d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: A5:8C:FE:32:CC:EB:0F:2C:D4:19:C6:08:B8:00:24:88:5D:C3:C5:B7 X509v3 Authority Key Identifier: 4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Authority Information Access: OCSP - URI:http://ocsp.digicert.com X509v3 CRL Distribution Points: Full Name: URI:http://crl3.digicert.com/DigiCertGlobalRootG2.crl X509v3 Certificate Policies: Policy: X509v3 Any Policy CPS: https://www.digicert.com/CPS Signature Algorithm: sha256WithRSAEncryption Signature Value:
ba:92:6d:0a:03:8b:13:6f:65:58:a4:40:66:fe:e2:f6:1c:bf:
e9:65:7f:41:ec:bf:e1:6c:9e:0d:72:80:5e:ed:5e:7a:a0:29:
ed:ed:a7:88:a3:cb:0c:8c:24:56:4c:25:99:0f:57:58:d3:ed:
8a:64:e0:b5:74:a8:fc:77:55:57:5c:0b:67:8f:2b:43:0e:e3:
cf:7f:af:e2:a3:0d:26:61:04:ce:fc:60:20:fc:c2:f2:2f:a0:
83:9b:71:73:0c:1f:15:b6:c1:ff:69:e3:20:3f:aa:60:0f:55:
d0:ab:3f:a1:68:39:df:9c:94:ca:06:ec:61:72:99:f1:dc:07:
5b:95:eb:9e:fd:09:cf:7f:58:47:61:af:0b:f9:1b:fc:3e:2e:
54:87:85:7d:17:01:ce:7e:98:5d:31:73:b1:8b:5e:0e:aa:6b:
22:4d:b7:39:70:eb:3d:fe:eb:a4:1f:e6:15:b2:e1:5d:59:39:
da:e8:85:70:d6:a8:7e:b4:4b:72:1f:5e:91:be:68:bb:a6:4a:
b2:65:85:0b:38:f3:08:13:b6:af:ae:58:d5:54:16:6e:8a:4c:
00:46:d6:3c:b4:25:55:e8:fa:7d:97:75:5e:6a:00:6a:6f:67:
df:82:a3:49:b7:70:b4:4d:83:58:40:8f:81:5c:6d:51:d5:c0:
01:96:89:5d Certificate: Data: Version: 3 (0x2) Serial Number: 03:3a:f1:e6:a7:11:a9:a0:bb:28:64:b1:1d:09:fa:e5 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com>, CN=DigiCert Global Root G2 Validity Not Before: Aug 1 12:00:00 2013 GMT Not After : Jan 15 12:00:00 2038 GMT Subject: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com>, CN=DigiCert Global Root G2 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:bb:37:cd:34:dc:7b:6b:c9:b2:68:90:ad:4a:75: ff:46:ba:21:0a:08:8d:f5:19:54:c9:fb:88:db:f3: ae:f2:3a:89:91:3c:7a:e6:ab:06:1a:6b:cf:ac:2d: e8:5e:09:24:44:ba:62:9a:7e:d6:a3:a8:7e:e0:54: 75:20:05:ac:50:b7:9c:63:1a:6c:30:dc:da:1f:19: b1:d7:1e:de:fd:d7:e0:cb:94:83:37:ae:ec:1f:43: 4e:dd:7b:2c:d2:bd:2e:a5:2f:e4:a9:b8:ad:3a:d4: 99:a4:b6:25:e9:9b:6b:00:60:92:60:ff:4f:21:49: 18:f7:67:90:ab:61:06:9c:8f:f2:ba:e9:b4:e9:92: 32:6b:b5:f3:57:e8:5d:1b:cd:8c:1d:ab:95:04:95: 49:f3:35:2d:96:e3:49:6d:dd:77:e3:fb:49:4b:b4: ac:55:07:a9:8f:95:b3:b4:23:bb:4c:6d:45:f0:f6: a9:b2:95:30:b4:fd:4c:55:8c:27:4a:57:14:7c:82: 9d:cd:73:92:d3:16:4a:06:0c:8c:50:d1:8f:1e:09: be:17:a1:e6:21:ca:fd:83:e5:10:bc:83:a5:0a:c4: 67:28:f6:73:14:14:3d:46:76:c3:87:14:89:21:34: 4d:af:0f:45:0c:a6:49:a1:ba:bb:9c:c5:b1:33:83: 