Thank you Rob for your help.

I see no expired certificates:

getcert list | grep expires expires: 2022-04-17 16:46:12 CEST expires: unknown expires: unknown expires: unknown expires: unknown expires: 2022-04-06 16:44:19 CEST expires: 2022-04-06 16:44:45 CEST expires: 2022-04-17 16:45:23 CEST expires: 2022-04-17 16:45:47 CEST

I did also not see anything curious in the ca log folder. All services seem to be running, as far as I can see.

On a restart of certmonger I get these errors, but after that its up Jan 12 07:31:05 test.intra certmonger[53276]: 2021-01-12 07:31:05 [53378] Error authenticating to token "NSS Certificate DB". Jan 12 07:31:05 test.intra certmonger[53276]: 2021-01-12 07:31:05 [53378] Error shutting down NSS. Jan 12 07:31:07 test.intra certmonger[53276]: 2021-01-12 07:31:07 [53417] Error authenticating to token "NSS Certificate DB". Jan 12 07:31:07 test.intra certmonger[53276]: 2021-01-12 07:31:07 [53417] Error shutting down NSS. Jan 12 07:31:12 test.intra certmonger[53276]: 2021-01-12 07:31:12 [53447] Error authenticating to token "NSS Certificate DB". Jan 12 07:31:12 test.intra certmonger[53276]: 2021-01-12 07:31:12 [53447] Error shutting down NSS. Jan 12 07:31:17 test.intra certmonger[53276]: 2021-01-12 07:31:17 [53492] Error authenticating to token "NSS Certificate DB". Jan 12 07:31:17 test.intra certmonger[53276]: 2021-01-12 07:31:17 [53492] Error shutting down NSS.

tomcat also answers to a curl on http://test.intra:8080/ca/admin/ca/getStatus with running

Any further ideas? I need to get it back runnig somehow :(!

Thanks a lot

Nico

Nico Maas via FreeIPA-users wrote:

Thank you all, I could resolve the issue. Problem was a somewhat faulty certificate that a user had loaded into the userCertificate attribute of its LDAP entry.

I could see it by using cat /var/log/httpd/error_log

ValueError: unable to convert the attribute 'usercertificate' value b'-----BEGIN CERTIFICATE-----\nMIIEaDCCA1CgAwIBAgI .... X5xy7CQ==\n-----END CERTIFICATE-----\n' to type <class 'cryptography.x509.base.Certificate'> in LDAP entry 'uid=test-user,cn=users,cn=accounts,dc=test,dc=intra'

removing the userCertificate attribute of this entry got all 3 freeIPA instances back running and the web interface error free.

Do you have any more details on this? Was the 903 thrown only for this user or for all users? I'm interested to know if a bad cert in one user could affect all.

thanks

rob

Hi Nico,

Hey! Please describe the process of solving this problem in more detail, how to remove such a problematic certificate?

I have exactly the same problem and even #ipa cert-revoke does not work in the console.

Hi, if you know exactly which certificate is causing the problem, you can use ldapmodify to remove the value from the ldap user entry.

ldapmodify -D "cn=directory manager" -W dn: uid=<user>,cn=users,cn=accounts,<base dn> changetype: modify delete: usercertificate usercertificate: <value to be removed>

If you're not comfortable with the ldapmodify tool, there are graphical tools such as ApacheDirectoryStudio that can help. flo

On Wed, Nov 9, 2022 at 8:19 PM Артем Михайлов via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:

Hi Nico,

Hey! Please describe the process of solving this problem in more detail, how to remove such a problematic certificate?

I have exactly the same problem and even #ipa cert-revoke does not work in the console. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue