I sorted problem. I need to import new R3 Let’sencrypt intermediate before issue of new
ipa-cacert-manage -n R3 -t C,, install letsencrypt_r3.pem
renewl Let’s encypt ssl.
On 20.01.2021., at 10:37, Petar Kozić <petar.kozic(a)mint.rs>
I had Let’s encrypt SSL on my freeipa server. When I setup freeIPA for the first time, I
set Let’s encrypt on next way:
I installed DST CA ROOT and LetsEncrypt intermediate with next command:
ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem
ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer
Then, I issued letsencypt ssl for domain with certbot and make pkcs chain with command:
openssl pkcs12 -export -in my_domain.cer -inkey my.key.key -out my_ipa.p12 -certfile
and install with command:
ipa-server-certinstall -w ipa.soholab.org.p12
In the last almost two years I didn’t have any problem, letsencrypt was renewed and
freeipa was worked. But after last renew sll failed.
In the freeipa gui when I try to access to Authentication tab I get error:
cannot connect to 'https://my_domain:443/ca/rest/certs/search?size=2147483647':
CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727)
I checked SSL in browser and I can see Let’s encrypt changed intermediate from Let’s
encypt Authority X3 to R3.
I found doc on letsencypt where they said about that intermediate changes:
I tried to install new Intermediate with this new R3 on same way as I do that earlier
with old intermediate:
ipa-cacert-manage -n R3 -t C,, install new_intermediate.cer
but without luck.
Maybe someone of you had same probem, or some idea how to solve this?
Thank you in advanced.