I can't do anything with my ipa server, I need help the certification is expired and pki-tomcat is not renewing it pa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa1.lesbg.com', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fe4459bda00>: Failed to establish a new connection: [Errno 111] Connection refused')) pa-pki-wait-running[7492]: ipa-pki-wait-running: Created connection http://ipa1.lesbg.com:8080/ca Oct 08 21:14:39 ipa1.lesbg.com ipa-pki-wait-running[7492]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa1.lesbg.com', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fe4459bda00>: Failed to establish a new connection: [Errno 111] Connection refused'))
my replication stopped when I create a new server and import my data I am having the same problem my firewall is disabled nothing on poer 8080
Hi,
you can use ipa-cert-fix to repair your IPA server. The guide *Managing certificates in IdM* has a chapter explaining how to use the tool: Chapter 13 https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/8/html/managing_certificates_in_idm/renewing-expired-system-certificates-when-idm-is-offline_working-with-idm-certificates#renewing-expired-system-certificates-when-idm-is-offline_working-with-idm-certificates . *Renewing expired system certificates when IdM is offline*.
HTH, flo
On Thu, Oct 10, 2024 at 1:34 AM Rowana Bejjani via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
I can't do anything with my ipa server, I need help the certification is expired and pki-tomcat is not renewing it pa-pki-wait-running: Connection failed: HTTPConnectionPool(host=' ipa1.lesbg.com', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fe4459bda00>: Failed to establish a new connection: [Errno 111] Connection refused')) pa-pki-wait-running[7492]: ipa-pki-wait-running: Created connection http://ipa1.lesbg.com:8080/ca Oct 08 21:14:39 ipa1.lesbg.com ipa-pki-wait-running[7492]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host=' ipa1.lesbg.com', port=8080): Max retries exceeded with url: /ca/admin/ca/getStatus (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fe4459bda00>: Failed to establish a new connection: [Errno 111] Connection refused'))
my replication stopped when I create a new server and import my data I am having the same problem my firewall is disabled nothing on poer 8080 -- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi Flo, Thank you for your reply, this is what happened <pre>Last login: Tue Oct 8 20:49:14 2024 from 10.10.1.5 [root@ipa1 ~]# ipa-cert-fix
WARNING
ipa-cert-fix is intended for recovery when expired certificates prevent the normal operation of IPA. It should ONLY be used in such scenarios, and backup of the system, especially certificates and keys, is STRONGLY RECOMMENDED.
The following certificates will be renewed:
Dogtag subsystem certificate: Subject: CN=CA Subsystem,O=LOCAL.LESBG.COM Serial: 10468392990 Expires: 2024-10-02 10:19:00+00:00
Dogtag ca_ocsp_signing certificate: Subject: CN=OCSP Subsystem,O=LOCAL.LESBG.COM Serial: 10468392980 Expires: 2024-10-02 10:19:00+00:00
Dogtag ca_audit_signing certificate: Subject: CN=CA Audit,O=LOCAL.LESBG.COM Serial: 10468392992 Expires: 2024-10-02 10:19:00+00:00
IPA IPA RA certificate: Subject: CN=IPA RA,O=LOCAL.LESBG.COM Serial: 10468392987 Expires: 2024-10-02 10:19:00+00:00
IPA Apache HTTPS certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352280 Expires: 2024-10-02 10:19:00+00:00
IPA LDAP certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352279 Expires: 2024-10-02 10:19:00+00:00
IPA KDC certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352277 Expires: 2024-10-02 10:19:00+00:00
Enter "yes" to proceed: yes Proceeding. CalledProcessError(Command ['pki-server', 'cert-fix', '--ldapi-socket', '/run/slapd-LOCAL-LESBG-COM.socket', '--agent-uid', 'ipara', '--cert', 'subsystem', '--cert', 'ca_ocsp_signing', '--cert', 'ca_audit_signing', '--extra-cert', '10468392987', '--extra-cert', '95866352280', '--extra-cert', '95866352279', '--extra-cert', '95866352277'] returned non-zero exit status 1: 'INFO: Loading instance type: pki-tomcatd\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Loading subsystem registry: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: Fixing the following system certs: ['subsystem', 'ca_ocsp_signing', 'ca_audit_signing']\nINFO: Renewing the following additional certs: ['10468392987', '95866352280', '95866352279', '95866352277']\nINFO: Stopping the instance to proceed with system cert renewal\nINFO: Configuring LDAP connection for CA\nINFO: Setting pkidbuser password via ldappasswd\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Selftests disabled for subsystems: ca\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Resetting password for uid=ipara,ou=people,o=ipaca\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Starting the instance\nINFO: Sleeping for 10 seconds to allow server time to start...