On Tue, Jan 09, 2018 at 10:40:32AM +0100, Giulio Casella via FreeIPA-users wrote:
Hi Fraser,
Il 09/01/2018 07:44, Fraser Tweedale via FreeIPA-users ha scritto:
> On Mon, Jan 08, 2018 at 10:15:29PM +0100, Giulio Casella via FreeIPA-users wrote:
> > After some time, requests go "CA_UNREACHABLE", caused by "RPC
failed at
> > server. Request failed with status 500: Non-2xx response from CA REST API:
> > 500." when certmonger tries to renew httpd/dirsrv certificate.
> >
> > Any ideas to correctly debug this issue?
> >
> Here are some things to check:
>
> What is the validity of /var/lib/ipa/ra-agent.pem at the time you
> set the clock back to? Is it possible that you have gone earlier
> than its `notBefore' time?
I've set date between "Not Before" and "Not After" of
/var/lib/ipa/ra-agent.pem
>
> Is that certificate in sync with the userCertificate attribute of
> the `uid=ipara,ou=people,o=ipaca' LDAP entry?
I don't have that entry in ldap; I tried to find in ldap a
"userCertificate"
with subject " O=MY.DOM.AIN, CN=IPA RA" (the same of
/var/lib/ipa/ra-agent.pem).
Its distinguished name is
"dn: cn=ipaCert,cn=ca_renewal,cn=ipa,cn=etc,dc=my,dc=dom,dc=ain"
and is indeed different from cert /var/lib/ipa/ra-agent.pem (the one in ldap
is newer).
You are looking for an entry in the Dogtag CA DIT (base DN `o=ipaca'),
not the FreeIPA DIT. You should check on a CA replica.
Do you think I can try to substitute the entry in ldap with the cert
from
/var/lib/ipa/ra-agent.pem?
We really need to check what the userCertificate attribute of
`uid=ipara,ou=people,o=ipaca' is, and whether it matches
ra-agent.pem (and if not, how it differs). The entry should
certainly exist in the Dogtag DIT, on CA replicas.
Knowing that will help decide the way forward.
>
> What does the /var/log/pki/pki-tomcat/ca/debug log contain?
After a few digging I've seen nothing relevant...
OK. If it is an authentication error you won't necessary see a lot
- from Dogtag's point of view is is not actually an error. It would
get logged but not prominenty.
> >
> > Cheers,
> > Fraser
> >
> >
> > >
> > >
> > > Il 08/01/2018 17:56, Giulio Casella via FreeIPA-users ha scritto:
> > > >
> > > >
> > > > Il 08/01/2018 17:26, Rob Crittenden ha scritto:
> > > > > Giulio Casella via FreeIPA-users wrote:
> > > > >
> > > > > You need to stop ntpd, use date to go back when the web server
cert is
> > > > > still valid, then restart certmonger. That generally will do it.
> > > >
> > > > Hi Rob,
> > > > I already tried with date few hours before expiration, with no luck:
> > > > certmonger cannot perform cert update.
> > > >
> > > > Queued requests remain in "SUBMITTING" status, I tried to
launch
> > > > certmonger in foreground (-d 10), here's a snippet of the output:
> > > >
> > > > 2018-01-08 01:17:08 [6000] Request9('20171205091409') ends in
state
> > > > 'HAVE_CSR'
> > > > 2018-01-08 01:17:08 [6000] Stopped
Request9('20171205091409').
> > > > 2018-01-08 01:17:09 [6235] Read value "0" from
> > > > "/proc/sys/crypto/fips_enabled".
> > > > 2018-01-08 01:17:09 [6235] Not attempting to set NSS FIPS mode.
> > > > 2018-01-08 01:17:09 [6235] Skipping NSS internal slot (NSS Generic
> > > > Crypto Services).
> > > > 2018-01-08 01:17:09 [6235] Found token 'NSS Certificate DB'.
> > > > 2018-01-08 01:17:09 [6235] Located a certificate with the key's
nickname
> > > > ("Server-Cert").
> > > > 2018-01-08 01:17:09 [6235] Located its private key.
> > > > 2018-01-08 01:17:09 [6235] Recovered public key from private key.
> > > > 2018-01-08 01:17:09 [6235] Key is an RSA key.
> > > > 2018-01-08 01:17:09 [6235] Key size is 2048.
> > > > 2018-01-08 01:17:10 [6251] Read value "0" from
> > > > "/proc/sys/crypto/fips_enabled".
> > > > 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
> > > > 2018-01-08 01:17:10 [6251] Found token 'NSS Generic Crypto
Services'.
> > > > 2018-01-08 01:17:10 [6251] Token is named "NSS Generic Crypto
Services",
> > > > not "NSS Certificate DB", skipping.
> > > > 2018-01-08 01:17:10 [6251] Found token 'NSS Certificate DB'.
> > > > 2018-01-08 01:17:10 [6251] Located the certificate
"Server-Cert".
> > > > 2018-01-08 01:17:10 [6251] Read value "0" from
> > > > "/proc/sys/crypto/fips_enabled".
> > > > 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
> > > > 2018-01-08 01:17:10 [6000] Request9('20171205091409') starts
in state
> > > > 'HAVE_KEYINFO'
> > > > 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to
state
> > > > 'NEED_CSR'
> > > > 2018-01-08 01:17:10 [6000] Will revisit
Request9('20171205091409') now.
> > > > 2018-01-08 01:17:10 [6000] Started
Request9('20171205091409').