29:85 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Digital Signature, Certificate Sign, CRL Sign X509v3 Subject Key Identifier: 4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 Signature Algorithm: sha256WithRSAEncryption Signature Value: 60:67:28:94:6f:0e:48:63:eb:31:dd:ea:67:18:d5:89:7d:3c: c5:8b:4a:7f:e9:be:db:2b:17:df:b0:5f:73:77:2a:32:13:39: 81:67:42:84:23:f2:45:67:35:ec:88:bf:f8:8f:b0:61:0c:34: a4:ae:20:4c:84:c6:db:f8:35:e1:76:d9:df:a6:42:bb:c7:44: 08:86:7f:36:74:24:5a:da:6c:0d:14:59:35:bd:f2:49:dd:b6: 1f:c9:b3:0d:47:2a:3d:99:2f:bb:5c:bb:b5:d4:20:e1:99:5f: 53:46:15:db:68:9b:f0:f3:30:d5:3e:31:e2:8d:84:9e:e3:8a: da:da:96:3e:35:13:a5:5f:f0:f9:70:50:70:47:41:11:57:19: 4e:c0:8f:ae:06:c4:95:13:17:2f:1b:25:9f:75:f2:b1:8e:99: a1:6f:13:b1:41:71:fe:88:2a:c8:4f:10:20:55:d7:f3:14:45: e5:e0:44:f4:ea:87:95:32:93:0e:fe:53:46:fa:2c:9d:ff:8b: 22:b9:4b:d9:09:45:a4:de:a4:b8:9a:58:dd:1b:7d:52:9f:8e: 59:43:88:81:a4:9e:26:d5:6f:ad:dd:0d:c6:37:7d:ed:03:92: 1b:e5:77:5f:76:ee:3c:8d:c4:5d:56:5b:a2:d9:66:6e:b3:35: 37:e5:32:b6
So the certificate is there. I wonder if the check is not able to retriever serial #1 and mis-reporting that as a different issue.
[root@prod-us-freeipa /]# ldapsearch -LLL -x -D 'cn=directory manager' -W -b ou=certificateRepository,ou=ca,o=ipaca '(subjectName=CN=CA Audit,O=JSCRAMBLER.COM <http://JSCRAMBLER.COM>)'
cn
Enter LDAP Password: dn: cn=5,ou=certificateRepository,ou=ca,o=ipaca cn: 5 [root@prod-us-freeipa /]# certutil -L -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' | grep 'Serial Number' Serial Number: 5 (0x5)
So there is only one copy of the audit signing cert and the serial numbers match.
Nothing conclusive here for either issue unfortunately.
So why are you trying to use ipa-restore at all?
rob
-- /Kind Regards/ *Duarte Petiz* *DevOps Team Lead *| jscrambler.com <http://jscrambler.com/> * * * *
-- /Kind Regards/
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com http://jscrambler.com/
It is difficult to troubleshoot issues remotely without understanding some of the history and motivations.
This includes things like "why are the DigiCert CA's present?" Are they currently in use? Previously? These aren't likely a root cause but it provides a fuller picture.
Was the old server working properly when it was "destroyed?"
So far the details have been pretty thin.
I'm not sure we've seen the state of the certs since you've done a full restore, other than the healthcheck output.
rob
Duarte Petiz wrote:
Because we had this installed in baremetal and we moved it to a different server. The old server was destroyed and we wanted to recover the data. It is normal to have disaster recovery procedures and we would like to have one for freeipa :/
On Mon, Sep 16, 2024 at 6:49 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Duarte Petiz wrote: > Hello, > Everything fine? > Did you had availability to check it? > Regards > > On Fri, Sep 6, 2024 at 9:58 AM Duarte Petiz <duarte.petiz@jscrambler.com <mailto:duarte.petiz@jscrambler.com> > <mailto:duarte.petiz@jscrambler.com <mailto:duarte.petiz@jscrambler.com>>> wrote: > > Hello Rob > Thank you a lot for your help. > > Answers: > openssl crl2pkcs7 -nocrl -certfile /etc/ipa/ca.crt | openssl pkcs7 > -print_certs -text -noout > > Certificate: > > Data: > Version: 3 (0x2) > Serial Number: 1 (0x1) > Signature Algorithm: sha256WithRSAEncryption > Issuer: O=JSCRAMBLER.COM <http://JSCRAMBLER.COM> <http://JSCRAMBLER.COM>, > CN=Certificate Authority > Validity > Not Before: Sep 4 09:46:01 2024 GMT > Not After : Sep 4 09:46:01 2044 GMT > Subject: O=JSCRAMBLER.COM <http://JSCRAMBLER.COM> <http://JSCRAMBLER.COM>, > CN=Certificate Authority > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > Public-Key: (3072 bit) > Modulus: > > 00:a7:73:8a:1d:06:fa:c2:2e:ca:f2:c1:6b:ec:9a: > > e2:19:1b:20:8c:ab:8f:d5:51:b2:87:e1:32:a8:8c: > > fc:e3:a6:58:a2:91:51:4d:03:c8:05:c3:6a:a1:94: > > d1:77:ce:bf:6f:5b:c3:d9:c0:4f:da:29:a8:9a:bf: > > f2:a4:b2:fc:b4:8b:a2:5e:47:20:74:23:12:2d:8e: > > 67:d4:a3:17:0c:8f:e8:d4:de:75:62:cc:f3:5d:c1: > > 6a:ed:28:16:3c:57:a6:f1:8d:51:15:d9:a3:8a:90: > > 04:94:72:7c:3a:fa:dd:50:d3:fb:82:21:1f:84:d2: > > 3e:5e:75:c4:12:23:89:ae:34:c7:b8:fc:c0:c8:b7: > > 38:1f:e7:2f:71:21:96:4f:98:a3:6f:53:d5:a0:73: > > c4:9e:78:1b:59:d9:ec:6f:4f:d8:84:fa:b2:af:55: > > 7a:8a:93:12:a4:50:f6:cd:9d:7f:3c:39:23:4b:62: > > 0f:a6:31:30:61:d8:95:08:e9:3a:a7:6f:f7:91:29: > > f4:67:14:40:59:ff:98:1f:54:13:f0:f3:c1:76:f4: > > ff:1c:b9:18:e6:c1:3d:44:2a:8c:59:0d:9d:70:c0: > > 5a:eb:84:e7:ec:be:b2:b5:9d:42:cd:fc:4c:33:8b: > > 0d:65:01:7f:59:0f:fe:59:bc:2b:60:7d:36:0d:f3: > > b1:e6:91:e0:d6:c5:a0:ae:61:9d:bb:20:b6:42:5b: > > 99:5b:a7:28:e4:e7:4a:35:17:3d:22:67:61:e2:c0: > > 99:a5:bb:0f:b1:82:04:cf:55:ab:94:c7:54:d0:6d: > > 1a:0a:b2:3d:bc:b8:c2:bc:c8:7e:e2:59:eb:f8:4c: > > b3:3c:f7:c0:94:44:39:3f:6a:93:b2:36:e3:43:dc: > > 8f:16:5f:3a:dc:2c:0a:74:a0:8c:c6:b2:af:a5:f4: > > 2a:e1:36:38:bf:bf:29:98:13:a8:04:5e:79:f4:8e: > > 28:c7:01:d8:7b:51:84:10:d8:3b:7a:8b:b4:91:e6: > 2c:a9:69:50:10:98:2a:54:8e:25 > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Authority Key Identifier: > > 22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 > X509v3 Basic Constraints: critical > CA:TRUE > X509v3 Key Usage: critical > Digital Signature, Non Repudiation, > Certificate Sign, CRL Sign > X509v3 Subject Key Identifier: > > 22:35:09:8D:75:D8:D9:07:9E:C7:A3:21:D3:49:2A:53:79:94:CF:74 > Authority Information Access: > OCSP - URI:http://ipa-ca.jscrambler.com/ca/ocsp > Signature Algorithm: sha256WithRSAEncryption > Signature Value: > a4:14:11:b4:c5:ba:7b:3a:41:08:ea:69:92:41:e7:1b:71:2e: > 45:30:f0:0d:92:c7:b0:a4:bc:83:4b:b5:ff:1d:78:ae:52:c7: > cd:f4:9c:f6:92:01:c8:f0:aa:8e:0a:9a:36:81:53:45:06:d3: > 1a:2c:7a:27:6d:00:d0:08:47:d8:2f:0b:2b:67:14:1f:76:13: > 62:2a:0c:b9:24:91:f4:55:50:7b:0b:a2:b8:d7:66:68:49:cf: > 76:25:18:3e:4d:71:6a:10:1a:4e:33:c3:44:2d:75:6c:c8:73: > 62:03:06:44:5d:1d:68:a1:a7:7f:91:9d:33:c0:7f:76:50:6f: > 73:5b:6a:2c:91:3b:e8:9f:5a:d6:61:61:f6:44:85:45:8e:a1: > f0:8d:a8:07:4d:24:70:73:c7:91:54:e2:99:0b:cc:04:fd:b3: > 1b:ed:f2:8a:fc:d2:cf:18:76:18:87:45:3e:f9:cf:58:f0:5b: > da:23:b1:51:b9:23:1a:f0:b2:be:3a:6e:c0:c6:13:17:ea:ca: > 2d:a6:09:fa:17:04:a2:44:e6:35:9c:6a:d9:4e:e8:37:67:38: > 00:69:35:9f:9c:57:2b:01:51:eb:f8:ce:ac:18:d7:87:93:a1: > e8:24:fd:fc:c3:9e:21:0a:9f:27:79:6a:00:0b:83:ca:dc:cd: > 8e:b2:7c:95:99:ad:3c:4a:81:a1:d7:5f:e9:20:3e:75:ab:cb: > ab:46:c3:19:e2:55:9b:ea:5c:79:e1:80:36:84:03:a8:37:89: > 2a:d8:45:b3:ba:7c:49:74:a4:ad:8f:09:90:35:32:c6:07:42: > 65:28:7b:d8:ec:f6:40:88:38:74:1b:6f:79:f3:0a:67:4f:c0: > d3:37:3b:c9:8e:bb:9e:28:e0:0d:ac:49:a3:e9:97:bf:40:b3: > 7d:4f:71:22:be:cb:b6:64:8b:41:12:f3:f0:76:c7:a1:18:17: > 3d:fc:75:2b:cd:7f:84:09:31:78:4c:b2:c1:9a:ba:3a:f8:44: > 02:81:75:9c:57:c2 > Certificate: > Data: > Version: 3 (0x2) > Serial Number: > 09:0e:e8:c5:de:5b:fa:62:d2:ae:2f:f7:09:7c:48:57 > Signature Algorithm: sha256WithRSAEncryption > Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com> > <http://www.digicert.com>, CN=DigiCert Global Root G2 > Validity > Not Before: Nov 2 12:24:25 2017 GMT > Not After : Nov 2 12:24:25 2027 GMT > Subject: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com> > <http://www.digicert.com>, CN=Thawte TLS RSA CA G1 > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > Public-Key: (2048 bit) > Modulus: > > 00:c6:39:e0:98:f8:55:7a:d0:b4:6f:fa:33:6d:82: > > 5d:cc:e0:54:03:5b:0c:a2:0e:3b:d3:7d:1c:00:ff: > > 8f:db:70:0d:50:df:20:ad:71:02:2f:c3:61:0c:41: > > 78:17:54:7d:b4:bd:30:63:49:9c:cc:76:91:d1:ae: > > e5:61:a9:e5:c6:dc:16:a3:5b:36:b8:69:e7:c8:3b: > > 3a:98:e0:ac:eb:a7:b0:db:0d:d8:11:3a:fa:4d:bd: > > 78:c6:08:e9:bb:58:06:16:d0:1e:7b:06:a2:90:ef: > > 45:b9:df:21:c4:62:53:4b:09:fc:c5:e3:64:7c:a5: > > 56:a4:3d:8b:e2:f1:4d:df:a1:4d:83:17:a2:94:ae: > > 9a:13:8c:a4:80:60:33:36:5a:24:4e:9e:a1:34:e2: > > c0:62:90:f2:49:d2:c0:3c:ac:ee:25:24:3b:24:21: > > 19:e8:ef:92:0c:ac:b0:21:d5:cb:a0:c4:e7:a7:1b: > > 81:28:64:86:f3:c3:56:4e:8d:c2:1c:23:86:99:01: > > 