Hi, trying to delete a host failed with "Unable to communicate with CMS (500)"   # ipa host-del foo.bar.local   ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (500) Checking the pki logs shows "Subsystem unavailable"   # /var/log/pki/pki-tomcat/localhost.YYYY-MM-DD.log   SEVERE: Exception Processing /ca/rest/certs/search   javax.ws.rs.ServiceUnavailableException: Subsystem unavailable Trying to troubleshoot it with help of https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom... shows an authentication error on LDAP (/var/log/pki/pki-tomcat/ca/debug), but debug it further failed in the part "Check the subsystemCert cert-pki-ca" The 1st command works:   # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca'   Certificate:       Data:           Version: 3 (0x2)           Serial Number:               00:9f:ff:01:6c   ... # grep internal= /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt But then the private key can't been read:   # certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca'   certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"   certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier.   # certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'NSS Certificate DB: subsystemCert cert-pki-ca'   certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"   certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. It looks as it's there:   # certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt   certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"   < 0> rsa      f7eXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX79c   Server-Cert cert-pki-ca   < 1> rsa      7e4XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX164   NSS Certificate DB:caSigningCert cert-pki-ca   < 2> rsa      f40XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX978   Server-Cert cert-pki-ca   < 3> rsa      097XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXcca   NSS Certificate DB:subsystemCert cert-pki-ca   < 4> rsa      28cXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX8f9   (orphan)   < 5> rsa      602XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX400   NSS Certificate DB:ocspSigningCert cert-pki-ca   < 6> rsa      b28XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX9fe   NSS Certificate DB:auditSigningCert cert-pki-ca   < 7> rsa      91cXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXb13   (orphan) What could be wrong here?

Thanks in advance & b/r H. _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...

Am 03.05.2019 10:18, schrieb Florence Blanc-Renaud via FreeIPA-users: > On 5/2/19 7:08 PM, H. Frenzel via FreeIPA-users wrote: >> What could be wrong here? > Hi, > the key is present, its name is just "NSS Certificate > DB:subsystemCert cert-pki-ca" without any space after the colon. You > can check the next steps, i.e. is the "subsystemCert cert-pki-ca" > certificate consistent with the content of the LDAP entry > uid=pkidbuser,ou=people,o=ipaca. > > flo Tried the ldapsearch and found three userCertificates, one of them matches with that one in /etc/pki/pki-tomcat/alias:   # ldapsearch -LLL -D 'cn=directory manager' -W -b uid=pkidbuser,ou=people,o=ipaca userCertificate description seeAlso   Enter LDAP Password:   dn: uid=pkidbuser,ou=people,o=ipaca   userCertificate:: MIIDbD...    ...    .../342g==   userCertificate:: MIIDbj...    ...    ...xQ4WGL4   userCertificate:: MIIDaT...    ...    ...PP09A==   description: 2;2684289388;CN=Certificate Authority,O=EXAMPLE.COM;CN=CA Subsystem,O    =EXAMPLE.COM   seeAlso: CN=CA Subsystem,O=EXAMPLE.COM The last one (MIIDaT...PP09A==) is the matching one. The Serial Number seems to match too:   # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep -A1 Serial           Serial Number:               00:9f:ff:01:6c   # printf %d, 0x009fff016c   2684289388 What next? Can those other two certificates been removed?

Thanks in advance & b/r H. _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...

