[Freeipa-users] Re: Upgrading with GoDaddy SSL cert for https only

There was a previous email about this. I suspect what failed was near the end when it was upgrading the CA. As part of that process it looks at the certificates for LDAP and HTTP. It expects the nicknames in the certificate database to be Server-Cert. However the process of installing a 3rd party cert changes the nickname. The fix is to rename them to Server-Cert, and update the config files that refer to them. Unfortunately certutil’s rename command doesn’t work for the format of certificate database used by ipa, so you have to remove the cert and put it back with the new nickname. Here’s what the process looked like for me: certutil -L -d /etc/httpd/alias -n 'krb1-cert' -a -o ~/krb1.cert certutil -D -d /etc/httpd/alias -n 'krb1-cert' certutil -A -d /etc/httpd/alias -n "Server-Cert" -t u,u,u -i ~/krb1.cert emacs /etc/httpd/conf.d/nss.conf change NSSNickname to Server-Cert certutil -d /etc/dirsrv/slapd-CS-RUTGERS-EDU/ -L -a -n 'CN=krb1.cs.rutgers.edu,OU=SAS,O="Rutgers, The State University of New Jersey",STREET=43 College Avenue,STREET=Room 226A,L=New Brunswick,ST=NJ,postalCode=08901,C=US' -o ~/krb1.cert2 certutil -d /etc/dirsrv/slapd-CS-RUTGERS-EDU/ -D -n 'CN=krb1.cs.rutgers.edu,OU=SAS,O="Rutgers, The State University of New Jersey",STREET=43 College Avenue,STREET=Room 226A,L=New Brunswick,ST=NJ,postalCode=08901,C=US' certutil -A -d /etc/dirsrv/slapd-CS-RUTGERS-EDU/ -n "Server-Cert" -t u,u,u -i ~/krb1.cert2 emacs /etc/dirsrv/slapd-CS-RUTGERS-EDU/dse.ldif change nsSSLPersonalitySSL to Server-Cert Also, if you’re not using the originally generated certs, removing the process that wold update them: getcert list -d /etc/dirsrv/slapd-CS-RUTGERS-EDU -n Server-Cert ; find requestid 20171002175930 in output getcert stop-tracking -i 20171002175930 getcert list -d /etc/httpd/alias/ -n Server-Cert getcert stop-tracking -i 20171002175931 A couple of unexpected things happened during this process, but they are probably specific to my system. I had to fixup permissions in /etc/httpd/alias for some reason.