Thx flo,
Indeed you are right, I didn't have an ipaCert certificate store in my
NSS databases.
certutil: Could not find cert: ipaCert
so I used your ldapsearch command to retrieve the certificate and was
able to import it into the various NSS databases with certutil.
I don't know why the ipaCert certificate is no longer there. I think (
i'm not sur), i lost it when I installed 3rd part certificates with the
ipa-server-certinstall command.
My problem is now solved, thank you very much.
Pierre
Le 04/02/2019 à 16:42, Florence Blanc-Renaud a écrit :
On 2/4/19 12:16 PM, Pierre Labanowski via FreeIPA-users wrote:
> Hello,
>
> I have some issues with certificate management.
>
> 2 important points of the recent information:
>
> - after a longstanding loss of the certification authority. The
> certification authority was deleted and a new one was created.
>
https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-l...
>
<
https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-l...
> ( very big thx )
>
> - For http and ldap, i use 3rd part certificates (
> /ipa-server-certinstall /)
>
>
> So far, I've noticed 2 problems :
>
> 1°) ipa-server-upgrade : failed
>
> Impossible to upgrade the server.
> i have a 401 error return when the upgrade script wants to access the
> url:
>
>> GET request
https://freeipa4.exemple.fr:8443/ca/rest/account/login
>> ...
>> response status 401
>
> for this problem, I followed this information :
>
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
>
> certificate on //etc/pki/pki-tomcat/alias///is the same pkiuser on
> the LDAP server
>
> internaldb.ldapauth.authtype=SslClientAuth
>
> so I don't know why I have a 401 error.
>
> //
> 2°) ipa cert-request --principal : failed
>
> ipa: ERROR: impossible de se connecter à « *MailScanner soupçonne le
> lien suivant d'être une tentative de fraude de la part de
> "freeipa4.exmple.fr:443" *
>
https://freeipa4.exmple.fr:443/ca/eeca/ca/profileSubmitSSLClient » :
> (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate
>
> this is strange because on this port 443 i use a 3rd part certificates
>
> do you have any idea what the problem is? I'm lost I don't know what
> to look for anymore.
>
The 401 error points to ipaCert not allowing to authenticate to PKI
(this certificate is used by FreeIPA framework when it performs
operations on PKI that require authentication).
On IPA 4.4, this certificate is stored in the NSS database
/etc/httpd/alias with the nickname ipaCert. You can check its content
with
$ certutil -L -d /etc/httpd/alias -n ipaCert
The same cert must be present in uid=ipara,ou=people,o=ipaca.
$ ldapsearch -D "cn=directory manager" -W -b o=ipaca -LLL -o
ldif-wrap=no "(uid=ipara)" usercertificate description
Enter LDAP Password:
dn: uid=ipara,ou=people,o=ipaca
usercertificate:: MIIDvDC...jyi5w
description: 2;7;CN=Certificate Authority,O=DOMAIN.COM;CN=IPA
RA,O=DOMAIN.COM
The usercertificate field must contain the ipaCert certificate and the
description field must contain 2;<serial>;<issuer>;<subject>.
Can you check if the cert is consistent in the NSS database and in LDAP?
HTH,
flo
> thank you in advance
> Pierre
>
>
> here are some excerpts from the log
>
>
> -----
>
> IPA server version 4.4.0. API version 2.213
> -----
> ipaupgrade.log :
> '''
> 2019-01-29T16:48:21Z DEBUG request GET
>
https://freeipa4.exemple.fr:8443/ca/rest/account/login
> 2019-01-29T16:48:21Z DEBUG request body ''
> 2019-01-29T16:48:21Z DEBUG NSSConnection init freeipa4.exemple.fr
> 2019-01-29T16:48:21Z DEBUG Connecting: XX.XX.XX.XX:0
> 2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage
> = SSL Server
> 2019-01-29T16:48:21Z DEBUG cert valid True for
> "CN=freeipa4.exemple.fr,O=exemple.FR"
> 2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443
> 2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
> 2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
> 2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage
> = SSL Server
> 2019-01-29T16:48:21Z DEBUG cert valid True for
> "CN=freeipa4.exemple.fr,O=exemple.FR"
> 2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443
> 2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
> 2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
> 2019-01-29T16:48:21Z DEBUG response status 401
> 2019-01-29T16:48:21Z DEBUG response headers {'content-length':
'964',
> 'content-language': 'fr', 'expires': 'Thu, 01 Jan 1970
01:00:00 CET',
> 'server': 'Apache-Coyote/1.1', 'cache-control':
'private', 'date':
> 'Tue, 29 Jan 2019 16:48:21 GMT', 'content-type':
> 'text/html;charset=utf-8', 'www-authenticate': 'Basic
realm="C}
> 2019-01-29T16:48:21Z DEBUG response body
'<html><head><title>Apache
> Tomcat/7.0.69 - Rapport d\'\'erreur</title><style><!--H1
>
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
> H2
>
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;}
> H3 {font'
> 2019-01-29T16:48:21Z ERROR IPA server upgrade failed: Inspect
> /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
> 2019-01-29T16:48:21Z DEBUG File
> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171,
> in execute
> return_value = self.run()
> File
>
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
> line 46, in run
> server.upgrade()
> File
> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
> line 1863, in upgrade
> upgrade_configuration()
> File
> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
> line 1785, in upgrade_configuration
> ca_enable_ldap_profile_subsystem(ca)
> File
> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
> line 336, in ca_enable_ldap_profile_subsystem
> cainstance.migrate_profiles_to_ldap()
> File
> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
> line 1984, in migrate_profiles_to_ldap
> _create_dogtag_profile(profile_id, profile_data, overwrite=False)
> File
> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
> line 1990, in _create_dogtag_profile
> with api.Backend.ra_certprofile as profile_api:
> File
> "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line
> 2060, in __enter__
> raise errors.RemoteRetrieveError(reason=_('Failed to
> authenticate to CA REST API'))
>
> 2019-01-29T16:48:21Z DEBUG The ipa-server-upgrade command failed,
> exception: RemoteRetrieveError: Échec de l'authentification auprès de
> l'API REST de l'AC
>
> -------
> # getcert list
> Number of certificates and requests being tracked: 5.
> -------
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>