\nINFO: Requesting new cert for subsystem\nINFO: Getting subsystem cert info from CS.cfg\nINFO: Getting subsystem cert info from NSS database\nINFO: Trying to setup a secure connection to CA subsystem.\nINFO: Stopping the instance\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Selftests enabled for subsystems: ca\nINFO: Restoring LDAP connection for CA\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nERROR: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 700, in urlopen\n httplib_response = self._make_request(\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 383, in _make_request\n self._validate_conn(conn)\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 1015, in _validate_conn\n conn.connect()\n File "/usr/lib/python3.9/site-packages/urllib3/connection.py", line 411, in connect\n self.sock = ssl_wrap_socket(\n File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket\n ssl_sock = _ssl_wrap_socket_impl(\n File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl\n return ssl_context.wrap_socket(sock, server_hostname=server_hostname)\n File "/usr/lib64/python3.9/ssl.py", line 501, in wrap_socket\n return self.sslsocket_class._create(\n File "/usr/lib64/python3.9/ssl.py", line 1074, in _create\n self.do_handshake()\n File "/usr/lib64/python3.9/ssl.py", line 1343, in do_handshake\n self._sslobj.do_handshake()\nssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 439, in send\n resp = conn.urlopen(\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 756, in urlopen\n retries = retries.increment(\n File "/usr/lib/python3.9/site-packages/urllib3/util/retry.py", line 576, in increment\n raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/pki/server/pkiserver.py", line 41, in <module>\n cli.execute(sys.argv)\n File "/usr/lib/python3.9/site-packages/pki/server/cli/__init__.py", line 144, in execute\n super().execute(args)\n File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute\n module.execute(module_args)\n File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute\n module.execute(module_args)\n File "/usr/lib/python3.9/site-packages/pki/server/cli/cert.py", line 1467, in execute\n instance.cert_create(\n File "/usr/lib/python3.9/site-packages/pki/server/instance.py", line 980, in cert_create\n connection = pki.server.PKIServer.setup_password_authentication(\n File "/usr/lib/python3.9/site-packages/pki/server/__init__.py", line 1420, in setup_password_authentication\n account_client.login()\n File "/usr/lib/python3.9/site-packages/pki/__init__.py", line 432, in handler\n return fn_call(inst, *args, **kwargs)\n File "/usr/lib/python3.9/site-packages/pki/account.py", line 68, in login\n self.connection.get(self.login_url)\n File "/usr/lib/python3.9/site-packages/pki/client.py", line 56, in wrapper\n return func(self, *args, **kwargs)\n File "/usr/lib/python3.9/site-packages/pki/client.py", line 263, in get\n r = self.session.get(\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 557, in get\n return self.request('GET', url, **kwargs)\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 544, in request\n resp = self.send(prep, **send_kwargs)\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 657, in send\n r = adapter.send(request, **kwargs)\n File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 514, in send\n raise SSLError(e, request=request)\nrequests.exceptions.SSLError: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\n') The ipa-cert-fix command failed. </pre>
Hi Flo, Thank you for your reply, this is what happened <pre>Last login: Tue Oct 8 20:49:14 2024 from 10.10.1.5 [root@ipa1 ~]# ipa-cert-fix
WARNING
ipa-cert-fix is intended for recovery when expired certificates prevent the normal operation of IPA. It should ONLY be used in such scenarios, and backup of the system, especially certificates and keys, is STRONGLY RECOMMENDED.
