Hello, I am trying to find the correct way to get the FreeIPA SSL certificate in pem format.
So far I have the following commands:
kinit $USER_WITH_ADMIN_PRIVS ipa ca-show ipa ca-show --certificate-out=/etc/pki/tls/private/server.key
I don't think this is right. I need this to get the private key for FreeIPA for setting up Duo 2FA.
Thanks!
Andrew Meyer via FreeIPA-users wrote:
Hello, I am trying to find the correct way to get the FreeIPA SSL certificate in pem format.
So far I have the following commands:
kinit $USER_WITH_ADMIN_PRIVS ipa ca-show ipa ca-show --certificate-out=/etc/pki/tls/private/server.key
I don't think this is right. I need this to get the private key for FreeIPA for setting up Duo 2FA.
You can't retrieve private keys over the IPA API and that's a good thing.
I assume you're following some instructions? Can you share them? It's hard to write generic instructions and I doubt that what they are telling you is right for IPA (and for many CA's).
rob
This is what I have been following: https://github.com/gudmmk/howtos/blob/master/duo_authproxy-with-freeipa.md https://duo.com/docs/authproxy-reference https://help.duo.com/s/article/2209?language=en_US https://community.duo.com/t/directory-sync-with-idm/2171/19
Here is the error output. [error] The Auth Proxy was not able to create an SSL context with the given certificate and private key. It will be unable to use these credentials to create and maintain SSL-based connections such as LDAPS. [error] The Auth Proxy was not able to validate the SSL private key at /opt/duoauthproxy/conf/duoauth-starttls.key. Ensure that it is a readable, valid SSL key file using a tool like 'openssl rsa'. [debug] Exception: [('PEM routines', 'PEM_read_bio', 'no start line')] [info] The Auth Proxy was able to validate the SSL certificate data at /etc/ipa/ca.crt. [warn] The Auth Proxy did not run the SSL context creation check because of the problem(s) with the SSL key and cert check. Resolve that issue and rerun the tester. [warn] The Auth Proxy did not run the listen check because of the problem(s) with the ssl configuration check. Resolve that issue and rerun the tester. [info] ----------------------------- [info] SUMMARY
Thanks for your help!
Andrew Meyer via FreeIPA-users wrote:
This is what I have been following: https://github.com/gudmmk/howtos/blob/master/duo_authproxy-with-freeipa.md https://duo.com/docs/authproxy-reference https://help.duo.com/s/article/2209?language=en_US https://community.duo.com/t/directory-sync-with-idm/2171/19
Here is the error output. [error] The Auth Proxy was not able to create an SSL context with the given certificate and private key. It will be unable to use these credentials to create and maintain SSL-based connections such as LDAPS. [error] The Auth Proxy was not able to validate the SSL private key at /opt/duoauthproxy/conf/duoauth-starttls.key. Ensure that it is a readable, valid SSL key file using a tool like 'openssl rsa'. [debug] Exception: [('PEM routines', 'PEM_read_bio', 'no start line')] [info] The Auth Proxy was able to validate the SSL certificate data at /etc/ipa/ca.crt. [warn] The Auth Proxy did not run the SSL context creation check because of the problem(s) with the SSL key and cert check. Resolve that issue and rerun the tester. [warn] The Auth Proxy did not run the listen check because of the problem(s) with the ssl configuration check. Resolve that issue and rerun the tester. [info] ----------------------------- [info] SUMMARY
Thanks for your help!
You need a server certificate for the duo auth proxy service. I'm not in the office right now but you can refer to the IdM documentation on docs.redhat.com to see how to generate a server certificate for this service.
rob
freeipa-users@lists.fedorahosted.org
-
Andrew Meyer -
Rob Crittenden