Am 07.05.2019 08:39, schrieb Florence Blanc-Renaud via FreeIPA-users: > On 5/3/19 11:47 AM, H. Frenzel via FreeIPA-users wrote: >> Am 03.05.2019 10:18, schrieb Florence Blanc-Renaud via FreeIPA-users: >>> On 5/2/19 7:08 PM, H. Frenzel via FreeIPA-users wrote: >> >> What next? Can those other two certificates been removed? >> Hi, > > it's not a problem if the previous certs are still present in LDAP, > you can keep them here. It looks like the content of the NSSDB and > LDAP are consistent. > > A few other things to check: > > - Are there any replication conflicts (if you have multiple CA masters)? > $ ldapsearch -D "cn=Directory Manager" -W -b o=ipaca > "(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))" \* > nsds5ReplConflict It seems there are no conflicts:   # search result   search: 2   result: 0 Success The multiple CA masters setup didn't work (s. https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...) > - In /etc/pki/pki-tomcat/ca/CS.cfg, the line starting with > 'ca.subsystem.cert=' must contain the same cert as 'subsystemCert > cert-pki-ca' in /etc/pki/pki-tomcat/alias It is as expected. > - Are there any specific errors in /var/log/pki/pki-tomcat/ca/debug? > When the CA subsystem properly starts, you should see lines about > 'subsystemCert cert-pki-ca' and SSL handshake like the following: > > [date][localhost-startStop-1]: > ldapconn/PKISocketFactory.makeSSLSocket: begins > [date][localhost-startStop-1]: SSLClientCertificateSelectionCB: > Setting desired cert nickname to: subsystemCert cert-pki-ca > [date][localhost-startStop-1]: LdapJssSSLSocket: set client auth cert > nickname subsystemCert cert-pki-ca > [date][localhost-startStop-1]: SSLClientCertificatSelectionCB: Entering! > [date][localhost-startStop-1]: Candidate cert: subsystemCert cert-pki-ca > [date][localhost-startStop-1]: SSLClientCertificateSelectionCB: > desired cert found in list: subsystemCert cert-pki-ca > [date][localhost-startStop-1]: SSLClientCertificateSelectionCB: > returning: subsystemCert cert-pki-ca > [date][localhost-startStop-1]: > PKIClientSocketListener.handshakeCompleted: begins > [date][localhost-startStop-1]: SignedAuditLogger: event > CLIENT_ACCESS_SESSION_ESTABLISH > [date][localhost-startStop-1]: > PKIClientSocketListener.handshakeCompleted: > CS_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS > [date][localhost-startStop-1]: > PKIClientSocketListener.handshakeCompleted: clientIP=<local IP> > serverIP=<local IP> serverPort=31746 > [date][localhost-startStop-1]: SSL handshake happened > [date][localhost-startStop-1]: Established LDAP connection with SSL > client auth to <local hostname>:636 > > so any error related to subsystemCert cert-pki-ca may help us diagnose.   [07/May/2019:14:19:33][localhost-startStop-1]: ldapconn/PKISocketFactory.makeSSLSocket: begins   [07/May/2019:14:19:33][localhost-startStop-1]: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca   [07/May/2019:14:19:33][localhost-startStop-1]: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca   [07/May/2019:14:19:33][localhost-startStop-1]: SSLClientCertificatSelectionCB: Entering!   [07/May/2019:14:19:33][localhost-startStop-1]: Candidate cert: EXAMPLE.COM IPA CA   [07/May/2019:14:19:33][localhost-startStop-1]: Candidate cert: Server-Cert cert-pki-ca   [07/May/2019:14:19:33][localhost-startStop-1]: SSLClientCertificateSelectionCB: returning: null   [07/May/2019:14:19:33][localhost-startStop-1]: PKIClientSocketListener.handshakeCompleted: begins   [07/May/2019:14:19:33][localhost-startStop-1]: SignedAuditLogger: event CLIENT_ACCESS_SESSION_ESTABLISH   [07/May/2019:14:19:33][localhost-startStop-1]: LogFile: event type not selected: CLIENT_ACCESS_SESSION_ESTABLISH   [07/May/2019:14:19:33][localhost-startStop-1]: PKIClientSocketListener.handshakeCompleted: CS_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS   [07/May/2019:14:19:33][localhost-startStop-1]: PKIClientSocketListener.handshakeCompleted: clientIP=10.1.1.101 serverIP=10.1.1.101 serverPort=31746   [07/May/2019:14:19:33][localhost-startStop-1]: SSL handshake happened   Could not connect to LDAP server host ipa.example.com port 636 Error netscape.ldap.LDAPException: Authentication failed (48) There are even no errors within /var/log/dirsrv/slapd-EXAMPLE-COM/error of this try. But I found some warnings within /var/log/messages, might be those are related somehow?   2019-05-07T14:19:28.494819+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'enableOCSP' to 'false' did not find a matching property.   2019-05-07T14:19:28.495201+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderURL' to 'http://ipa.example.com:8080/ca/ocsp' did not find a matching property.   2019-05-07T14:19:28.495495+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspResponderCertNickname' to 'ocspSigningCert cert-pki-ca' did not find a matching property.   