Hi Flo,
thanks (again!!!!) for your kind support. Really appreciate it. You
found again the source of the problem and we were able to solve it (see
buttom):
Am 12.02.19 um 18:22 schrieb Florence Blanc-Renaud:
Hi,
there are a few things that you can check. The error "Failed to
authenticate to CA REST API" points to authentication issue between IPA
framework and Dogtag, which is done with a certificate.
Are there expired certificates on the server where the upgrade failed?
[root@ipa2 ~]# getcert list | grep expires
expires: 2021-01-14 08:53:15 UTC
expires: 2021-01-14 08:51:44 UTC
expires: 2021-01-14 08:55:41 UTC
expires: 2039-01-25 08:52:13 UTC
expires: 2021-01-14 08:51:08 UTC
expires: 2020-06-28 03:05:27 UTC
expires: 2020-07-20 03:05:47 UTC
expires: 2020-07-20 03:05:30 UTC
[root@ipa2 ~]#
--> Check!
I
would check more specifically for the RA cert that is stored in
/etc/httpd/alias (nickname=ipaCert) in IPA < 4.5 and in
/var/lib/ipa/ra-agent.pem in IPA 4.5+.
Request ID '20170526083117':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=PLEIADES.UNI-WUPPERTAL.DE
subject: CN=IPA RA,O=PLEIADES.UNI-WUPPERTAL.DE
expires: 2021-01-14 08:51:08 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
--> check!
You can check its content with
$ certutil -L -d /etc/httpd/alias -n ipaCert
or
$ openssl x509 -noout -text -in /var/lib/ipa/ra-agent.pem
root@ipa2 ~]# certutil -L -d /etc/httpd/alias -n ipaCert
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 268173514 (0xffc00ca)
Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
Issuer: "CN=Certificate Authority,O=PLEIADES.UNI-WUPPERTAL.DE"
Validity:
Not Before: Fri Jan 25 08:51:08 2019
Not After : Thu Jan 14 08:51:08 2021
Subject: "CN=IPA RA,O=PLEIADES.UNI-WUPPERTAL.DE"
The same cert must be present in uid=ipara,ou=people,o=ipaca.
$ ldapsearch -D "cn=directory manager" -W -b o=ipaca -LLL -o
ldif-wrap=no "(uid=ipara)" usercertificate description
Enter LDAP Password:
dn: uid=ipara,ou=people,o=ipaca
usercertificate:: MIIDvDC...jyi5w
description: 2;7;CN=Certificate Authority,O=DOMAIN.COM;CN=IPA
RA,O=DOMAIN.COM
The usercertificate field must contain the ipaCert certificate and the
description field must contain 2;<serial>;<issuer>;<subject>.
[root@ipa2 ~]# ldapsearch -D "cn=directory manager" -W -b o=ipaca -LLL
-o ldif-wrap=no "(uid=ipara)" usercertificate description
Enter LDAP Password:
dn: uid=ipara,ou=people,o=ipaca
[...]
description: 2;1342111780;CN=Certificate
Authority,O=PLEIADES.UNI-WUPPERTAL.DE;CN=IPA RA,O=PLEIADES.UNI-WUPPERTAL.DE
And here we see a different serial compared to the one above.
We changed the certificates accordingly and voilà: update ran through
like a charm. :-)
THanks again
Torsten
--
Dr. Torsten Harenberg harenberg(a)physik.uni-wuppertal.de
Bergische Universitaet
Fakultät 4 - Physik Tel.: +49 (0)202 439-3521
Gaussstr. 20 Fax : +49 (0)202 439-2811
42097 Wuppertal