> > > > 2018-01-08 01:17:10 [6000] Queuing FD 7 for Read for
> > > > 0x561b59c82750:0x561b59c98940.
> > > > 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to
state
> > > > 'GENERATING_CSR'
> > > > 2018-01-08 01:17:10 [6000] Will revisit
Request9('20171205091409') on
> > > > traffic from 27.
> > > > 2018-01-08 01:17:11 [6263] Read value "0" from
> > > > "/proc/sys/crypto/fips_enabled".
> > > > 2018-01-08 01:17:11 [6263] Not attempting to set NSS FIPS mode.
> > > > 2018-01-08 01:17:11 [6263] Skipping NSS internal slot (NSS Generic
> > > > Crypto Services).
> > > > 2018-01-08 01:17:11 [6263] Found token 'NSS Certificate DB'.
> > > > 2018-01-08 01:17:11 [6263] Located a certificate with the key's
nickname
> > > > ("Server-Cert").
> > > > 2018-01-08 01:17:11 [6263] Located its private key.
> > > > 2018-01-08 01:17:11 [6263] Recovered public key from private key.
> > > > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to
state
> > > > 'HAVE_CSR'
> > > > 2018-01-08 01:17:11 [6000] Will revisit
Request9('20171205091409') now.
> > > > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to
state
> > > > 'NEED_TO_SUBMIT'
> > > > 2018-01-08 01:17:11 [6000] Will revisit
Request9('20171205091409') now.
> > > > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to
state
> > > > 'SUBMITTING'
> > > > 2018-01-08 01:17:11 [6000] Will revisit
Request9('20171205091409') on
> > > > traffic from 31.
> > > > ^C2018-01-08 01:17:14 [6000] Got signal 2.
> > > > 2018-01-08 01:17:14 [6000] Shutting down.
> > > >
> > > > I'm stuck...
> > > >
> > > > Thank you for your time.
> > > >
> > > > >
> > > > > rob
> > > > >
> > > > > >
> > > > > > Is there a way to force update?
> > > > > >
> > > > > > Here's my output of "getcert list":
> > > > > >
> > > > > >
> > > > > > Number of certificates and requests being tracked: 9.
> > > > > > Request ID '20170915095009':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > > type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
> > > > > > certificate:
type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
> > > > > > CA: SelfSign
> > > > > > issuer:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2018-09-15 09:50:10 UTC
> > > > > > principal name:
> > > > > >
krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > certificate template/profile: KDCs_PKINIT_Certs
> > > > > > pre-save command:
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_kdc_cert
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091347':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> > > > > >
> > > > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> > > > > >
> > > > > > cert-pki-ca',token='NSS Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=CA
Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-21 07:19:44 UTC
> > > > > > key usage: digitalSignature,nonRepudiation
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "auditSigningCert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091349':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> > > > > > cert-pki-ca',token='NSS
> > > > > > Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> > > > > > cert-pki-ca',token='NSS
> > > > > > Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=OCSP
Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-21 07:18:07 UTC
> > > > > > eku: id-kp-OCSPSigning
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "ocspSigningCert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091350':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> > > > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> > > > > > cert-pki-ca',token='NSS Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=CA
Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-21 07:19:43 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "subsystemCert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091351':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> > > > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> > > > > > cert-pki-ca',token='NSS Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=Certificate
> > > > > > Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2038-01-08 00:16:58 UTC
> > > > > > key usage:
digitalSignature,nonRepudiation,keyCertSign,cRLSign
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "caSigningCert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091352':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > > type=FILE,location='/var/lib/ipa/ra-agent.key'
> > > > > > certificate:
type=FILE,location='/var/lib/ipa/ra-agent.pem'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-21 07:18:14 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/renew_ra_cert_pre
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ra_cert
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091353':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> > > > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> > > > > > cert-pki-ca',token='NSS Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-20 10:02:31 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "Server-Cert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091357':
> > > > > > status: CA_UNREACHABLE
> > > > > > ca-error: Server at
> > > > > >
https://idc01.linux.unicloudidattica.local/ipa/xml failed
request, will
> > > > > > retry: -504 (libcurl failed to execute the HTTP POST
transaction,
> > > > > > explaining: Peer's Certificate has expired.).
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
> > > > > >
> > > > > > Certificate
> > > > > >
DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
> > > > > >
> > > > > > Certificate DB'
> > > > > > CA: IPA
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2018-01-08 08:24:22 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/restart_dirsrv
> > > > > > LINUX-UNICLOUDIDATTICA-LOCAL
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091409':
> > > > > > status: CA_UNREACHABLE
> > > > > > ca-error: Server at
> > > > > >
https://idc01.linux.unicloudidattica.local/ipa/xml failed
request, will
> > > > > > retry: -504 (libcurl failed to execute the HTTP POST
transaction,
> > > > > > explaining: Peer's Certificate has expired.).
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
> > > > > > Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
> > > > > > Certificate DB'
> > > > > > CA: IPA
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2018-01-08 08:33:05 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/restart_httpd
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > >
> > > > > >
> > > > > > Thanks in advance,
> > > > > > Giulio
> > > > > > _______________________________________________
> > > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
> > > > > > To unsubscribe send an email to
> > > > > > freeipa-users-leave(a)lists.fedorahosted.org
> > > > >
> > > >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> >
>
> --
> Giulio Casella giulio at di.unimi.it
> System and network architect
> Computer Science Dept. - University of Milano
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org