The following certificates will be renewed:
Dogtag subsystem certificate: Subject: CN=CA Subsystem,O=LOCAL.LESBG.COM Serial: 10468392990 Expires: 2024-10-02 10:19:00+00:00
Dogtag ca_ocsp_signing certificate: Subject: CN=OCSP Subsystem,O=LOCAL.LESBG.COM Serial: 10468392980 Expires: 2024-10-02 10:19:00+00:00
Dogtag ca_audit_signing certificate: Subject: CN=CA Audit,O=LOCAL.LESBG.COM Serial: 10468392992 Expires: 2024-10-02 10:19:00+00:00
IPA IPA RA certificate: Subject: CN=IPA RA,O=LOCAL.LESBG.COM Serial: 10468392987 Expires: 2024-10-02 10:19:00+00:00
IPA Apache HTTPS certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352280 Expires: 2024-10-02 10:19:00+00:00
IPA LDAP certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352279 Expires: 2024-10-02 10:19:00+00:00
IPA KDC certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352277 Expires: 2024-10-02 10:19:00+00:00
Enter "yes" to proceed: yes Proceeding. CalledProcessError(Command ['pki-server', 'cert-fix', '--ldapi-socket', '/run/slapd-LOCAL-LESBG-COM.socket', '--agent-uid', 'ipara', '--cert', 'subsystem', '--cert', 'ca_ocsp_signing', '--cert', 'ca_audit_signing', '--extra-cert', '10468392987', '--extra-cert', '95866352280', '--extra-cert', '95866352279', '--extra-cert', '95866352277'] returned non-zero exit status 1: 'INFO: Loading instance type: pki-tomcatd\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Loading subsystem registry: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: Fixing the following system certs: ['subsystem', 'ca_ocsp_signing', 'ca_audit_signing']\nINFO: Renewing the following additional certs: ['10468392987', '95866352280', '95866352279', '95866352277']\nINFO: Stopping the instance to proceed with system cert renewal\nINFO: Configuring LDAP connection for CA\nINFO: Setting pkidbuser password via ldappasswd\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Selftests disabled for subsystems: ca\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Resetting password for uid=ipara,ou=people,o=ipaca\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Starting the instance\nINFO: Sleeping for 10 seconds to allow server time to start...\nINFO: Requesting new cert for subsystem\nINFO: Getting subsystem cert info from CS.cfg\nINFO: Getting subsystem cert info from NSS database\nINFO: Trying to setup a secure connection to CA subsystem.\nINFO: Stopping the instance\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Selftests enabled for subsystems: ca\nINFO: Restoring LDAP connection for CA\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nERROR: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 700, in urlopen\n httplib_response = self._make_request(\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 383, in _make_request\n self._validate_conn(conn)\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 1015, in _validate_conn\n conn.connect()\n File "/usr/lib/python3.9/site-packages/urllib3/connection.py", line 411, in connect\n self.sock = ssl_wrap_socket(\n File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket\n ssl_sock = _ssl_wrap_socket_impl(\n File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl\n return ssl_context.wrap_socket(sock, server_hostname=server_hostname)\n File "/usr/lib64/python3.9/ssl.py", line 501, in wrap_socket\n return self.sslsocket_class._create(\n File "/usr/lib64/python3.9/ssl.py", line 1074, in _create\n self.do_handshake()\n File "/usr/lib64/python3.9/ssl.py", line 1343, in do_handshake\n self._sslobj.do_handshake()\nssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 439, in send\n resp = conn.urlopen(\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 756, in urlopen\n retries = retries.increment(\n File "/usr/lib/python3.9/site-packages/urllib3/util/retry.py", line 576, in increment\n raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/pki/server/pkiserver.py", line 41, in <module>\n cli.execute(sys.argv)\n File "/usr/lib/python3.9/site-packages/pki/server/cli/__init__.py", line 144, in execute\n super().execute(args)\n File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute\n module.execute(module_args)\n File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute\n module.execute(module_args)\n File "/usr/lib/python3.9/site-packages/pki/server/cli/cert.py", line 1467, in execute\n instance.cert_create(\n File "/usr/lib/python3.9/site-packages/pki/server/instance.py", line 980, in cert_create\n connection = pki.server.PKIServer.setup_password_authentication(\n File "/usr/lib/python3.9/site-packages/pki/server/__init__.py", line 1420, in setup_password_authentication\n account_client.login()\n File "/usr/lib/python3.9/site-packages/pki/__init__.py", line 432, in handler\n return fn_call(inst, *args, **kwargs)\n File "/usr/lib/python3.9/site-packages/pki/account.py", line 68, in login\n self.connection.get(self.login_url)\n File "/usr/lib/python3.9/site-packages/pki/client.py", line 56, in wrapper\n return func(self, *args, **kwargs)\n File "/usr/lib/python3.9/site-packages/pki/client.py", line 263, in get\n r = self.session.get(\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 557, in get\n return self.request('GET', url, **kwargs)\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 544, in request\n resp = self.send(prep, **send_kwargs)\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 657, in send\n r = adapter.send(request, **kwargs)\n File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 514, in send\n raise SSLError(e, request=request)\nrequests.exceptions.SSLError: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\n') The ipa-cert-fix command failed. </pre>
Hi Flo, Thank you for your reply, this is what happened <pre>Last login: Tue Oct 8 20:49:14 2024 from 10.10.1.5 [root@ipa1 ~]# ipa-cert-fix
WARNING
ipa-cert-fix is intended for recovery when expired certificates prevent the normal operation of IPA. It should ONLY be used in such scenarios, and backup of the system, especially certificates and keys, is STRONGLY RECOMMENDED.
The following certificates will be renewed:
Dogtag subsystem certificate: Subject: CN=CA Subsystem,O=LOCAL.LESBG.COM Serial: 10468392990 Expires: 2024-10-02 10:19:00+00:00
Dogtag ca_ocsp_signing certificate: Subject: CN=OCSP Subsystem,O=LOCAL.LESBG.COM Serial: 10468392980 Expires: 2024-10-02 10:19:00+00:00
Dogtag ca_audit_signing certificate: Subject: CN=CA Audit,O=LOCAL.LESBG.COM Serial: 10468392992 Expires: 2024-10-02 10:19:00+00:00
IPA IPA RA certificate: Subject: CN=IPA RA,O=LOCAL.LESBG.COM Serial: 10468392987 Expires: 2024-10-02 10:19:00+00:00
IPA Apache HTTPS certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352280 Expires: 2024-10-02 10:19:00+00:00
IPA LDAP certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352279 Expires: 2024-10-02 10:19:00+00:00
IPA KDC certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352277 Expires: 2024-10-02 10:19:00+00:00
Enter "yes" to proceed: yes Proceeding. CalledProcessError(Command ['pki-server', 'cert-fix', '--ldapi-socket', '/run/slapd-LOCAL-LESBG-COM.socket', '--agent-uid', 'ipara', '--cert', 'subsystem', '--cert', 'ca_ocsp_signing', '--cert', 'ca_audit_signing', '--extra-cert', '10468392987', '--extra-cert', '95866352280', '--extra-cert', '95866352279', '--extra-cert', '95866352277'] returned non-zero exit status 1: 'INFO: Loading instance type: pki-tomcatd\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Loading subsystem registry: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: Fixing the following system certs: ['subsystem', 'ca_ocsp_signing', 'ca_audit_signing']\nINFO: Renewing the following additional certs: ['10468392987', '95866352280', '95866352279', '95866352277']\nINFO: Stopping the instance to proceed with system cert renewal\nINFO: Configuring LDAP connection for CA\nINFO: Setting pkidbuser password via ldappasswd\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Selftests disabled for subsystems: ca\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Resetting password for uid=ipara,ou=people,o=ipaca\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Starting the instance\nINFO: Sleeping for 10 seconds to allow server time to start...\nINFO: Requesting new cert for subsystem\nINFO: Getting subsystem cert info from CS.cfg\nINFO: Getting subsystem cert info from NSS database\nINFO: Trying to setup a secure connection to CA subsystem.\nINFO: Stopping the instance\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Selftests enabled for subsystems: ca\nINFO: Restoring LDAP connection for CA\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nERROR: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 700, in urlopen\n httplib_response = self._make_request(\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 383, in _make_request\n self._validate_conn(conn)\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 1015, in _validate_conn\n conn.connect()\n File "/usr/lib/python3.9/site-packages/urllib3/connection.py", line 411, in connect\n self.sock = ssl_wrap_socket(\n File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket\n ssl_sock = _ssl_wrap_socket_impl(\n File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl\n return ssl_context.wrap_socket(sock, server_hostname=server_hostname)\n File "/usr/lib64/python3.9/ssl.py", line 501, in wrap_socket\n return self.sslsocket_class._create(\n File "/usr/lib64/python3.9/ssl.py", line 1074, in _create\n self.do_handshake()\n File "/usr/lib64/python3.9/ssl.py", line 1343, in do_handshake\n self._sslobj.do_handshake()\nssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 439, in send\n resp = conn.urlopen(\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 756, in urlopen\n retries = retries.increment(\n File "/usr/lib/python3.9/site-packages/urllib3/util/retry.py", line 576, in increment\n raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/pki/server/pkiserver.py", line 41, in <module>\n cli.execute(sys.argv)\n File "/usr/lib/python3.9/site-packages/pki/server/cli/__init__.py", line 144, in execute\n super().execute(args)\n File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute\n module.execute(module_args)\n File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute\n module.execute(module_args)\n File "/usr/lib/python3.9/site-packages/pki/server/cli/cert.py", line 1467, in execute\n