02:89:ad:b2:a9:d3:c3:8e:02:ea:9c:48:98:36:3c: > > 10:2f:cb:8c:aa:3f:2b:3a:f9:4c:82:f8:81:70:70: > > 3b:c6:dc:be:ef:fb:98:2c:de:99:4b:b5:6a:d7:f1: > > 7f:95:58:55:39:fe:5e:8f:a8:d9:76:60:7c:e6:cc: > c5:6d > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Subject Key Identifier: > > A5:8C:FE:32:CC:EB:0F:2C:D4:19:C6:08:B8:00:24:88:5D:C3:C5:B7 > X509v3 Authority Key Identifier: > > 4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 > X509v3 Key Usage: critical > Digital Signature, Certificate Sign, CRL Sign > X509v3 Extended Key Usage: > TLS Web Server Authentication, TLS Web > Client Authentication > X509v3 Basic Constraints: critical > CA:TRUE, pathlen:0 > Authority Information Access: > OCSP - URI:http://ocsp.digicert.com > X509v3 CRL Distribution Points: > Full Name: > > URI:http://crl3.digicert.com/DigiCertGlobalRootG2.crl > X509v3 Certificate Policies: > Policy: X509v3 Any Policy > CPS: https://www.digicert.com/CPS > Signature Algorithm: sha256WithRSAEncryption > Signature Value: > ba:92:6d:0a:03:8b:13:6f:65:58:a4:40:66:fe:e2:f6:1c:bf: > e9:65:7f:41:ec:bf:e1:6c:9e:0d:72:80:5e:ed:5e:7a:a0:29: > ed:ed:a7:88:a3:cb:0c:8c:24:56:4c:25:99:0f:57:58:d3:ed: > 8a:64:e0:b5:74:a8:fc:77:55:57:5c:0b:67:8f:2b:43:0e:e3: > cf:7f:af:e2:a3:0d:26:61:04:ce:fc:60:20:fc:c2:f2:2f:a0: > 83:9b:71:73:0c:1f:15:b6:c1:ff:69:e3:20:3f:aa:60:0f:55: > d0:ab:3f:a1:68:39:df:9c:94:ca:06:ec:61:72:99:f1:dc:07: > 5b:95:eb:9e:fd:09:cf:7f:58:47:61:af:0b:f9:1b:fc:3e:2e: > 54:87:85:7d:17:01:ce:7e:98:5d:31:73:b1:8b:5e:0e:aa:6b: > 22:4d:b7:39:70:eb:3d:fe:eb:a4:1f:e6:15:b2:e1:5d:59:39: > da:e8:85:70:d6:a8:7e:b4:4b:72:1f:5e:91:be:68:bb:a6:4a: > b2:65:85:0b:38:f3:08:13:b6:af:ae:58:d5:54:16:6e:8a:4c: > 00:46:d6:3c:b4:25:55:e8:fa:7d:97:75:5e:6a:00:6a:6f:67: > df:82:a3:49:b7:70:b4:4d:83:58:40:8f:81:5c:6d:51:d5:c0: > 01:96:89:5d > > Certificate: > Data: > Version: 3 (0x2) > Serial Number: > 03:3a:f1:e6:a7:11:a9:a0:bb:28:64:b1:1d:09:fa:e5 > Signature Algorithm: sha256WithRSAEncryption > Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com> > <http://www.digicert.com>, CN=DigiCert Global Root G2 > Validity > Not Before: Aug 1 12:00:00 2013 GMT > Not After : Jan 15 12:00:00 2038 GMT > Subject: C=US, O=DigiCert Inc, OU=www.digicert.com <http://www.digicert.com> > <http://www.digicert.com>, CN=DigiCert Global Root G2 > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > Public-Key: (2048 bit) > Modulus: > 00:bb:37:cd:34:dc:7b:6b:c9:b2:68:90:ad:4a:75: > ff:46:ba:21:0a:08:8d:f5:19:54:c9:fb:88:db:f3: > ae:f2:3a:89:91:3c:7a:e6:ab:06:1a:6b:cf:ac:2d: > e8:5e:09:24:44:ba:62:9a:7e:d6:a3:a8:7e:e0:54: > 75:20:05:ac:50:b7:9c:63:1a:6c:30:dc:da:1f:19: > b1:d7:1e:de:fd:d7:e0:cb:94:83:37:ae:ec:1f:43: > 4e:dd:7b:2c:d2:bd:2e:a5:2f:e4:a9:b8:ad:3a:d4: > 99:a4:b6:25:e9:9b:6b:00:60:92:60:ff:4f:21:49: > 