8:42 a.m.
Hi,
I've got a problem with certificate expiration. My setup is a CA-ful IPA
installation, ipa-server-4.5.0-22 on a CentOS 7 host.
I've been able to run ipa-cacert-manage renew, setting date in the past,
but server certs (dirsrv and httpd) are not updated.
Is there a way to force update?
Here's my output of "getcert list":
Number of certificates and requests being tracked: 9.
Request ID '20170915095009':
status: MONITORING
stuck: no
key pair storage:
type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: SelfSign
issuer:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-09-15 09:50:10 UTC
principal name:
krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
certificate template/profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
Request ID '20171205091347':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=CA Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:19:44 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091349':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=OCSP Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:18:07 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091350':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=CA Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:19:43 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091351':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2038-01-08 00:16:58 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091352':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:18:14 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20171205091353':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-20 10:02:31 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091357':
status: CA_UNREACHABLE
ca-error: Server at
https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
retry: -504 (libcurl failed to execute the HTTP POST transaction,
explaining: Peer's Certificate has expired.).
stuck: no
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
Certificate
DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-01-08 08:24:22 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
LINUX-UNICLOUDIDATTICA-LOCAL
track: yes
auto-renew: yes
Request ID '20171205091409':
status: CA_UNREACHABLE
ca-error: Server at
https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
retry: -504 (libcurl failed to execute the HTTP POST transaction,
explaining: Peer's Certificate has expired.).
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-01-08 08:33:05 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Thanks in advance,
Giulio
10:26 a.m.
Giulio Casella via FreeIPA-users wrote:
Hi,
I've got a problem with certificate expiration. My setup is a CA-ful IPA
installation, ipa-server-4.5.0-22 on a CentOS 7 host.
I've been able to run ipa-cacert-manage renew, setting date in the past,
but server certs (dirsrv and httpd) are not updated.
ipa-cacert-manage is NOT how you renew server certificates. It is how
you renew the _CA_ certificate which is generally good for 20 years.
You need to stop ntpd, use date to go back when the web server cert is
still valid, then restart certmonger. That generally will do it.
rob
Is there a way to force update?
Here's my output of "getcert list":
Number of certificates and requests being tracked: 9.
Request ID '20170915095009':
status: MONITORING
stuck: no
key pair storage:
type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: SelfSign
issuer:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-09-15 09:50:10 UTC
principal name:
krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
certificate template/profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
Request ID '20171205091347':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=CA Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:19:44 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091349':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=OCSP Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:18:07 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091350':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=CA Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:19:43 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091351':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2038-01-08 00:16:58 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091352':
status: MONITORING
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-21 07:18:14 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20171205091353':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2019-11-20 10:02:31 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20171205091357':
status: CA_UNREACHABLE
ca-error: Server at
https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
retry: -504 (libcurl failed to execute the HTTP POST transaction,
explaining: Peer's Certificate has expired.).
stuck: no
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
Certificate
DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-01-08 08:24:22 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
LINUX-UNICLOUDIDATTICA-LOCAL
track: yes
auto-renew: yes
Request ID '20171205091409':
status: CA_UNREACHABLE
ca-error: Server at
https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
retry: -504 (libcurl failed to execute the HTTP POST transaction,
explaining: Peer's Certificate has expired.).
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
subject:
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
expires: 2018-01-08 08:33:05 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Thanks in advance,
Giulio
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
10:56 a.m.
Il 08/01/2018 17:26, Rob Crittenden ha scritto:
Giulio Casella via FreeIPA-users wrote:
You need to stop ntpd, use date to go back when the web server cert is
still valid, then restart certmonger. That generally will do it.
Hi Rob,
I already tried with date few hours before expiration, with no luck:
certmonger cannot perform cert update.
Queued requests remain in "SUBMITTING" status, I tried to launch
certmonger in foreground (-d 10), here's a snippet of the output:
2018-01-08 01:17:08 [6000] Request9('20171205091409') ends in state
'HAVE_CSR'
2018-01-08 01:17:08 [6000] Stopped Request9('20171205091409').
2018-01-08 01:17:09 [6235] Read value "0" from
"/proc/sys/crypto/fips_enabled".
2018-01-08 01:17:09 [6235] Not attempting to set NSS FIPS mode.
2018-01-08 01:17:09 [6235] Skipping NSS internal slot (NSS Generic
Crypto Services).
2018-01-08 01:17:09 [6235] Found token 'NSS Certificate DB'.
2018-01-08 01:17:09 [6235] Located a certificate with the key's nickname
("Server-Cert").
2018-01-08 01:17:09 [6235] Located its private key.
2018-01-08 01:17:09 [6235] Recovered public key from private key.
2018-01-08 01:17:09 [6235] Key is an RSA key.
2018-01-08 01:17:09 [6235] Key size is 2048.
2018-01-08 01:17:10 [6251] Read value "0" from
"/proc/sys/crypto/fips_enabled".
2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
2018-01-08 01:17:10 [6251] Found token 'NSS Generic Crypto Services'.
2018-01-08 01:17:10 [6251] Token is named "NSS Generic Crypto Services",
not "NSS Certificate DB", skipping.
2018-01-08 01:17:10 [6251] Found token 'NSS Certificate DB'.
2018-01-08 01:17:10 [6251] Located the certificate "Server-Cert".
2018-01-08 01:17:10 [6251] Read value "0" from
"/proc/sys/crypto/fips_enabled".
2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
2018-01-08 01:17:10 [6000] Request9('20171205091409') starts in state
'HAVE_KEYINFO'
2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to state
'NEED_CSR'
2018-01-08 01:17:10 [6000] Will revisit Request9('20171205091409') now.
2018-01-08 01:17:10 [6000] Started Request9('20171205091409').
2018-01-08 01:17:10 [6000] Queuing FD 7 for Read for
0x561b59c82750:0x561b59c98940.
2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to state
'GENERATING_CSR'
2018-01-08 01:17:10 [6000] Will revisit Request9('20171205091409') on
traffic from 27.
2018-01-08 01:17:11 [6263] Read value "0" from
"/proc/sys/crypto/fips_enabled".
2018-01-08 01:17:11 [6263] Not attempting to set NSS FIPS mode.
2018-01-08 01:17:11 [6263] Skipping NSS internal slot (NSS Generic
Crypto Services).
2018-01-08 01:17:11 [6263] Found token 'NSS Certificate DB'.
2018-01-08 01:17:11 [6263] Located a certificate with the key's nickname
("Server-Cert").
2018-01-08 01:17:11 [6263] Located its private key.
2018-01-08 01:17:11 [6263] Recovered public key from private key.
2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
'HAVE_CSR'
2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') now.
2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
'NEED_TO_SUBMIT'
2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') now.
2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
'SUBMITTING'
2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') on
traffic from 31.
^C2018-01-08 01:17:14 [6000] Got signal 2.
2018-01-08 01:17:14 [6000] Shutting down.
I'm stuck...
Thank you for your time.
rob
>
> Is there a way to force update?
>
> Here's my output of "getcert list":
>
>
> Number of certificates and requests being tracked: 9.
> Request ID '20170915095009':
> status: MONITORING
> stuck: no
> key pair storage:
> type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
> CA: SelfSign
> issuer:
> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject:
> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2018-09-15 09:50:10 UTC
> principal name:
> krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
> certificate template/profile: KDCs_PKINIT_Certs
> pre-save command:
> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
> track: yes
> auto-renew: yes
> Request ID '20171205091347':
> status: MONITORING
> stuck: no
> key pair storage:
>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject: CN=CA Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2019-11-21 07:19:44 UTC
> key usage: digitalSignature,nonRepudiation
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> "auditSigningCert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20171205091349':
> status: MONITORING
> stuck: no
> key pair storage:
> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
> Certificate DB',pin set
> certificate:
> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS
> Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject: CN=OCSP Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2019-11-21 07:18:07 UTC
> eku: id-kp-OCSPSigning
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> "ocspSigningCert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20171205091350':
> status: MONITORING
> stuck: no
> key pair storage:
> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject: CN=CA Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2019-11-21 07:19:43 UTC
> key usage:
> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> "subsystemCert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20171205091351':
> status: MONITORING
> stuck: no
> key pair storage:
> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2038-01-08 00:16:58 UTC
> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> "caSigningCert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20171205091352':
> status: MONITORING
> stuck: no
> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2019-11-21 07:18:14 UTC
> key usage:
> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
> track: yes
> auto-renew: yes
> Request ID '20171205091353':
> status: MONITORING
> stuck: no
> key pair storage:
> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> cert-pki-ca',token='NSS Certificate DB',pin set
> certificate:
> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> cert-pki-ca',token='NSS Certificate DB'
> CA: dogtag-ipa-ca-renew-agent
> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject:
> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2019-11-20 10:02:31 UTC
> key usage:
> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> "Server-Cert cert-pki-ca"
> track: yes
> auto-renew: yes
> Request ID '20171205091357':
> status: CA_UNREACHABLE
> ca-error: Server at
> https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
> retry: -504 (libcurl failed to execute the HTTP POST transaction,
> explaining: Peer's Certificate has expired.).
> stuck: no
> key pair storage:
>
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
> Certificate
> DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
> certificate:
>
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
> Certificate DB'
> CA: IPA
> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject:
> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2018-01-08 08:24:22 UTC
> key usage:
> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command:
> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
> LINUX-UNICLOUDIDATTICA-LOCAL
> track: yes
> auto-renew: yes
> Request ID '20171205091409':
> status: CA_UNREACHABLE
> ca-error: Server at
> https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
> retry: -504 (libcurl failed to execute the HTTP POST transaction,
> explaining: Peer's Certificate has expired.).
> stuck: no
> key pair storage:
>
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> certificate:
>
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
> Certificate DB'
> CA: IPA
> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> subject:
> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> expires: 2018-01-08 08:33:05 UTC
> key usage:
> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> eku: id-kp-serverAuth,id-kp-clientAuth
> pre-save command:
> post-save command: /usr/libexec/ipa/certmonger/restart_httpd
> track: yes
> auto-renew: yes
>
>
> Thanks in advance,
> Giulio
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
--
Giulio Casella giulio at di.unimi.it
System and network architect
Computer Science Dept. - University of Milano
3:15 p.m.
After some time, requests go "CA_UNREACHABLE", caused by "RPC failed at
server. Request failed with status 500: Non-2xx response from CA REST
API: 500." when certmonger tries to renew httpd/dirsrv certificate.
Any ideas to correctly debug this issue?
Il 08/01/2018 17:56, Giulio Casella via FreeIPA-users ha scritto:
>
>
> Il 08/01/2018 17:26, Rob Crittenden ha scritto:
>> Giulio Casella via FreeIPA-users wrote:
>>
>> You need to stop ntpd, use date to go back when the web server cert is
>> still valid, then restart certmonger. That generally will do it.
>
> Hi Rob,
> I already tried with date few hours before expiration, with no luck:
> certmonger cannot perform cert update.
>
> Queued requests remain in "SUBMITTING" status, I tried to launch
> certmonger in foreground (-d 10), here's a snippet of the output:
>
> 2018-01-08 01:17:08 [6000] Request9('20171205091409') ends in state
> 'HAVE_CSR'
> 2018-01-08 01:17:08 [6000] Stopped Request9('20171205091409').
> 2018-01-08 01:17:09 [6235] Read value "0" from
> "/proc/sys/crypto/fips_enabled".
> 2018-01-08 01:17:09 [6235] Not attempting to set NSS FIPS mode.
> 2018-01-08 01:17:09 [6235] Skipping NSS internal slot (NSS Generic
> Crypto Services).
> 2018-01-08 01:17:09 [6235] Found token 'NSS Certificate DB'.
> 2018-01-08 01:17:09 [6235] Located a certificate with the key's nickname
> ("Server-Cert").
> 2018-01-08 01:17:09 [6235] Located its private key.
> 2018-01-08 01:17:09 [6235] Recovered public key from private key.
> 2018-01-08 01:17:09 [6235] Key is an RSA key.
> 2018-01-08 01:17:09 [6235] Key size is 2048.
> 2018-01-08 01:17:10 [6251] Read value "0" from
> "/proc/sys/crypto/fips_enabled".
> 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
> 2018-01-08 01:17:10 [6251] Found token 'NSS Generic Crypto Services'.
> 2018-01-08 01:17:10 [6251] Token is named "NSS Generic Crypto Services",
> not "NSS Certificate DB", skipping.
> 2018-01-08 01:17:10 [6251] Found token 'NSS Certificate DB'.
> 2018-01-08 01:17:10 [6251] Located the certificate "Server-Cert".
> 2018-01-08 01:17:10 [6251] Read value "0" from
> "/proc/sys/crypto/fips_enabled".
> 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
> 2018-01-08 01:17:10 [6000] Request9('20171205091409') starts in state
> 'HAVE_KEYINFO'
> 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to state
> 'NEED_CSR'
> 2018-01-08 01:17:10 [6000] Will revisit Request9('20171205091409') now.
> 2018-01-08 01:17:10 [6000] Started Request9('20171205091409').
> 2018-01-08 01:17:10 [6000] Queuing FD 7 for Read for
> 0x561b59c82750:0x561b59c98940.
> 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to state
> 'GENERATING_CSR'
> 2018-01-08 01:17:10 [6000] Will revisit Request9('20171205091409') on
> traffic from 27.
> 2018-01-08 01:17:11 [6263] Read value "0" from
> "/proc/sys/crypto/fips_enabled".
> 2018-01-08 01:17:11 [6263] Not attempting to set NSS FIPS mode.
> 2018-01-08 01:17:11 [6263] Skipping NSS internal slot (NSS Generic
> Crypto Services).
> 2018-01-08 01:17:11 [6263] Found token 'NSS Certificate DB'.
> 2018-01-08 01:17:11 [6263] Located a certificate with the key's nickname
> ("Server-Cert").
> 2018-01-08 01:17:11 [6263] Located its private key.
> 2018-01-08 01:17:11 [6263] Recovered public key from private key.
> 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
> 'HAVE_CSR'
> 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') now.
> 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
> 'NEED_TO_SUBMIT'
> 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') now.
> 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
> 'SUBMITTING'
> 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') on
> traffic from 31.
> ^C2018-01-08 01:17:14 [6000] Got signal 2.
> 2018-01-08 01:17:14 [6000] Shutting down.
>
> I'm stuck...
>
> Thank you for your time.
>
>>
>> rob
>>
>>>
>>> Is there a way to force update?
>>>
>>> Here's my output of "getcert list":
>>>
>>>
>>> Number of certificates and requests being tracked: 9.
>>> Request ID '20170915095009':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage:
>>> type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
>>> certificate:
type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
>>> CA: SelfSign
>>> issuer:
>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject:
>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2018-09-15 09:50:10 UTC
>>> principal name:
>>> krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
>>> certificate template/profile: KDCs_PKINIT_Certs
>>> pre-save command:
>>> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20171205091347':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
>>>
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
>>>
>>> cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject: CN=CA Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2019-11-21 07:19:44 UTC
>>> key usage: digitalSignature,nonRepudiation
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>> "auditSigningCert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20171205091349':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
>>> cert-pki-ca',token='NSS
>>> Certificate DB',pin set
>>> certificate:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
>>> cert-pki-ca',token='NSS
>>> Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject: CN=OCSP Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2019-11-21 07:18:07 UTC
>>> eku: id-kp-OCSPSigning
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>> "ocspSigningCert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20171205091350':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
>>> cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject: CN=CA Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2019-11-21 07:19:43 UTC
>>> key usage:
>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>> "subsystemCert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20171205091351':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
>>> cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject: CN=Certificate
>>> Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2038-01-08 00:16:58 UTC
>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>> "caSigningCert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20171205091352':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage:
>>> type=FILE,location='/var/lib/ipa/ra-agent.key'
>>> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2019-11-21 07:18:14 UTC
>>> key usage:
>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20171205091353':
>>> status: MONITORING
>>> stuck: no
>>> key pair storage:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>> certificate:
>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
>>> cert-pki-ca',token='NSS Certificate DB'
>>> CA: dogtag-ipa-ca-renew-agent
>>> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject:
>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2019-11-20 10:02:31 UTC
>>> key usage:
>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>> "Server-Cert cert-pki-ca"
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20171205091357':
>>> status: CA_UNREACHABLE
>>> ca-error: Server at
>>> https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
>>> retry: -504 (libcurl failed to execute the HTTP POST transaction,
>>> explaining: Peer's Certificate has expired.).
>>> stuck: no
>>> key pair storage:
>>>
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
>>>
>>> Certificate
>>>
DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
>>> certificate:
>>>
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
>>>
>>> Certificate DB'
>>> CA: IPA
>>> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject:
>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2018-01-08 08:24:22 UTC
>>> key usage:
>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command:
>>> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
>>> LINUX-UNICLOUDIDATTICA-LOCAL
>>> track: yes
>>> auto-renew: yes
>>> Request ID '20171205091409':
>>> status: CA_UNREACHABLE
>>> ca-error: Server at
>>> https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
>>> retry: -504 (libcurl failed to execute the HTTP POST transaction,
>>> explaining: Peer's Certificate has expired.).
