On 08/13/2018 05:43 PM, Tobi Berninger via FreeIPA-users wrote:
thanks for ur fast answer.
First of all we are an small student organization so we dont have the
luck to have the money for an red hat support contract and cant access
the link u provided.
I started the other services with ipactl, as u described, allready but
not working fully.
I also restarted cermonger several times but it doesnst seem to have any
influence on the cert.
in summary the process is the following:
1. identify all the expired certs with getcert list (look at expires:
field). Note, getcert list should display 8 or 9 certs depending on your
version (otherwise it means some tracking requests are missing).
2. change time back to a date where all certs were valid (do not forget
to stop ntpd with systemctl stop ntpd before changing the time)
3. make sure that all the IdM processes are running (except ntpd). If
needed, manually start pki-tomcat (but not with ipactl command as it
would restart ntpd, use systemctl start instead).
4. restart certmonger and wait for a few minutes for it to renew the
certs. You can check the output in the journal.
Thanks for ur help
2018-08-13 17:29 GMT+02:00 Florence Blanc-Renaud <flo(a)redhat.com
On 08/13/2018 04:13 PM, Tobi Berninger via FreeIPA-users wrote:
i upgrade my centos 7.5 ipaserver to an new version and runned
into a few problems.
It seems like 'subsystemCert cert-pki-ca' is expired nearly a
month ago (jul 22) and i am not sure how to renew it.
When i run the ipa-server-upgrade manual, i run into a error
with the ca certificates and in the log i found that line:
Internal Database Error encountered: Could not connect to LDAP
server host ipababy.int.asta-frankfurt.de
port 636 Error
netscape.ldap.LDAPException: Unable to create socket:
failed: (-8181) Peer's Certificate has expired. (-1)
When i run ipactl start, tomcatd and httpd wont start.
I allready tried to turn back time, but i dont know how to
manual start pki-tomcatd or any other way to renew the certificates.
Or do i look in the wrong diection the whole time?
Thank u all for ur help
The recovery steps are described in
How do I manually
renew Identity Management (IPA) certificates on RHEL7 after they
have expired? (Master IPA Server) and involve going back in time as
pki-tomcatd is normally started using ipactl start. When one of the
processes launched through ipactl fails to start, you can use ipactl
start --ignore-service-failures, so that the other processes stay up.
pki-tomcatd can be started individually using systemctl start
pki-tomcatd@pki-tomcat. But in your case, you will need to restart
certmonger to trigger the certificate renewal.
FreeIPA-users mailing list --
To unsubscribe send an email to
Fedora Code of Conduct:
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines