Thanks for the quick response Fraser. I did some more digging based on your suggestions, and I think I have a pretty good handle on whats going on.

We actually have 3 ipa servers, with ipa01 being the CA master. After I created the sub-CA, its keys were added to the /etc/pki/pki-tomcat/alias database on ipa01, but not ipa02 or ipa03.

The ipa client on our host was pointing directly to ipa02, and since the CA wasn't in the database it was throwing the error in my original post. By changing /etc/ipa/default.conf to point at ipa01 (and changing the certificate policy,) I was able to get certmonger to issue the cert I wanted.

So the question now is: Shouldn't the pki-tomcat/aliases database get automatically replicated from the master to the replicas? What configuration is responsible for doing this, and why might it not be working?

Thanks again for your help,

Ben

On Thu, Sep 5, 2019 at 9:22 PM Fraser Tweedale <ftweedal@redhat.com> wrote:

On Thu, Sep 05, 2019 at 09:07:48PM -0000, Ben Rawson via FreeIPA-users wrote:
> I'm having some trouble getting sub-ca signed certificates issued and managed by certmonger. The implementation here [https://www.freeipa.org/page/V4/Sub-CAs] describes how that should work. I see that the -X option can be passed to ipa-getcert to specify the issuer, but every time I create a request with -X specified I get an error.
>
> Steps to reproduce:
> 1. Create a new CA named "Test" through the FreeIPA web UI.
>
> 2. Run the following on a host enrolled in freeIPA:
> ipa-getcert request -k /root/test.key -f /root/test.crt -I "testrequest" -X "Test"
>
> 3. Run ipa-getcert list and receive the an error message:
> Request ID 'test':
> status: CA_REJECTED
> ca-error: Server at https://ipa02.yyy.com/ipa/xml failed request, will retry: 4035 (RPC failed at server. Request failed with status 500: Non-2xx response from CA REST API: 500. ).
> stuck: yes
> key pair storage: type=FILE,location='/root/test.key'
> certificate: type=FILE,location='/root/test.crt'
> CA: IPA
> issuer:
> subject:
> expires: unknown
> pre-save command:
> post-save command:
> track: yes
> auto-renew: yes
>
> Running FreeIPA 4.6.4
>
Hi Ben,

Have a look at the Dogtag debug log under
/var/log/pki/pki-tomcat/ca/, and also the system journal, on host
ipa02.yyy.com. You should see something related to the error above.

What is your topology like? Do you have multiple CA replicas? Are
the sub-CA signing keys present on ipa02, in the Dogtag NSSDB?

# certutil -d /etc/pki/pki-tomcat/alias -L

Cheers,
Fraser