https://bugzilla.redhat.com/show_bug.cgi?id=2326918

Ralf Schneider ralf.schneider@ra-s.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Flags|needinfo?(ralf.schneider@ra | |-s.org) | Resolution|--- |NOTABUG Last Closed| |2024-11-18 18:22:08

--- Comment #10 from Ralf Schneider ralf.schneider@ra-s.org --- (In reply to Alexey Tikhonov from comment #9)

And could you please also check if `/usr/share/polkit-1/rules.d/sssd-pcsc.rules` file is present on your system?

(In reply to Alexey Tikhonov from comment #8)

(In reply to Ralf Schneider from comment #0)

...

(2024-11-18 9:35:29): [pam] [child_sig_handler] (0x0100): [CID#16] child [13272] finished successfully. (2024-11-18 9:35:29): [pam] [_read_pipe_handler] (0x0400): [CID#16] EOF received, client finished (2024-11-18 9:35:29): [pam] [parse_p11_child_response] (0x1000): [CID#16] No certificate found.

Could you please attach corresponding part of '/var/log/sss/p11_child.log'?

Hi all thanks a lot for the quick responses and sorry about digging through the wrong logs.

/var/log/sssd/p11_child.log tells

(2024-11-18 17:17:13): [p11_child[11266]] [do_verification] (0x0040): [CID#20] X509_verify_cert failed [0]. (2024-11-18 17:17:13): [p11_child[11266]] [do_verification] (0x0040): [CID#20] X509_verify_cert failed [10][certificate has expired].

So doing an

openssl ca -config ca.cnf -batch -notext -keyfile rootCA.key -in user.csr -days <no_days> -extensions usr_cert -out new_cert.crt pkcs15-init --update-certificate new_cert.crt --auth-id $AUTH_ID --id $ID --format pem

did the trick. Now everything works again as expected. Updating to Fedora 41 at the same time as my user certificate expired was really another prime example of Murphy's Law.

What was indeed confusing was the fact that unlocking LUKS2 with X509 certificate on Nitrokey Storage, which I implemented as per https://vtimofeenko.com/posts/unlocking-luks2-with-x509-certificate-on-nitro..., still worked and is still working even though I have not enrolled the new certificate on the luks device.

Sorry again for all the confusion & thanks a lot for the quick help.