Good afternoon,
I was able to find a date where it's possible to start IPA services successfully
(2022-03-02).
Is it possible to clear IPA from bad certificates?
I see four "QC.LRTECH.CA IPA CA" certificates in:
certutil -L -d /etc/ipa/nssdb
certutil -L -d /etc/httpd/alias
certutil -L -d /etc/dirsrv/slapd-QC-LRTECH-CA/
I can manually delete them with certutil -D -d <path/todb> -n <nickname> and
keep the one I want, but each time I execute ipa-certupdate they come back and root CA
isn't trusted anymore.
# certutil -L -d /etc/ipa/nssdb
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
E=admin(a)lrtech.ca,CN=LR Tech inc. ROOT CA,OU=Intranet,O=LR Tech inc.,L=Levis,ST=QC,C=CA
CT,C,C
QC.LRTECH.CA IPA CA CT,C,C
QC.LRTECH.CA IPA CA CT,C,C
E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA CT,C,C
# certutil -L -d /etc/httpd/alias
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
E=admin(a)lrtech.ca,CN=LR Tech inc. ROOT CA,OU=Intranet,O=LR Tech inc.,L=Levis,ST=QC,C=CA
CT,C,C
QC.LRTECH.CA IPA CA CT,C,C
Signing-Cert u,u,u
QC.LRTECH.CA IPA CA CT,C,C
E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA CT,C,C
Server-Cert u,u,u
ipaCert u,u,u
# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
E=admin(a)lrtech.ca,CN=LR Tech inc. ROOT CA,OU=Intranet,O=LR Tech inc.,L=Levis,ST=QC,C=CA
CT,C,C
caSigningCert cert-pki-ca CTu,Cu,Cu
subsystemCert cert-pki-ca u,u,u
auditSigningCert cert-pki-ca u,u,Pu
caSigningCert cert-pki-ca CTu,Cu,Cu
E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA C,,
Server-Cert cert-pki-ca u,u,u
ocspSigningCert cert-pki-ca u,u,u
# certutil -L -d /etc/dirsrv/slapd-QC-LRTECH-CA/
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
E=admin(a)lrtech.ca,CN=LR Tech inc. ROOT CA,OU=Intranet,O=LR Tech inc.,L=Levis,ST=QC,C=CA
CT,C,C
QC.LRTECH.CA IPA CA CT,C,C
Server-Cert u,u,u
QC.LRTECH.CA IPA CA CT,C,C
E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA CT,C,C
After the cleaning I was able to renew all certificates and they are all MONITORING with a
valid date.
See getcert list output below.
Number of certificates and requests being tracked: 8.
Request ID '20170113205242':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=QC.LRTECH.CA
subject: CN=CA Audit,O=QC.LRTECH.CA
expires: 2024-02-23 05:00:03 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170113205243':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=QC.LRTECH.CA
subject: CN=OCSP Subsystem,O=QC.LRTECH.CA
expires: 2024-02-23 05:00:13 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170113205244':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=QC.LRTECH.CA
subject: CN=CA Subsystem,O=QC.LRTECH.CA
expires: 2024-02-20 05:03:27 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170113205245':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: E=admin(a)lrtech.ca,CN=LR Tech inc. Root CA 2022,OU=Intranet,O=LR Tech
inc.,L=Levis,ST=Quebec,C=CA
subject: CN=Certificate Authority,O=QC.LRTECH.CA
expires: 2027-03-04 14:26:48 UTC
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170113205246':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=QC.LRTECH.CA
subject: CN=IPA RA,O=QC.LRTECH.CA
expires: 2024-02-20 05:03:35 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20170113205247':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=QC.LRTECH.CA
subject: CN=freeipa.qc.lrtech.ca,O=QC.LRTECH.CA
expires: 2024-02-23 05:00:11 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert
cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20170113205302':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-QC-LRTECH-CA',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-QC-LRTECH-CA/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-QC-LRTECH-CA',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=QC.LRTECH.CA
subject: CN=freeipa.qc.lrtech.ca,O=QC.LRTECH.CA
expires: 2024-03-02 05:03:02 UTC
principal name: ldap/freeipa.qc.lrtech.ca(a)QC.LRTECH.CA
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv QC-LRTECH-CA
track: yes
auto-renew: yes
Request ID '20220304195651':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=QC.LRTECH.CA
subject: CN=freeipa.qc.lrtech.ca,O=QC.LRTECH.CA
expires: 2024-03-02 05:02:44 UTC
dns: freeipa.qc.lrtech.ca
principal name: HTTP/freeipa.qc.lrtech.ca(a)QC.LRTECH.CA
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Now I still got some issue with FreeIPA webUI.
Firefox is unable to load the page and gives error SEC_ERROR_REUSED_ISSUER_AND_SERIAL
Chrome allow me to connect but when I try to reach Authentication tab I get IPA Error
4301: CertificateOperationError Certificate operation cannot be completed: Unable to
communicate with CMS (Internal Server Error)
After that I tried to renew my client certificate by doing what Rob said:
Copy /etc/pki/ca-trust/source/ipa.p11-kit from the server to a client
I set time to 2022-03-02
kinit
Run update-ca-trust
Run ipa-certupdate
But the ipa-certupdate command return:
Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor
(2529639122): Generic preauthentication failure
Also I don't see my new root CA in /etc/httpd/nssdb even if the certificate is in
/etc/pki/ca-trust/anchor/
# certutil -L -d /etc/httpd/nssdb
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
LR Tech ROOT CA CT,C,C
Server-Cert u,u,u
QC.LRTECH.CA IPA CA CT,C,C
Eric