instance.cert_create(\n File "/usr/lib/python3.9/site-packages/pki/server/instance.py", line 980, in cert_create\n connection = pki.server.PKIServer.setup_password_authentication(\n File "/usr/lib/python3.9/site-packages/pki/server/__init__.py", line 1420, in setup_password_authentication\n account_client.login()\n File "/usr/lib/python3.9/site-packages/pki/__init__.py", line 432, in handler\n return fn_call(inst, *args, **kwargs)\n File "/usr/lib/python3.9/site-packages/pki/account.py", line 68, in login\n self.connection.get(self.login_url)\n File "/usr/lib/python3.9/site-packages/pki/client.py", line 56, in wrapper\n return func(self, *args, **kwargs)\n File "/usr/lib/python3.9/site-packages/pki/client.py", line 263, in get\n r = self.session.get(\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 557, in get\n return self.request('GET', url, **kwargs)\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 544, in request\n resp = self.send(prep, **send_kwargs)\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 657, in send\n r = adapter.send(request, **kwargs)\n File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 514, in send\n raise SSLError(e, request=request)\nrequests.exceptions.SSLError: HTTPSConnectionPool(host='ipa1.lesbg.com', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))\n') The ipa-cert-fix command failed. </pre>
<pre>[root@ipa1 ~]# curl -k http://ipa1.lesbg.com:8080/ca/admin/ca/getStatus curl: (7) Failed to connect to ipa1.lesbg.com port 8080: Connection refused </pre>
Hi,
can you provide the output of "getcert list"?
flo
On Thu, Oct 10, 2024 at 2:26 PM Rowana Bejjani via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi Flo, Thank you for your reply, this is what happened
<pre>Last login: Tue Oct 8 20:49:14 2024 from 10.10.1.5 [root@ipa1 ~]# ipa-cert-fix WARNING ipa-cert-fix is intended for recovery when expired certificates prevent the normal operation of IPA. It should ONLY be used in such scenarios, and backup of the system, especially certificates and keys, is STRONGLY RECOMMENDED. The following certificates will be renewed: Dogtag subsystem certificate: Subject: CN=CA Subsystem,O=LOCAL.LESBG.COM Serial: 10468392990 Expires: 2024-10-02 10:19:00+00:00 Dogtag ca_ocsp_signing certificate: Subject: CN=OCSP Subsystem,O=LOCAL.LESBG.COM Serial: 10468392980 Expires: 2024-10-02 10:19:00+00:00 Dogtag ca_audit_signing certificate: Subject: CN=CA Audit,O=LOCAL.LESBG.COM Serial: 10468392992 Expires: 2024-10-02 10:19:00+00:00 IPA IPA RA certificate: Subject: CN=IPA RA,O=LOCAL.LESBG.COM Serial: 10468392987 Expires: 2024-10-02 10:19:00+00:00 IPA Apache HTTPS certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352280 Expires: 2024-10-02 10:19:00+00:00 IPA LDAP certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352279 Expires: 2024-10-02 10:19:00+00:00 IPA KDC certificate: Subject: CN=ipa1.lesbg.com,O=LOCAL.LESBG.COM Serial: 95866352277 Expires: 2024-10-02 10:19:00+00:00 Enter "yes" to proceed: yes Proceeding. CalledProcessError(Command ['pki-server', 'cert-fix', '--ldapi-socket', '/run/slapd-LOCAL-LESBG-COM.socket', '--agent-uid', 'ipara', '--cert', 'subsystem', '--cert', 'ca_ocsp_signing', '--cert', 'ca_audit_signing', '--extra-cert', '10468392987', '--extra-cert', '95866352280', '--extra-cert', '95866352279', '--extra-cert', '95866352277'] returned non-zero exit status 1: 'INFO: Loading instance type: pki-tomcatd\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Loading subsystem registry: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: Fixing the following system certs: [\'subsystem\', \'ca_ocsp_signing\', \'ca_audit_signing\']\nINFO: Renewing the following additional certs: [\'10468392987\', \'95866352280\', \'95866352279\', \'95866352277\']\nINFO: Stopping the instance to proceed with system cert renewal\nINFO: Configuring LDAP connection for CA\nINFO: Setting pkidbuser password via ldappasswd\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Selftests disabled for subsystems: ca\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Resetting password for uid=ipara,ou=people,o=ipaca\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\nSASL SSF: 0\nINFO: Starting the instance\nINFO: Sleeping for 10 seconds to allow server time to start...