2019-05-07T14:19:28.495775+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspCacheSize' to '1000' did not find a matching property.   2019-05-07T14:19:28.496412+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMinCacheEntryDuration' to '60' did not find a matching property.   2019-05-07T14:19:28.497308+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspMaxCacheEntryDuration' to '120' did not find a matching property.   2019-05-07T14:19:28.498213+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ocspTimeout' to '10' did not find a matching property.   2019-05-07T14:19:28.499134+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'strictCiphers' to 'true' did not find a matching property.   2019-05-07T14:19:28.500062+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslOptions' to 'ssl2=false,ssl3=false,tls=true' did not find a matching property.   2019-05-07T14:19:28.500918+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl2Ciphers' to '-SSL2_RC4_128_WITH_MD5,-SSL2_RC4_128_EXPORT40_WITH_MD5,-SSL2_RC2_128_CBC_WITH_MD5,-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5,-SSL2_DES_64_CBC_WITH_MD5,-SSL2_DES_192_EDE3_CBC_WITH_MD5' did not find a matching property.   2019-05-07T14:19:28.502491+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'ssl3Ciphers' to '-SSL3_FORTEZZA_DMS_WITH_NULL_SHA,-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA,+SSL3_RSA_WITH_RC4_128_SHA,-SSL3_RSA_EXPORT_WITH_RC4_40_MD5,+SSL3_RSA_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_DES_CBC_SHA,-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5,-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA,-SSL_RSA_FIPS_WITH_DES_CBC_SHA,+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,-SSL3_RSA_WITH_NULL_MD5,-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA' did not find a matching property.   2019-05-07T14:19:28.504300+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'tlsCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_DSS_WITH_AES_128_CBC_SHA,+TLS_DHE_DSS_WITH_AES_256_CBC_SHA,+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_DHE_RSA_WITH_AES_128_CBC_SHA,+TLS_DHE_RSA_WITH_AES_256_CBC_SHA' did not find a matching property.   2019-05-07T14:19:28.505563+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeStream' to 'tls1_0:tls1_2' did not find a matching property.   2019-05-07T14:19:28.506169+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslVersionRangeDatagram' to 'tls1_1:tls1_2' did not find a matching property.   2019-05-07T14:19:28.506856+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sslRangeCiphers' to '-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_DSS_WITH_AES_128_CBC_SHA,-TLS_DHE_DSS_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA,-TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,-TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,-TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,-TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,-TLS_RSA_WITH_AES_128_CBC_SHA256,-TLS_RSA _WITH_AES_256_CBC_SHA256,-TLS_RSA_WITH_AES_128_GCM_SHA256,+TLS_RSA_WITH_3DES_EDE_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA,+TLS_RSA_WITH_AES_256_CBC_SHA' did not find a matching property.   2019-05-07T14:19:28.508160+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'serverCertNickFile' to '/var/lib/pki/pki-tomcat/conf/serverCertNick.conf' did not find a matching property.   2019-05-07T14:19:28.508811+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordFile' to '/var/lib/pki/pki-tomcat/conf/password.conf' did not find a matching property.   2019-05-07T14:19:28.509434+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'passwordClass' to 'org.apache.tomcat.util.net.jss.PlainPasswordFile' did not find a matching property.   2019-05-07T14:19:28.510180+02:00 ipa server: WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'certdbDir' to '/var/lib/pki/pki-tomcat/alias' did not find a matching property.   2019-05-07T14:19:28.537648+02:00 ipa server: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlValidation' to 'false' did not find a matching property.   2019-05-07T14:19:28.538024+02:00 ipa server: WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'xmlNamespaceAware' to 'false' did not find a matching property.   2019-05-07T14:19:33.518554+02:00 ipa server: CMSEngine.initializePasswordStore() begins   2019-05-07T14:19:33.520758+02:00 ipa server: CMSEngine.initializePasswordStore(): tag=internaldb   2019-05-07T14:19:33.521107+02:00 ipa server: CMSEngine.initializePasswordStore(): tag=replicationdb   2019-05-07T14:19:33.882875+02:00 ipa server: Internal Database Error encountered: Could not connect to LDAP server host ipa.example.com port 636 Error netscape.ldap.LDAPException: Authentication failed (48)

Thanks for your help H. _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...