>>> stuck: no
>>> key pair storage:
>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
>>> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>> certificate:
>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
>>> Certificate DB'
>>> CA: IPA
>>> issuer: CN=Certificate Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> subject:
>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>> expires: 2018-01-08 08:33:05 UTC
>>> key usage:
>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>> pre-save command:
>>> post-save command: /usr/libexec/ipa/certmonger/restart_httpd
>>> track: yes
>>> auto-renew: yes
>>>
>>>
>>> Thanks in advance,
>>> Giulio
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to
>>> freeipa-users-leave(a)lists.fedorahosted.org
>>
>
12:44 a.m.
On Mon, Jan 08, 2018 at 10:15:29PM +0100, Giulio Casella via FreeIPA-users wrote:
After some time, requests go "CA_UNREACHABLE", caused by
"RPC failed at
server. Request failed with status 500: Non-2xx response from CA REST API:
500." when certmonger tries to renew httpd/dirsrv certificate.
Any ideas to correctly debug this issue?
Here are some things to check:
What is the validity of /var/lib/ipa/ra-agent.pem at the time you
set the clock back to? Is it possible that you have gone earlier
than its `notBefore' time?
Is that certificate in sync with the userCertificate attribute of
the `uid=ipara,ou=people,o=ipaca' LDAP entry?
What does the /var/log/pki/pki-tomcat/ca/debug log contain?
Cheers,
Fraser
>
>
> Il 08/01/2018 17:56, Giulio Casella via FreeIPA-users ha scritto:
> >
> >
> > Il 08/01/2018 17:26, Rob Crittenden ha scritto:
> > > Giulio Casella via FreeIPA-users wrote:
> > >
> > > You need to stop ntpd, use date to go back when the web server cert is
> > > still valid, then restart certmonger. That generally will do it.
> >
> > Hi Rob,
> > I already tried with date few hours before expiration, with no luck:
> > certmonger cannot perform cert update.
> >
> > Queued requests remain in "SUBMITTING" status, I tried to launch
> > certmonger in foreground (-d 10), here's a snippet of the output:
> >
> > 2018-01-08 01:17:08 [6000] Request9('20171205091409') ends in state
> > 'HAVE_CSR'
> > 2018-01-08 01:17:08 [6000] Stopped Request9('20171205091409').
> > 2018-01-08 01:17:09 [6235] Read value "0" from
> > "/proc/sys/crypto/fips_enabled".
> > 2018-01-08 01:17:09 [6235] Not attempting to set NSS FIPS mode.
> > 2018-01-08 01:17:09 [6235] Skipping NSS internal slot (NSS Generic
> > Crypto Services).
> > 2018-01-08 01:17:09 [6235] Found token 'NSS Certificate DB'.
> > 2018-01-08 01:17:09 [6235] Located a certificate with the key's nickname
> > ("Server-Cert").
> > 2018-01-08 01:17:09 [6235] Located its private key.
> > 2018-01-08 01:17:09 [6235] Recovered public key from private key.
> > 2018-01-08 01:17:09 [6235] Key is an RSA key.
> > 2018-01-08 01:17:09 [6235] Key size is 2048.
> > 2018-01-08 01:17:10 [6251] Read value "0" from
> > "/proc/sys/crypto/fips_enabled".
> > 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
> > 2018-01-08 01:17:10 [6251] Found token 'NSS Generic Crypto Services'.
> > 2018-01-08 01:17:10 [6251] Token is named "NSS Generic Crypto
Services",
> > not "NSS Certificate DB", skipping.
> > 2018-01-08 01:17:10 [6251] Found token 'NSS Certificate DB'.
> > 2018-01-08 01:17:10 [6251] Located the certificate "Server-Cert".
> > 2018-01-08 01:17:10 [6251] Read value "0" from
> > "/proc/sys/crypto/fips_enabled".
> > 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
> > 2018-01-08 01:17:10 [6000] Request9('20171205091409') starts in state
> > 'HAVE_KEYINFO'
> > 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to state
> > 'NEED_CSR'
> > 2018-01-08 01:17:10 [6000] Will revisit Request9('20171205091409') now.
> > 2018-01-08 01:17:10 [6000] Started Request9('20171205091409').
> > 2018-01-08 01:17:10 [6000] Queuing FD 7 for Read for
> > 0x561b59c82750:0x561b59c98940.
> > 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to state
> > 'GENERATING_CSR'
> > 2018-01-08 01:17:10 [6000] Will revisit Request9('20171205091409') on
> > traffic from 27.
> > 2018-01-08 01:17:11 [6263] Read value "0" from
> > "/proc/sys/crypto/fips_enabled".
> > 2018-01-08 01:17:11 [6263] Not attempting to set NSS FIPS mode.
> > 2018-01-08 01:17:11 [6263] Skipping NSS internal slot (NSS Generic
> > Crypto Services).
> > 2018-01-08 01:17:11 [6263] Found token 'NSS Certificate DB'.
> > 2018-01-08 01:17:11 [6263] Located a certificate with the key's nickname
> > ("Server-Cert").
> > 2018-01-08 01:17:11 [6263] Located its private key.
> > 2018-01-08 01:17:11 [6263] Recovered public key from private key.
> > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
> > 'HAVE_CSR'
> > 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') now.
> > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
> > 'NEED_TO_SUBMIT'
> > 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') now.
> > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
> > 'SUBMITTING'
> > 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') on
> > traffic from 31.
> > ^C2018-01-08 01:17:14 [6000] Got signal 2.
> > 2018-01-08 01:17:14 [6000] Shutting down.
> >
> > I'm stuck...
> >
> > Thank you for your time.
> >
> > >
> > > rob
> > >
> > > >
> > > > Is there a way to force update?
> > > >
> > > > Here's my output of "getcert list":
> > > >
> > > >
> > > > Number of certificates and requests being tracked: 9.
> > > > Request ID '20170915095009':
> > > > status: MONITORING
> > > > stuck: no
> > > > key pair storage:
> > > > type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
> > > > certificate:
type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
> > > > CA: SelfSign
> > > > issuer:
> > > > CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject:
> > > > CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2018-09-15 09:50:10 UTC
> > > > principal name:
> > > > krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
> > > > certificate template/profile: KDCs_PKINIT_Certs
> > > > pre-save command:
> > > > post-save command:
/usr/libexec/ipa/certmonger/renew_kdc_cert
> > > > track: yes
> > > > auto-renew: yes
> > > > Request ID '20171205091347':
> > > > status: MONITORING
> > > > stuck: no
> > > > key pair storage:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> > > >
> > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > certificate:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> > > >
> > > > cert-pki-ca',token='NSS Certificate DB'
> > > > CA: dogtag-ipa-ca-renew-agent
> > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject: CN=CA Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2019-11-21 07:19:44 UTC
> > > > key usage: digitalSignature,nonRepudiation
> > > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> > > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> > > > "auditSigningCert cert-pki-ca"
> > > > track: yes
> > > > auto-renew: yes
> > > > Request ID '20171205091349':
> > > > status: MONITORING
> > > > stuck: no
> > > > key pair storage:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> > > > cert-pki-ca',token='NSS
> > > > Certificate DB',pin set
> > > > certificate:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> > > > cert-pki-ca',token='NSS
> > > > Certificate DB'
> > > > CA: dogtag-ipa-ca-renew-agent
> > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject: CN=OCSP Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2019-11-21 07:18:07 UTC
> > > > eku: id-kp-OCSPSigning
> > > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> > > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> > > > "ocspSigningCert cert-pki-ca"
> > > > track: yes
> > > > auto-renew: yes
> > > > Request ID '20171205091350':
> > > > status: MONITORING
> > > > stuck: no
> > > > key pair storage:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > certificate:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> > > > cert-pki-ca',token='NSS Certificate DB'
> > > > CA: dogtag-ipa-ca-renew-agent
> > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject: CN=CA Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2019-11-21 07:19:43 UTC
> > > > key usage:
> > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> > > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> > > > "subsystemCert cert-pki-ca"
> > > > track: yes
> > > > auto-renew: yes
> > > > Request ID '20171205091351':
> > > > status: MONITORING
> > > > stuck: no
> > > > key pair storage:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > certificate:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> > > > cert-pki-ca',token='NSS Certificate DB'
> > > > CA: dogtag-ipa-ca-renew-agent
> > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject: CN=Certificate
> > > > Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2038-01-08 00:16:58 UTC
> > > > key usage:
digitalSignature,nonRepudiation,keyCertSign,cRLSign
> > > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> > > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> > > > "caSigningCert cert-pki-ca"
> > > > track: yes
> > > > auto-renew: yes
> > > > Request ID '20171205091352':
> > > > status: MONITORING
> > > > stuck: no
> > > > key pair storage:
> > > > type=FILE,location='/var/lib/ipa/ra-agent.key'
> > > > certificate:
type=FILE,location='/var/lib/ipa/ra-agent.pem'
> > > > CA: dogtag-ipa-ca-renew-agent
> > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2019-11-21 07:18:14 UTC
> > > > key usage:
> > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > pre-save command:
/usr/libexec/ipa/certmonger/renew_ra_cert_pre
> > > > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
> > > > track: yes
> > > > auto-renew: yes
> > > > Request ID '20171205091353':
> > > > status: MONITORING
> > > > stuck: no
> > > > key pair storage:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > certificate:
> > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> > > > cert-pki-ca',token='NSS Certificate DB'
> > > > CA: dogtag-ipa-ca-renew-agent
> > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject:
> > > > CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2019-11-20 10:02:31 UTC
> > > > key usage:
> > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
> > > > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
> > > > "Server-Cert cert-pki-ca"
> > > > track: yes
> > > > auto-renew: yes
> > > > Request ID '20171205091357':
> > > > status: CA_UNREACHABLE
> > > > ca-error: Server at
> > > > https://idc01.linux.unicloudidattica.local/ipa/xml failed request,
will
> > > > retry: -504 (libcurl failed to execute the HTTP POST transaction,
> > > > explaining: Peer's Certificate has expired.).
> > > > stuck: no
> > > > key pair storage:
> > > >
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
> > > >
> > > > Certificate
> > > >
DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
> > > > certificate:
> > > >
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
> > > >
> > > > Certificate DB'
> > > > CA: IPA
> > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject:
> > > > CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2018-01-08 08:24:22 UTC
> > > > key usage:
> > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > pre-save command:
> > > > post-save command:
/usr/libexec/ipa/certmonger/restart_dirsrv
> > > > LINUX-UNICLOUDIDATTICA-LOCAL
> > > > track: yes
> > > > auto-renew: yes
> > > > Request ID '20171205091409':
> > > > status: CA_UNREACHABLE
> > > > ca-error: Server at
> > > > https://idc01.linux.unicloudidattica.local/ipa/xml failed request,
will
> > > > retry: -504 (libcurl failed to execute the HTTP POST transaction,
> > > > explaining: Peer's Certificate has expired.).
> > > > stuck: no
> > > > key pair storage:
> > > >
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
> > > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> > > > certificate:
> > > >
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
> > > > Certificate DB'
> > > > CA: IPA
> > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > subject:
> > > > CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > expires: 2018-01-08 08:33:05 UTC
> > > > key usage:
> > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > pre-save command:
> > > > post-save command: /usr/libexec/ipa/certmonger/restart_httpd
> > > > track: yes
> > > > auto-renew: yes
> > > >
> > > >
> > > > Thanks in advance,
> > > > Giulio
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > > To unsubscribe send an email to
> > > > freeipa-users-leave(a)lists.fedorahosted.org
> > >
> >
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
3:40 a.m.
Hi Fraser,
Il 09/01/2018 07:44, Fraser Tweedale via FreeIPA-users ha scritto:
On Mon, Jan 08, 2018 at 10:15:29PM +0100, Giulio Casella via
FreeIPA-users wrote:
> After some time, requests go "CA_UNREACHABLE", caused by "RPC failed
at
> server. Request failed with status 500: Non-2xx response from CA REST API:
> 500." when certmonger tries to renew httpd/dirsrv certificate.
>
> Any ideas to correctly debug this issue?
>
Here are some things to check:
What is the validity of /var/lib/ipa/ra-agent.pem at the time you
set the clock back to? Is it possible that you have gone earlier
than its `notBefore' time?
I've set date between "Not Before" and "Not After" of
/var/lib/ipa/ra-agent.pem
Is that certificate in sync with the userCertificate attribute of
the `uid=ipara,ou=people,o=ipaca' LDAP entry?
I don't have that entry in ldap; I tried to find in ldap a
"userCertificate" with subject " O=MY.DOM.AIN, CN=IPA RA" (the same of
/var/lib/ipa/ra-agent.pem).
Its distinguished name is
"dn: cn=ipaCert,cn=ca_renewal,cn=ipa,cn=etc,dc=my,dc=dom,dc=ain"
and is indeed different from cert /var/lib/ipa/ra-agent.pem (the one in
ldap is newer).
Do you think I can try to substitute the entry in ldap with the cert
from /var/lib/ipa/ra-agent.pem?
What does the /var/log/pki/pki-tomcat/ca/debug log contain?
After a few digging I've seen nothing relevant...
Cheers,
Fraser
>
>
> Il 08/01/2018 17:56, Giulio Casella via FreeIPA-users ha scritto:
>>
>>
>> Il 08/01/2018 17:26, Rob Crittenden ha scritto:
>>> Giulio Casella via FreeIPA-users wrote:
>>>
>>> You need to stop ntpd, use date to go back when the web server cert is
>>> still valid, then restart certmonger. That generally will do it.
>>
>> Hi Rob,
>> I already tried with date few hours before expiration, with no luck:
>> certmonger cannot perform cert update.
>>
>> Queued requests remain in "SUBMITTING" status, I tried to launch
>> certmonger in foreground (-d 10), here's a snippet of the output:
>>
>> 2018-01-08 01:17:08 [6000] Request9('20171205091409') ends in state
>> 'HAVE_CSR'
>> 2018-01-08 01:17:08 [6000] Stopped Request9('20171205091409').
>> 2018-01-08 01:17:09 [6235] Read value "0" from
>> "/proc/sys/crypto/fips_enabled".
>> 2018-01-08 01:17:09 [6235] Not attempting to set NSS FIPS mode.
>> 2018-01-08 01:17:09 [6235] Skipping NSS internal slot (NSS Generic
>> Crypto Services).
>> 2018-01-08 01:17:09 [6235] Found token 'NSS Certificate DB'.
>> 2018-01-08 01:17:09 [6235] Located a certificate with the key's nickname
>> ("Server-Cert").
>> 2018-01-08 01:17:09 [6235] Located its private key.
>> 2018-01-08 01:17:09 [6235] Recovered public key from private key.
>> 2018-01-08 01:17:09 [6235] Key is an RSA key.
>> 2018-01-08 01:17:09 [6235] Key size is 2048.
>> 2018-01-08 01:17:10 [6251] Read value "0" from
>> "/proc/sys/crypto/fips_enabled".
>> 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
>> 2018-01-08 01:17:10 [6251] Found token 'NSS Generic Crypto Services'.
>> 2018-01-08 01:17:10 [6251] Token is named "NSS Generic Crypto
Services",
>> not "NSS Certificate DB", skipping.
>> 2018-01-08 01:17:10 [6251] Found token 'NSS Certificate DB'.
>> 2018-01-08 01:17:10 [6251] Located the certificate "Server-Cert".
>> 2018-01-08 01:17:10 [6251] Read value "0" from
>> "/proc/sys/crypto/fips_enabled".
>> 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
>> 2018-01-08 01:17:10 [6000] Request9('20171205091409') starts in state
>> 'HAVE_KEYINFO'
>> 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to state
>> 'NEED_CSR'
>> 2018-01-08 01:17:10 [6000] Will revisit Request9('20171205091409') now.
>> 2018-01-08 01:17:10 [6000] Started Request9('20171205091409').
>> 2018-01-08 01:17:10 [6000] Queuing FD 7 for Read for
>> 0x561b59c82750:0x561b59c98940.
>> 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to state
>> 'GENERATING_CSR'
>> 2018-01-08 01:17:10 [6000] Will revisit Request9('20171205091409') on
>> traffic from 27.
>> 2018-01-08 01:17:11 [6263] Read value "0" from
>> "/proc/sys/crypto/fips_enabled".
>> 2018-01-08 01:17:11 [6263] Not attempting to set NSS FIPS mode.
>> 2018-01-08 01:17:11 [6263] Skipping NSS internal slot (NSS Generic
>> Crypto Services).
>> 2018-01-08 01:17:11 [6263] Found token 'NSS Certificate DB'.
>> 2018-01-08 01:17:11 [6263] Located a certificate with the key's nickname
>> ("Server-Cert").
>> 2018-01-08 01:17:11 [6263] Located its private key.
>> 2018-01-08 01:17:11 [6263] Recovered public key from private key.
>> 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
>> 'HAVE_CSR'
>> 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') now.
>> 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
>> 'NEED_TO_SUBMIT'
>> 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') now.
>> 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to state
>> 'SUBMITTING'
>> 2018-01-08 01:17:11 [6000] Will revisit Request9('20171205091409') on
>> traffic from 31.
>> ^C2018-01-08 01:17:14 [6000] Got signal 2.
>> 2018-01-08 01:17:14 [6000] Shutting down.
>>
>> I'm stuck...
>>
>> Thank you for your time.
>>
>>>
>>> rob
>>>
>>>>
>>>> Is there a way to force update?
>>>>
>>>> Here's my output of "getcert list":
>>>>
>>>>
>>>> Number of certificates and requests being tracked: 9.
>>>> Request ID '20170915095009':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage:
>>>> type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
>>>> certificate:
type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
>>>> CA: SelfSign
>>>> issuer:
>>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject:
>>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2018-09-15 09:50:10 UTC
>>>> principal name:
>>>> krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
>>>> certificate template/profile: KDCs_PKINIT_Certs
>>>> pre-save command:
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20171205091347':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
>>>>
>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
>>>>
>>>> cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject: CN=CA Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2019-11-21 07:19:44 UTC
>>>> key usage: digitalSignature,nonRepudiation
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>>> "auditSigningCert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20171205091349':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
>>>> cert-pki-ca',token='NSS
>>>> Certificate DB',pin set
>>>> certificate:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
>>>> cert-pki-ca',token='NSS
>>>> Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject: CN=OCSP Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2019-11-21 07:18:07 UTC
>>>> eku: id-kp-OCSPSigning
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>>> "ocspSigningCert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20171205091350':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
>>>> cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject: CN=CA Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2019-11-21 07:19:43 UTC
>>>> key usage:
>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>>> "subsystemCert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20171205091351':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
>>>> cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject: CN=Certificate
>>>> Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2038-01-08 00:16:58 UTC
>>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>>> "caSigningCert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20171205091352':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage:
>>>> type=FILE,location='/var/lib/ipa/ra-agent.key'
>>>> certificate:
type=FILE,location='/var/lib/ipa/ra-agent.pem'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2019-11-21 07:18:14 UTC
>>>> key usage:
>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command:
/usr/libexec/ipa/certmonger/renew_ra_cert_pre
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20171205091353':
>>>> status: MONITORING
>>>> stuck: no
>>>> key pair storage:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
>>>> cert-pki-ca',token='NSS Certificate DB',pin set
>>>> certificate:
>>>>
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
>>>> cert-pki-ca',token='NSS Certificate DB'
>>>> CA: dogtag-ipa-ca-renew-agent
>>>> issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject:
>>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2019-11-20 10:02:31 UTC
>>>> key usage:
>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
>>>> "Server-Cert cert-pki-ca"
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20171205091357':
>>>> status: CA_UNREACHABLE
>>>> ca-error: Server at
>>>> https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
>>>> retry: -504 (libcurl failed to execute the HTTP POST transaction,
>>>> explaining: Peer's Certificate has expired.).
>>>> stuck: no
>>>> key pair storage:
>>>>
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
>>>>
>>>> Certificate
>>>>
DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
>>>> certificate:
>>>>
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
>>>>
>>>> Certificate DB'
>>>> CA: IPA
>>>> issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject:
>>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2018-01-08 08:24:22 UTC
>>>> key usage:
>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command:
>>>> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
>>>> LINUX-UNICLOUDIDATTICA-LOCAL
>>>> track: yes
>>>> auto-renew: yes
>>>> Request ID '20171205091409':
>>>> status: CA_UNREACHABLE
>>>> ca-error: Server at
>>>> https://idc01.linux.unicloudidattica.local/ipa/xml failed request, will
>>>> retry: -504 (libcurl failed to execute the HTTP POST transaction,
>>>> explaining: Peer's Certificate has expired.).
>>>> stuck: no
>>>> key pair storage:
>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
>>>> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>>>> certificate:
>>>>
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
>>>> Certificate DB'
>>>> CA: IPA
>>>> issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> subject:
>>>> CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
>>>> expires: 2018-01-08 08:33:05 UTC
>>>> key usage:
>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>>>> eku: id-kp-serverAuth,id-kp-clientAuth
>>>> pre-save command:
>>>> post-save command: /usr/libexec/ipa/certmonger/restart_httpd
>>>> track: yes
>>>> auto-renew: yes
>>>>
>>>>
>>>> Thanks in advance,
>>>> Giulio
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email to
>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>
>>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
--
Giulio Casella giulio at di.unimi.it
System and network architect
Computer Science Dept. - University of Milano
6:15 a.m.
On Tue, Jan 09, 2018 at 10:40:32AM +0100, Giulio Casella via FreeIPA-users wrote:
Hi Fraser,
Il 09/01/2018 07:44, Fraser Tweedale via FreeIPA-users ha scritto:
> On Mon, Jan 08, 2018 at 10:15:29PM +0100, Giulio Casella via FreeIPA-users wrote:
> > After some time, requests go "CA_UNREACHABLE", caused by "RPC
failed at
> > server. Request failed with status 500: Non-2xx response from CA REST API:
> > 500." when certmonger tries to renew httpd/dirsrv certificate.
> >
> > Any ideas to correctly debug this issue?
> >
> Here are some things to check:
>
> What is the validity of /var/lib/ipa/ra-agent.pem at the time you
> set the clock back to? Is it possible that you have gone earlier
> than its `notBefore' time?
I've set date between "Not Before" and "Not After" of
/var/lib/ipa/ra-agent.pem
>
> Is that certificate in sync with the userCertificate attribute of
> the `uid=ipara,ou=people,o=ipaca' LDAP entry?
I don't have that entry in ldap; I tried to find in ldap a
"userCertificate"
with subject " O=MY.DOM.AIN, CN=IPA RA" (the same of
/var/lib/ipa/ra-agent.pem).
Its distinguished name is
"dn: cn=ipaCert,cn=ca_renewal,cn=ipa,cn=etc,dc=my,dc=dom,dc=ain"
and is indeed different from cert /var/lib/ipa/ra-agent.pem (the one in ldap
is newer).
You are looking for an entry in the Dogtag CA DIT (base DN `o=ipaca'),
not the FreeIPA DIT. You should check on a CA replica.
Do you think I can try to substitute the entry in ldap with the cert
from
/var/lib/ipa/ra-agent.pem?
We really need to check what the userCertificate attribute of
`uid=ipara,ou=people,o=ipaca' is, and whether it matches
ra-agent.pem (and if not, how it differs). The entry should
certainly exist in the Dogtag DIT, on CA replicas.
Knowing that will help decide the way forward.
>
> What does the /var/log/pki/pki-tomcat/ca/debug log contain?
After a few digging I've seen nothing relevant...
OK. If it is an authentication error you won't necessary see a lot
- from Dogtag's point of view is is not actually an error. It would
get logged but not prominenty.
> >
> > Cheers,
> > Fraser
> >
> >
> > >
> > >
> > > Il 08/01/2018 17:56, Giulio Casella via FreeIPA-users ha scritto:
> > > >
> > > >
> > > > Il 08/01/2018 17:26, Rob Crittenden ha scritto:
> > > > > Giulio Casella via FreeIPA-users wrote:
> > > > >
> > > > > You need to stop ntpd, use date to go back when the web server
cert is
> > > > > still valid, then restart certmonger. That generally will do it.
> > > >
> > > > Hi Rob,
> > > > I already tried with date few hours before expiration, with no luck:
> > > > certmonger cannot perform cert update.
> > > >
> > > > Queued requests remain in "SUBMITTING" status, I tried to
launch
> > > > certmonger in foreground (-d 10), here's a snippet of the output:
> > > >
> > > > 2018-01-08 01:17:08 [6000] Request9('20171205091409') ends in
state
> > > > 'HAVE_CSR'
> > > > 2018-01-08 01:17:08 [6000] Stopped
Request9('20171205091409').
> > > > 2018-01-08 01:17:09 [6235] Read value "0" from
> > > > "/proc/sys/crypto/fips_enabled".
> > > > 2018-01-08 01:17:09 [6235] Not attempting to set NSS FIPS mode.
> > > > 2018-01-08 01:17:09 [6235] Skipping NSS internal slot (NSS Generic
> > > > Crypto Services).
> > > > 2018-01-08 01:17:09 [6235] Found token 'NSS Certificate DB'.
> > > > 2018-01-08 01:17:09 [6235] Located a certificate with the key's
nickname
> > > > ("Server-Cert").
> > > > 2018-01-08 01:17:09 [6235] Located its private key.
> > > > 2018-01-08 01:17:09 [6235] Recovered public key from private key.
> > > > 2018-01-08 01:17:09 [6235] Key is an RSA key.
> > > > 2018-01-08 01:17:09 [6235] Key size is 2048.
> > > > 2018-01-08 01:17:10 [6251] Read value "0" from
> > > > "/proc/sys/crypto/fips_enabled".
> > > > 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
> > > > 2018-01-08 01:17:10 [6251] Found token 'NSS Generic Crypto
Services'.
> > > > 2018-01-08 01:17:10 [6251] Token is named "NSS Generic Crypto
Services",
> > > > not "NSS Certificate DB", skipping.
> > > > 2018-01-08 01:17:10 [6251] Found token 'NSS Certificate DB'.
> > > > 2018-01-08 01:17:10 [6251] Located the certificate
"Server-Cert".
> > > > 2018-01-08 01:17:10 [6251] Read value "0" from
> > > > "/proc/sys/crypto/fips_enabled".
> > > > 2018-01-08 01:17:10 [6251] Not attempting to set NSS FIPS mode.
> > > > 2018-01-08 01:17:10 [6000] Request9('20171205091409') starts
in state
> > > > 'HAVE_KEYINFO'
> > > > 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to
state
> > > > 'NEED_CSR'
> > > > 2018-01-08 01:17:10 [6000] Will revisit
Request9('20171205091409') now.
> > > > 2018-01-08 01:17:10 [6000] Started
Request9('20171205091409').
> > > > 2018-01-08 01:17:10 [6000] Queuing FD 7 for Read for
> > > > 0x561b59c82750:0x561b59c98940.
> > > > 2018-01-08 01:17:10 [6000] Request9('20171205091409') moved to
state
> > > > 'GENERATING_CSR'
> > > > 2018-01-08 01:17:10 [6000] Will revisit
Request9('20171205091409') on
> > > > traffic from 27.
> > > > 2018-01-08 01:17:11 [6263] Read value "0" from
> > > > "/proc/sys/crypto/fips_enabled".
> > > > 2018-01-08 01:17:11 [6263] Not attempting to set NSS FIPS mode.
> > > > 2018-01-08 01:17:11 [6263] Skipping NSS internal slot (NSS Generic
> > > > Crypto Services).
> > > > 2018-01-08 01:17:11 [6263] Found token 'NSS Certificate DB'.
> > > > 2018-01-08 01:17:11 [6263] Located a certificate with the key's
nickname
> > > > ("Server-Cert").
> > > > 2018-01-08 01:17:11 [6263] Located its private key.
> > > > 2018-01-08 01:17:11 [6263] Recovered public key from private key.
> > > > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to
state
> > > > 'HAVE_CSR'
> > > > 2018-01-08 01:17:11 [6000] Will revisit
Request9('20171205091409') now.
> > > > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to
state
> > > > 'NEED_TO_SUBMIT'
> > > > 2018-01-08 01:17:11 [6000] Will revisit
Request9('20171205091409') now.
> > > > 2018-01-08 01:17:11 [6000] Request9('20171205091409') moved to
state
> > > > 'SUBMITTING'
> > > > 2018-01-08 01:17:11 [6000] Will revisit
Request9('20171205091409') on
> > > > traffic from 31.
> > > > ^C2018-01-08 01:17:14 [6000] Got signal 2.
> > > > 2018-01-08 01:17:14 [6000] Shutting down.
> > > >
> > > > I'm stuck...
> > > >
> > > > Thank you for your time.
> > > >
> > > > >
> > > > > rob
> > > > >
> > > > > >
> > > > > > Is there a way to force update?
> > > > > >
> > > > > > Here's my output of "getcert list":
> > > > > >
> > > > > >
> > > > > > Number of certificates and requests being tracked: 9.
> > > > > > Request ID '20170915095009':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > > type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
> > > > > > certificate:
type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
> > > > > > CA: SelfSign
> > > > > > issuer:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2018-09-15 09:50:10 UTC
> > > > > > principal name:
> > > > > >
krbtgt/LINUX.UNICLOUDIDATTICA.LOCAL(a)LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > certificate template/profile: KDCs_PKINIT_Certs
> > > > > > pre-save command:
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_kdc_cert
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091347':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> > > > > >
> > > > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
> > > > > >
> > > > > > cert-pki-ca',token='NSS Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=CA
Audit,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-21 07:19:44 UTC
> > > > > > key usage: digitalSignature,nonRepudiation
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "auditSigningCert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091349':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> > > > > > cert-pki-ca',token='NSS
> > > > > > Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
> > > > > > cert-pki-ca',token='NSS
> > > > > > Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=OCSP
Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-21 07:18:07 UTC
> > > > > > eku: id-kp-OCSPSigning
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "ocspSigningCert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091350':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> > > > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
> > > > > > cert-pki-ca',token='NSS Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=CA
Subsystem,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-21 07:19:43 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "subsystemCert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091351':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> > > > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
> > > > > > cert-pki-ca',token='NSS Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=Certificate
> > > > > > Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2038-01-08 00:16:58 UTC
> > > > > > key usage:
digitalSignature,nonRepudiation,keyCertSign,cRLSign
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "caSigningCert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091352':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > > type=FILE,location='/var/lib/ipa/ra-agent.key'
> > > > > > certificate:
type=FILE,location='/var/lib/ipa/ra-agent.pem'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject: CN=IPA RA,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-21 07:18:14 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/renew_ra_cert_pre
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ra_cert
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091353':
> > > > > > status: MONITORING
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> > > > > > cert-pki-ca',token='NSS Certificate DB',pin set
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
> > > > > > cert-pki-ca',token='NSS Certificate DB'
> > > > > > CA: dogtag-ipa-ca-renew-agent
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2019-11-20 10:02:31 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
/usr/libexec/ipa/certmonger/stop_pkicad
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/renew_ca_cert
> > > > > > "Server-Cert cert-pki-ca"
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091357':
> > > > > > status: CA_UNREACHABLE
> > > > > > ca-error: Server at
> > > > > > https://idc01.linux.unicloudidattica.local/ipa/xml failed
request, will
> > > > > > retry: -504 (libcurl failed to execute the HTTP POST
transaction,
> > > > > > explaining: Peer's Certificate has expired.).
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
> > > > > >
> > > > > > Certificate
> > > > > >
DB',pinfile='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL/pwdfile.txt'
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/dirsrv/slapd-LINUX-UNICLOUDIDATTICA-LOCAL',nickname='Server-Cert',token='NSS
> > > > > >
> > > > > > Certificate DB'
> > > > > > CA: IPA
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2018-01-08 08:24:22 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/restart_dirsrv
> > > > > > LINUX-UNICLOUDIDATTICA-LOCAL
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > > Request ID '20171205091409':
> > > > > > status: CA_UNREACHABLE
> > > > > > ca-error: Server at
> > > > > > https://idc01.linux.unicloudidattica.local/ipa/xml failed
request, will
> > > > > > retry: -504 (libcurl failed to execute the HTTP POST
transaction,
> > > > > > explaining: Peer's Certificate has expired.).
> > > > > > stuck: no
> > > > > > key pair storage:
> > > > > >
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
> > > > > > Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
> > > > > > certificate:
> > > > > >
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
> > > > > > Certificate DB'
> > > > > > CA: IPA
> > > > > > issuer: CN=Certificate
Authority,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > subject:
> > > > > >
CN=idc01.linux.unicloudidattica.local,O=LINUX.UNICLOUDIDATTICA.LOCAL
> > > > > > expires: 2018-01-08 08:33:05 UTC
> > > > > > key usage:
> > > > > >
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
> > > > > > eku: id-kp-serverAuth,id-kp-clientAuth
> > > > > > pre-save command:
> > > > > > post-save command:
/usr/libexec/ipa/certmonger/restart_httpd
> > > > > > track: yes
> > > > > > auto-renew: yes
> > > > > >
> > > > > >
> > > > > > Thanks in advance,
> > > > > > Giulio
> > > > > > _______________________________________________
> > > > > > FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
> > > > > > To unsubscribe send an email to
> > > > > > freeipa-users-leave(a)lists.fedorahosted.org
> > > > >
> > > >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> >
>
> --
> Giulio Casella giulio at di.unimi.it
> System and network architect
> Computer Science Dept. - University of Milano
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
6:30 a.m.
Il 09/01/2018 13:15, Fraser Tweedale via FreeIPA-users ha scritto:
You are looking for an entry in the Dogtag CA DIT (base DN
`o=ipaca'),
not the FreeIPA DIT. You should check on a CA replica.
I don't have a replica right now (I'm in the middle of a disaster!)...
Some more detail: setting system date in an interval in which all
certificates are valid, certmonger leave requests in "SUBMITTING" state.
Outside this interval requests go in "CA_UNREACHABLE" state (post to
https://$SERVER/ipa/xml gives http 500).
All this issue has begun with a (damn!) "ipa-cacert-manage renew", tried
because services certificates weren't updated by certmonger.
Now the question is: is there a way to rollback this operation in order
to perform the date-in-the-past trick?
TIA,
Giulio
7:02 a.m.
On Tue, Jan 09, 2018 at 01:30:24PM +0100, Giulio Casella wrote:
Il 09/01/2018 13:15, Fraser Tweedale via FreeIPA-users ha scritto:
> You are looking for an entry in the Dogtag CA DIT (base DN `o=ipaca'),
> not the FreeIPA DIT. You should check on a CA replica.
>
I don't have a replica right now (I'm in the middle of a disaster!)...
"CA replica" just means any IPA master that has the Dogtag CA
installed.
