From flo at redhat.com Wed Oct 24 07:00:57 2018
Content-Type: multipart/mixed; boundary="===============3992596281233548502=="
MIME-Version: 1.0
From: Florence Blanc-Renaud <flo at redhat.com>
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: ipa.service "fails" to start
Date: Wed, 24 Oct 2018 09:00:32 +0200
Message-ID: <75952b4b-1fac-8323-fa99-322a6840e3b1@redhat.com>
In-Reply-To: 20181023032445.4736.42218@mailman01.phx2.fedoraproject.org

--===============3992596281233548502==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

On 10/23/18 5:24 AM, None via FreeIPA-users wrote:
> Hi Flo, the journalctl reports that request is rejected, error 2.
> =

>   dogtag-ipa-ca-renew-agent-submit[29544]: Forwarding request to dogtag-i=
pa-renew-agent
>   dogtag-ipa-renew-agent-submit[29558]: GET http://ca-ldap01.:8080/ca/ee/=
ca/profileSubmit?profil
>   dogtag-ipa-renew-agent-submit[29558]: <html><head><title>Apache Tomcat/=
7.0.69 - Error report</title><style>
>   dogtag-ipa-ca-renew-agent-submit[29544]: dogtag-ipa-renew-agent returne=
d 2
> =


Hi,

PKI debug log may contain more information explaining why the request =

was rejected (/var/log/pki/pki-tomcat/ca/debug). You can also increase =

the debug level to get more information: edit (or create) =

/etc/ipa/server.conf and add the following:
[global]
debug=3DTrue

Then modify the certmonger helper that is used to renew the PKI =

certificates to increase verbosity:
$ getcert modify-ca -c dogtag-ipa-ca-renew-agent -e =

'/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit -vv'

(this simply adds -vv to the command executed by certmonger to renew the =

cert). The helper will log information in /var/log/ipa/renew.log.

HTH,
flo

> I can't find a common date where all the certificates are valid, since ""=
ocspSigningCert cert-pki-ca" is not valid before today.
> =

> # certutil -L -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-=
ca" | egrep "Not Before|After"
>              Not Before: Wed Aug 24 20:49:38 2016
>              Not After : Tue Aug 14 20:49:38 2018
> =

> # certutil -L -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert cert-pki-c=
a" | egrep "Not Before|After"
>              Not Before: Mon Oct 22 20:15:53 2018
>              Not After : Sun Oct 11 20:15:53 2020
> =

> # certutil -L -d /etc/pki/pki-tomcat/alias -n "subsystemCert cert-pki-ca"=
 | egrep "Not Before|After"
>              Not Before: Wed Aug 24 20:49:36 2016
>              Not After : Tue Aug 14 20:49:36 2018
> =

> # certutil -L -d /etc/pki/pki-tomcat/alias -n "caSigningCert cert-pki-ca"=
 | egrep "Not Before|After"
>              Not Before: Mon Oct 22 18:15:48 2018
>              Not After : Fri Oct 22 18:15:48 2038
> =

> # certutil -L -d /etc/httpd/alias -n "ipaCert" | egrep "Not Before|After"
>              Not Before: Wed Aug 24 20:50:00 2016
>              Not After : Tue Aug 14 20:50:00 2018
> =

> # certutil -L -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" |=
 egrep "Not Before|After"
>              Not Before: Wed Jul 18 01:47:45 2018
>              Not After : Tue Jul 07 01:47:45 2020
> =

> =

> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.=
org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users=
(a)lists.fedorahosted.org
>=20

--===============3992596281233548502==--