18:f7:67:90:ab:61:06:9c:8f:f2:ba:e9:b4:e9:92: > 32:6b:b5:f3:57:e8:5d:1b:cd:8c:1d:ab:95:04:95: > 49:f3:35:2d:96:e3:49:6d:dd:77:e3:fb:49:4b:b4: > ac:55:07:a9:8f:95:b3:b4:23:bb:4c:6d:45:f0:f6: > a9:b2:95:30:b4:fd:4c:55:8c:27:4a:57:14:7c:82: > 9d:cd:73:92:d3:16:4a:06:0c:8c:50:d1:8f:1e:09: > be:17:a1:e6:21:ca:fd:83:e5:10:bc:83:a5:0a:c4: > 67:28:f6:73:14:14:3d:46:76:c3:87:14:89:21:34: > 4d:af:0f:45:0c:a6:49:a1:ba:bb:9c:c5:b1:33:83: > 29:85 > Exponent: 65537 (0x10001) > X509v3 extensions: > X509v3 Basic Constraints: critical > CA:TRUE > X509v3 Key Usage: critical > Digital Signature, Certificate Sign, CRL Sign > X509v3 Subject Key Identifier: > > 4E:22:54:20:18:95:E6:E3:6E:E6:0F:FA:FA:B9:12:ED:06:17:8F:39 > Signature Algorithm: sha256WithRSAEncryption > Signature Value: > 60:67:28:94:6f:0e:48:63:eb:31:dd:ea:67:18:d5:89:7d:3c: > c5:8b:4a:7f:e9:be:db:2b:17:df:b0:5f:73:77:2a:32:13:39: > 81:67:42:84:23:f2:45:67:35:ec:88:bf:f8:8f:b0:61:0c:34: > a4:ae:20:4c:84:c6:db:f8:35:e1:76:d9:df:a6:42:bb:c7:44: > 08:86:7f:36:74:24:5a:da:6c:0d:14:59:35:bd:f2:49:dd:b6: > 1f:c9:b3:0d:47:2a:3d:99:2f:bb:5c:bb:b5:d4:20:e1:99:5f: > 53:46:15:db:68:9b:f0:f3:30:d5:3e:31:e2:8d:84:9e:e3:8a: > da:da:96:3e:35:13:a5:5f:f0:f9:70:50:70:47:41:11:57:19: > 4e:c0:8f:ae:06:c4:95:13:17:2f:1b:25:9f:75:f2:b1:8e:99: > a1:6f:13:b1:41:71:fe:88:2a:c8:4f:10:20:55:d7:f3:14:45: > e5:e0:44:f4:ea:87:95:32:93:0e:fe:53:46:fa:2c:9d:ff:8b: > 22:b9:4b:d9:09:45:a4:de:a4:b8:9a:58:dd:1b:7d:52:9f:8e: > 59:43:88:81:a4:9e:26:d5:6f:ad:dd:0d:c6:37:7d:ed:03:92: > 1b:e5:77:5f:76:ee:3c:8d:c4:5d:56:5b:a2:d9:66:6e:b3:35: > 37:e5:32:b6 So the certificate is there. I wonder if the check is not able to retriever serial #1 and mis-reporting that as a different issue. > > [root@prod-us-freeipa /]# ldapsearch -LLL -x -D 'cn=directory > manager' -W -b ou=certificateRepository,ou=ca,o=ipaca > '(subjectName=CN=CA Audit,O=JSCRAMBLER.COM <http://JSCRAMBLER.COM> <http://JSCRAMBLER.COM>)' cn > Enter LDAP Password: > dn: cn=5,ou=certificateRepository,ou=ca,o=ipaca > cn: 5 > > > [root@prod-us-freeipa /]# certutil -L -d /etc/pki/pki-tomcat/alias > -n 'auditSigningCert cert-pki-ca' | grep 'Serial Number' > Serial Number: 5 (0x5) So there is only one copy of the audit signing cert and the serial numbers match. Nothing conclusive here for either issue unfortunately. So why are you trying to use ipa-restore at all? rob > > > -- > /Kind Regards/ > > *Duarte Petiz* > *DevOps Team Lead *| jscrambler.com <http://jscrambler.com> <http://jscrambler.com/> > * > * > * > * > > > > -- > /Kind Regards/ > > *Duarte Petiz* > *DevOps Team Lead *| jscrambler.com <http://jscrambler.com> <http://jscrambler.com/> > * > * > * > * >
-- /Kind Regards/
*Duarte Petiz* *DevOps Team Lead *| jscrambler.com http://jscrambler.com/
freeipa-users@lists.fedorahosted.org