On Thu, Sep 12, 2019 at 02:10:22PM -0400, Ben Rawson via FreeIPA-users wrote:
Thanks for the quick response Fraser. I did some more digging based
suggestions, and I think I have a pretty good handle on whats going on.
We actually have 3 ipa servers, with ipa01 being the CA master. After I
created the sub-CA, its keys were added to the /etc/pki/pki-tomcat/alias
database on ipa01, but not ipa02 or ipa03.
The ipa client on our host was pointing directly to ipa02, and since the CA
wasn't in the database it was throwing the error in my original post. By
changing /etc/ipa/default.conf to point at ipa01 (and changing the
certificate policy,) I was able to get certmonger to issue the cert I
So the question now is: Shouldn't the pki-tomcat/aliases database get
automatically replicated from the master to the replicas? What
configuration is responsible for doing this, and why might it not be
Yes, sub-CA keys should be replicated automatically. Something is
Have a look in the /etc/pki/pki-tomcat/ca/debug log on ipa02 (search
backwards from end for string KeyRetriever and see what's nearby).
If you want to see fresh results, restart Dogtag (systemctl restart
pki-tomcatd@pki-tomcat) because failed key retrieval retries with
Also check /var/log/httpd/error_log on ipa-01 to see if there's any
indication why the key retrieval requests failed.
'systemctl restart ipa-custodia' on ipa-01. Sometimes I have seen
custodia get into a funk and a restart resolves it.
Thanks again for your help,
On Thu, Sep 5, 2019 at 9:22 PM Fraser Tweedale <ftweedal(a)redhat.com> wrote:
> On Thu, Sep 05, 2019 at 09:07:48PM -0000, Ben Rawson via FreeIPA-users
> > I'm having some trouble getting sub-ca signed certificates issued and
> managed by certmonger. The implementation here [
] describes how that should work.
> I see that the -X option can be passed to ipa-getcert to specify the
> issuer, but every time I create a request with -X specified I get an error.
> > Steps to reproduce:
> > 1. Create a new CA named "Test" through the FreeIPA web UI.
> > 2. Run the following on a host enrolled in freeIPA:
> > ipa-getcert request -k /root/test.key -f /root/test.crt -I
> -X "Test"
> > 3. Run ipa-getcert list and receive the an error message:
> > Request ID 'test':
> > status: CA_REJECTED
> > ca-error: Server at https://ipa02.yyy.com/ipa/xml
> will retry: 4035 (RPC failed at server. Request failed with status 500:
> Non-2xx response from CA REST API: 500. ).
> > stuck: yes
> > key pair storage: type=FILE,location='/root/test.key'
> > certificate: type=FILE,location='/root/test.crt'
> > CA: IPA
> > issuer:
> > subject:
> > expires: unknown
> > pre-save command:
> > post-save command:
> > track: yes
> > auto-renew: yes
> > Running FreeIPA 4.6.4
> Hi Ben,
> Have a look at the Dogtag debug log under
> /var/log/pki/pki-tomcat/ca/, and also the system journal, on host
. You should see something related to the error above.
> What is your topology like? Do you have multiple CA replicas? Are
> the sub-CA signing keys present on ipa02, in the Dogtag NSSDB?
> # certutil -d /etc/pki/pki-tomcat/alias -L
*Ben Rawson *
99 E. Main Street
Columbus, OH 43215
Meet Olive, Your Newest Employee <https://youtu.be/9Vf84z9KA6Y>
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines