From luckydogxf at gmail.com Thu Jun 18 01:32:32 2020 Content-Type: multipart/mixed; boundary="===============8774100807775439522==" MIME-Version: 1.0 From: luckydog xf To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: pki-tomcat fails to start after I update CA for dirsrv and httpd. Date: Thu, 18 Jun 2020 09:31:55 +0800 Message-ID: In-Reply-To: 59061a2f-69c0-de16-749e-026c390d277b@redhat.com --===============8774100807775439522== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable The sad thing is that CA is expired on May 30, 2020. My IPA cannot login in. So I used certutil to remove old CAs. Here are steps I used. Unfortunately, I didn't try the step you mentioned. 1. certutil -d /etc/http/alias -D -n Server-Cert certutil -d /etc/http/alias -D -n < Other CAs of Comodo> 2. Do the same thing against /etc/dirsrv/slapd-xxx 3. Add new certs and CAs by: cat server.key server.crt > server.all openssl pkcs12 -export -chain -CAfile ca-bundle.crt -in server.all -out Server-Cert.p12 -name "Server-Cert" pk12util -i Server-Cert.p12 -d /etc/httpd/alias/ -n Server-Cert 4. iptacl restart -f -d shows pki-tomcatd cannot start. --------- Internal Database Error encountered:* Could not connect to LDAP server host wocfreeipa.sap.wingon.hk port 636 *Error netscape.ldap.LDAPException: Unable to create socket: org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8172) *Peer's certificate issuer has been marked as not trusted by the user.* (-1) So what's wrong ? ------------- On Wed, Jun 17, 2020 at 10:34 PM Florence Blanc-Renaud wrote: > On 6/17/20 11:32 AM, luckydog xf via FreeIPA-users wrote: > > Hi, As state in > https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-= CA-Root-Expiring-May-30-2020 > > > > I cannot login in FreeIPA web page. > > > > So I update CA by : > > > > # delete everything except IPA CA of httpd and dirsrv > > > > certutil -d /etc/http/alias -D -n 'xxx' > > > > # ca-bundle.crt is 3 files named USERTrust, .etc. > > > > # server.all is an combination of my certificate signed by Sectigo( > fomerly named Comodo). > > > > openssl pkcs12 -export -chain -CAfile ca-bundle.crt -in server.all > -out Server-Cert.p12 -name "Server-Cert" > > > > # add to httpd and dirsrv. > > > > pk12util -i Server-Cert.p12 -d /etc/httpd/alias/ -n Server-Cert > > > > I restart all services by ipactl restart. But it seems pki-tomcat fails > to startup. > > > > #### log of ipactcl start #### > > > > Starting pki-tomcatd Service > > ipa: DEBUG: Starting external process > > ipa: DEBUG: args=3D/bin/systemctl start pki-tomcatd.target > > ipa: DEBUG: Process finished, return code=3D0 > > ipa: DEBUG: request POST > http://wocfreeipa.sap.wingon.hk:8080/ca/admin/ca/getStatus > > ipa: DEBUG: request body '' > > ipa: DEBUG: response status 500 > > ipa: DEBUG: response headers Server: Apache-Coyote/1.1 > > Content-Type: text/html;charset=3Dutf-8 > > Content-Language: en > > Content-Length: 2208 > > Date: Wed, 17 Jun 2020 09:13:19 GMT > > Connection: close > > > > ipa: DEBUG: response body 'Apache Tomcat/7.0.76 - > Error report