\nINFO: Requesting new cert for subsystem\nINFO: Getting subsystem cert info from CS.cfg\nINFO: Getting subsystem cert info from NSS database\nINFO: Trying to setup a secure connection to CA subsystem.\nINFO: Stopping the instance\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nINFO: Selftests enabled for subsystems: ca\nINFO: Restoring LDAP connection for CA\nINFO: Storing subsystem config: /etc/pki/pki-tomcat/ca/CS.cfg\nINFO: Storing registry config: /etc/pki/pki-tomcat/ca/registry.cfg\nERROR: HTTPSConnectionPool(host=\'ipa1.lesbg.com\', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, \'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)\')))\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 700, in urlopen\n httplib_response = self._make_request(\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 383, in _make_request\n self._validate_conn(conn)\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 1015, in _validate_conn\n conn.connect()\n File "/usr/lib/python3.9/site-packages/urllib3/connection.py", line 411, in connect\n self.sock = ssl_wrap_socket(\n File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket\n ssl_sock = _ssl_wrap_socket_impl(\n File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl\n return ssl_context.wrap_socket(sock, server_hostname=server_hostname)\n File "/usr/lib64/python3.9/ssl.py", line 501, in wrap_socket\n return self.sslsocket_class._create(\n File "/usr/lib64/python3.9/ssl.py", line 1074, in _create\n self.do_handshake()\n File "/usr/lib64/python3.9/ssl.py", line 1343, in do_handshake\n self._sslobj.do_handshake()\nssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 439, in send\n resp = conn.urlopen(\n File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 756, in urlopen\n retries = retries.increment(\n File "/usr/lib/python3.9/site-packages/urllib3/util/retry.py", line 576, in increment\n raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host=\'ipa1.lesbg.com\', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, \'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)\')))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.9/site-packages/pki/server/pkiserver.py", line 41, in <module>\n cli.execute(sys.argv)\n File "/usr/lib/python3.9/site-packages/pki/server/cli/__init__.py", line 144, in execute\n super().execute(args)\n File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute\n module.execute(module_args)\n File "/usr/lib/python3.9/site-packages/pki/cli/__init__.py", line 217, in execute\n module.execute(module_args)\n File "/usr/lib/python3.9/site-packages/pki/server/cli/cert.py", line 1467, in execute\n instance.cert_create(\n File "/usr/lib/python3.9/site-packages/pki/server/instance.py", line 980, in cert_create\n connection = pki.server.PKIServer.setup_password_authentication(\n File "/usr/lib/python3.9/site-packages/pki/server/__init__.py", line 1420, in setup_password_authentication\n account_client.login()\n File "/usr/lib/python3.9/site-packages/pki/__init__.py", line 432, in handler\n return fn_call(inst, *args, **kwargs)\n File "/usr/lib/python3.9/site-packages/pki/account.py", line 68, in login\n self.connection.get(self.login_url)\n File "/usr/lib/python3.9/site-packages/pki/client.py", line 56, in wrapper\n return func(self, *args, **kwargs)\n File "/usr/lib/python3.9/site-packages/pki/client.py", line 263, in get\n r = self.session.get(\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 557, in get\n return self.request(\'GET\', url, **kwargs)\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 544, in request\n resp = self.send(prep, **send_kwargs)\n File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 657, in send\n r = adapter.send(request, **kwargs)\n File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 514, in send\n raise SSLError(e, request=request)\nrequests.exceptions.SSLError: HTTPSConnectionPool(host=\'ipa1.lesbg.com\', port=8443): Max retries exceeded with url: /ca/rest/account/login (Caused by SSLError(SSLCertVerificationError(1, \'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)\')))\n') The ipa-cert-fix command failed. </pre>
<pre>[root@ipa1 ~]# curl -k http://ipa1.lesbg.com:8080/ca/admin/ca/getStatus curl: (7) Failed to connect to ipa1.lesbg.com port 8080: Connection refused </pre>
-- _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
freeipa-users@lists.fedorahosted.org