You have a Dogtag CA. That CA uses an LDAP database, which has
basedn `o=ipaca'. That database should have the entry I indicated,
whose `userCertificate' attribute we are interested in.
Some more detail: setting system date in an interval in which all
certificates are valid, certmonger leave requests in "SUBMITTING" state.
Outside this interval requests go in "CA_UNREACHABLE" state (post to
https://$SERVER/ipa/xml gives http 500).
All this issue has begun with a (damn!) "ipa-cacert-manage renew", tried
because services certificates weren't updated by certmonger.
Now the question is: is there a way to rollback this operation in order to
perform the date-in-the-past trick?
There's no simple rollback, but I'm confident the situation is
recoverable. It will require a methodical examination of the state
of the system. This will take time (especially over email, across
timezones).
Here are some notes I made about how cert renewal works in FreeIPA,
what the different certs are used for, things that have to line up
and troubleshooting ideas. It is not comprehensive but perhaps it
will help.
https://github.com/frasertweedale/talks/blob/master/2017-11-01-ipa-cert-r...
Cheers,
Fraser
> TIA,
> Giulio
>
7:22 a.m.
Il 09/01/2018 14:02, Fraser Tweedale via FreeIPA-users ha scritto:
"CA replica" just means any IPA master that has the Dogtag
CA
installed.
You have a Dogtag CA. That CA uses an LDAP database, which has
basedn `o=ipaca'. That database should have the entry I indicated,
whose `userCertificate' attribute we are interested in.
Ok, sorry for my low IPA CA knowledge :-)
I've got 4 userCertificate entries in that entry, last one is the same
cert as /var/lib/ipa/ra-agent.pem
7:42 a.m.
On Tue, Jan 09, 2018 at 02:22:26PM +0100, Giulio Casella via FreeIPA-users wrote:
Il 09/01/2018 14:02, Fraser Tweedale via FreeIPA-users ha scritto:
> "CA replica" just means any IPA master that has the Dogtag CA
> installed.
>
> You have a Dogtag CA. That CA uses an LDAP database, which has
> basedn `o=ipaca'. That database should have the entry I indicated,
> whose `userCertificate' attribute we are interested in.
>
Ok, sorry for my low IPA CA knowledge :-)
No problem.
I've got 4 userCertificate entries in that entry, last one is the
same cert
as /var/lib/ipa/ra-agent.pem
Remove all the userAttribute values except the one that matches
ra-agent.pem.
You also suggested earlier to update that entry in the IPA DIT under
`cn=ca_renewal,cn=ipa,cn=etc,{basedn}'. If there is only one CA
master in the topology (the one you're working on) you can ignore
this. Otherwise you should either update its userCertificate value
with the content of ra_agent.pem, OR you can simply delete the
entry.
Do this all while the clock is set back to when the certs are all
valid. Then restart IPA; confirm that all the components start
properly, then attempt to renew the service certificates.
See how you go with that. Hopefully it will be progress, at least.
Cheers,
Fraser
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
8:38 a.m.
Il 09/01/2018 14:42, Fraser Tweedale ha scritto:
Remove all the userAttribute values except the one that matches
ra-agent.pem.
Removed, only the matching one remains.
You also suggested earlier to update that entry in the IPA DIT under
`cn=ca_renewal,cn=ipa,cn=etc,{basedn}'. If there is only one CA
master in the topology (the one you're working on) you can ignore
this. Otherwise you should either update its userCertificate value
with the content of ra_agent.pem, OR you can simply delete the
entry.
Do this all while the clock is set back to when the certs are all
valid. Then restart IPA; confirm that all the components start
properly, then attempt to renew the service certificates.
Done, ipactl status report everything running, but certificates don't renew.
Looking at certmonger (in debug mod) I can see:
"Server at https://idc01.linux.unicloudidattica.local/ipa/xml failed
request, will retry: 4035 (RPC failed at server. Request failed with
status 500: Non-2xx response from CA REST API: 500. ).
Server at https://idc02.linux.unicloudidattica.local/ipa/xml failed
request, will retry: -504 (libcurl failed to execute the HTTP POST
transaction, explaining: Failed connect to
idc02.linux.unicloudidattica.local:443; Connection refused).
"
2018-01-08 01:03:31 [21961] Certificate not (yet?) issued.
2018-01-08 01:03:31 [21961] Request9('20171205091409') moved to state
'CA_UNREACHABLE'
even after a getcert resubmit -i 20171205091409
Have I to try to remove/re-add monitoring from certmonger for service
certificates?
See how you go with that. Hopefully it will be progress, at least.
Cheers,
Fraser
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
--
Giulio Casella giulio at di.unimi.it
System and network architect
Computer Science Dept. - University of Milano
11:19 a.m.
Giulio Casella via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
Done, ipactl status report everything running,
That's not correct, see below.
but certificates don't renew.
Looking at certmonger (in debug mod) I can see:
"Server at https://idc01.linux.unicloudidattica.local/ipa/xml failed
request, will retry: 4035 (RPC failed at server. Request failed with
status 500: Non-2xx response from CA REST API: 500. ).
internal error from apache
Server at https://idc02.linux.unicloudidattica.local/ipa/xml failed
request, will retry: -504 (libcurl failed to execute the HTTP POST
transaction, explaining: Failed connect to
idc02.linux.unicloudidattica.local:443; Connection refused).
no apache running
Have I to try to remove/re-add monitoring from certmonger for
service
certificates?
No - try to find out the errors above. Leave certmonger alone until you
fixed apache/dogtag.
Jochen
--
This space is intentionally left blank.
2:30 p.m.
Il 09/01/2018 18:19, Jochen Hein via FreeIPA-users ha scritto:
Giulio Casella via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org>
writes:
> Done, ipactl status report everything running,
That's not correct, see below.
> but certificates don't renew.
> Looking at certmonger (in debug mod) I can see:
>
> "Server at https://idc01.linux.unicloudidattica.local/ipa/xml failed
> request, will retry: 4035 (RPC failed at server. Request failed with
> status 500: Non-2xx response from CA REST API: 500. ).
internal error from apache
> Server at https://idc02.linux.unicloudidattica.local/ipa/xml failed
> request, will retry: -504 (libcurl failed to execute the HTTP POST
> transaction, explaining: Failed connect to
> idc02.linux.unicloudidattica.local:443; Connection refused).
no apache running
I don't think so. HTTP 500 doesn't mean apache is not running, but an
internal server error.
Indeed I can reach the administration web ui. Login fails due to time
skew, but apache is fully responsive.
Apache return 500 when something behind the scene fails (maybe the
pki-tomcat part, following a post to api).
> Have I to try to remove/re-add monitoring from certmonger for service
> certificates?
No - try to find out the errors above. Leave certmonger alone until you
fixed apache/dogtag.
Jochen
--
Giulio Casella giulio at di.unimi.it
System and network architect
Computer Science Dept. - University of Milano
3:40 p.m.
Giulio Casella via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
Il 09/01/2018 18:19, Jochen Hein via FreeIPA-users ha scritto:
> Giulio Casella via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
> writes:
>
>> Done, ipactl status report everything running,
>
> That's not correct, see below.
>
>> but certificates don't renew.
>> Looking at certmonger (in debug mod) I can see:
>>
>> "Server at https://idc01.linux.unicloudidattica.local/ipa/xml failed
>> request, will retry: 4035 (RPC failed at server. Request failed with
>> status 500: Non-2xx response from CA REST API: 500. ).
>
> internal error from apache
>
>> Server at https://idc02.linux.unicloudidattica.local/ipa/xml failed
>> request, will retry: -504 (libcurl failed to execute the HTTP POST
>> transaction, explaining: Failed connect to
>> idc02.linux.unicloudidattica.local:443; Connection refused).
>
> no apache running
I don't think so. HTTP 500 doesn't mean apache is not running, but an
internal server error.
Indeed I can reach the administration web ui. Login fails due to time
skew, but apache is fully responsive.
Have a look again: Host idc01 delivers 500 - internal error. Host idc02
has no apache running ("connection refused").
Apache return 500 when something behind the scene fails (maybe the
pki-tomcat part, following a post to api).
Yes, try fixing idc01 - most probably dogtag/pki-tomcat there.
Jochen
--
This space is intentionally left blank.
2:20 a.m.
Il 09/01/2018 22:40, Jochen Hein via FreeIPA-users ha scritto:
Have a look again: Host idc01 delivers 500 - internal error. Host
idc02
has no apache running ("connection refused").
Correct, but I'm ignoring idc01 right now (more deeply corrupted),
focusing on idc01.
Next goal is to reinstall replica from scratch on idc02 (should be
straightforward).
Giulio
3:49 a.m.
Fraser, some more info:
In /var/log/pki/pki-tomcat/localhost_access_log.2018-01-08.txt I've found:
172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
/ca/rest/account/login HTTP/1.1" 200 218
172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
/ca/rest/authorities/13b94be3-f918-42e3-abeb-a2210150f28d/cert HTTP/1.1"
500 6472
172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
/ca/rest/account/logout HTTP/1.1" 204 -
I think this is the http 500 reported by certmonger.
And in /var/log/pki/pki-tomcat/localhost.2018-01-08.log:
Jan 08, 2018 2:08:27 AM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet [Resteasy] in context with path
[/ca] threw exception
org.jboss.resteasy.spi.UnhandledException:
org.jboss.resteasy.core.NoMessageBodyWriterFoundFailure: Could not find
MessageBodyWriter for response object of type:
com.netscape.certsrv.base.PKIException$Data of media type:
application/pkix-cert
at
org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:157)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
[...snip...]
Il 09/01/2018 15:38, Giulio Casella via FreeIPA-users ha scritto:
Il 09/01/2018 14:42, Fraser Tweedale ha scritto:
> Remove all the userAttribute values except the one that matches
> ra-agent.pem.
Removed, only the matching one remains.
>
> You also suggested earlier to update that entry in the IPA DIT under
> `cn=ca_renewal,cn=ipa,cn=etc,{basedn}'. If there is only one CA
> master in the topology (the one you're working on) you can ignore
> this. Otherwise you should either update its userCertificate value
> with the content of ra_agent.pem, OR you can simply delete the
> entry.
>
> Do this all while the clock is set back to when the certs are all
> valid. Then restart IPA; confirm that all the components start
> properly, then attempt to renew the service certificates.
>
Done, ipactl status report everything running, but certificates don't
renew.
Looking at certmonger (in debug mod) I can see:
"Server at https://idc01.linux.unicloudidattica.local/ipa/xml failed
request, will retry: 4035 (RPC failed at server. Request failed with
status 500: Non-2xx response from CA REST API: 500. ).
Server at https://idc02.linux.unicloudidattica.local/ipa/xml failed
request, will retry: -504 (libcurl failed to execute the HTTP POST
transaction, explaining: Failed connect to
idc02.linux.unicloudidattica.local:443; Connection refused).
"
2018-01-08 01:03:31 [21961] Certificate not (yet?) issued.
2018-01-08 01:03:31 [21961] Request9('20171205091409') moved to state
'CA_UNREACHABLE'
even after a getcert resubmit -i 20171205091409
Have I to try to remove/re-add monitoring from certmonger for service
certificates?
> See how you go with that. Hopefully it will be progress, at least.
>
> Cheers,
> Fraser
>
>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
--
Giulio Casella giulio at di.unimi.it
System and network architect
Computer Science Dept. - University of Milano
4:01 a.m.
Il 10/01/2018 10:49, Giulio Casella via FreeIPA-users ha scritto:
Fraser, some more info:
In /var/log/pki/pki-tomcat/localhost_access_log.2018-01-08.txt I've found:
172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
/ca/rest/account/login HTTP/1.1" 200 218
172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
/ca/rest/authorities/13b94be3-f918-42e3-abeb-a2210150f28d/cert HTTP/1.1"
500 6472
172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
/ca/rest/account/logout HTTP/1.1" 204 -
It seems that someone is looking for an authority with uuid
13b94be3-f918-42e3-abeb-a2210150f28d.
A little test with rest API (via curl) calling /ca/rest/authorities,
reports a xml collection of authorities, composed only by one authority
with a uuid 87f9c5e4-c7e8-4c4d-ac5e-5ee87a915576 (different from the one
called!)
6:45 a.m.
Il 10/01/2018 11:01, Giulio Casella via FreeIPA-users ha scritto:
Il 10/01/2018 10:49, Giulio Casella via FreeIPA-users ha scritto:
> Fraser, some more info:
>
> In /var/log/pki/pki-tomcat/localhost_access_log.2018-01-08.txt I've
> found:
>
> 172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
> /ca/rest/account/login HTTP/1.1" 200 218
> 172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
> /ca/rest/authorities/13b94be3-f918-42e3-abeb-a2210150f28d/cert
> HTTP/1.1" 500 6472
> 172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
> /ca/rest/account/logout HTTP/1.1" 204 -
It seems that someone is looking for an authority with uuid
13b94be3-f918-42e3-abeb-a2210150f28d.
A little test with rest API (via curl) calling /ca/rest/authorities,
reports a xml collection of authorities, composed only by one authority
with a uuid 87f9c5e4-c7e8-4c4d-ac5e-5ee87a915576 (different from the one
called!)
BINGO!
I tried to substitute wrong uuid in ipaCaId (dn:
cn=ipa,cn=cas,cn=ca,dc=my,dc=dom,dc=ain) with correct one in ldap, and
everything seems to work now.
Thank you Fraser and every guy that helped me solve this issue.
Cheers,
Giulio
8:34 a.m.
On Wed, Jan 10, 2018 at 01:45:04PM +0100, Giulio Casella wrote:
Il 10/01/2018 11:01, Giulio Casella via FreeIPA-users ha scritto:
> Il 10/01/2018 10:49, Giulio Casella via FreeIPA-users ha scritto:
> > Fraser, some more info:
> >
> > In /var/log/pki/pki-tomcat/localhost_access_log.2018-01-08.txt I've
> > found:
> >
> > 172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
> > /ca/rest/account/login HTTP/1.1" 200 218
> > 172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
> > /ca/rest/authorities/13b94be3-f918-42e3-abeb-a2210150f28d/cert
> > HTTP/1.1" 500 6472
> > 172.21.251.8 - ipara [08/Jan/2018:02:03:28 +0100] "GET
> > /ca/rest/account/logout HTTP/1.1" 204 -
>
> It seems that someone is looking for an authority with uuid
> 13b94be3-f918-42e3-abeb-a2210150f28d.
>
> A little test with rest API (via curl) calling /ca/rest/authorities,
> reports a xml collection of authorities, composed only by one authority
> with a uuid 87f9c5e4-c7e8-4c4d-ac5e-5ee87a915576 (different from the one
> called!)
BINGO!
I tried to substitute wrong uuid in ipaCaId (dn:
cn=ipa,cn=cas,cn=ca,dc=my,dc=dom,dc=ain) with correct one in ldap, and
everything seems to work now.
Thank you Fraser and every guy that helped me solve this issue.
Cheers,
Giulio
Great! I'm glad you got to the bottom of it. Just curious - were
there / are there multiple authority entries in LDAP underneath
ou=authorities,ou=ca,o=ipaca?
I have seen this sort of problem once before, when experimenting
with changing the CA Subject DN. I wonder if the CA certificate
renewal that started all this off worked properly... are you using
an externally signed CA cert?
Thanks,
Fraser
9:02 a.m.
Il 10/01/2018 15:34, Fraser Tweedale via FreeIPA-users ha scritto:
Great! I'm glad you got to the bottom of it. Just curious -
were
there / are there multiple authority entries in LDAP underneath
ou=authorities,ou=ca,o=ipaca?
No, there weren't (now, after solving initial problem, I setup a replica
with --setup-ca, and I have 2 authorities).
I have seen this sort of problem once before, when experimenting
with changing the CA Subject DN. I wonder if the CA certificate
renewal that started all this off worked properly... are you using
an externally signed CA cert?
No, I'm using only IPA internal CA. I really don't know where everything
started; for sure my cerificates weren't renewed, and when I found this
issues, trying to resolve, I issued a ipa-cacert-manage renew (I
promise, I won't do it anymore!)
Thanks again,
Giulio
7:10 p.m.
On Wed, Jan 10, 2018 at 04:02:57PM +0100, Giulio Casella wrote:
Il 10/01/2018 15:34, Fraser Tweedale via FreeIPA-users ha scritto:
> Great! I'm glad you got to the bottom of it. Just curious - were
> there / are there multiple authority entries in LDAP underneath
> ou=authorities,ou=ca,o=ipaca?
No, there weren't (now, after solving initial problem, I setup a replica
with --setup-ca, and I have 2 authorities).
>
> I have seen this sort of problem once before, when experimenting
> with changing the CA Subject DN. I wonder if the CA certificate
> renewal that started all this off worked properly... are you using
> an externally signed CA cert?
No, I'm using only IPA internal CA. I really don't know where everything
started; for sure my cerificates weren't renewed, and when I found this
issues, trying to resolve, I issued a ipa-cacert-manage renew (I promise, I
won't do it anymore!)
No worries, thanks for providing the additional info. I am
mystified about how the wrong ipaCaId value got into your IPA
database but I am glad that everything is working for you know.
Cheers,
Fraser
> Thanks again,
> Giulio
2294
days inactive
2297
days old
freeipa-users@lists.fedorahosted.org
21 comments
4 participants
participants (4)
-
Fraser Tweedale -
Giulio Casella -
Jochen Hein -
Rob Crittenden