Hi,
We have a problem connecting with CA REST API (403). Any ideas how to troubleshoot?
Setup: IPA 4.9.8 on CentOS Stream 8, two IPA CA servers Only looking at the CA renewal master (ipa1.example.com)
# ipa cert-show 1 ipa: DEBUG: trying https://ipa1.example.com/ipa/session/json ipa: ERROR: Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)
# pki-healthcheck Internal server error 403 Client Error: 403 for url: http://ipa1.example.com:80/ca/rest/securityDomain/domainInfo [ { "source": "pki.server.healthcheck.meta.csconfig", "check": "CADogtagCertsConfigCheck", "result": "ERROR", "uuid": "58153e6c-98ed-4264-a622-e8f6e23d58ca", "when": "20220809080611Z", "duration": "0.164052", "kw": { "key": "ca_signing", "nickname": "caSigningCert cert-pki-ca", "directive": "ca.signing.cert", "configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg", "msg": "Certificate 'caSigningCert cert-pki-ca' does not match the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg" } } ]
LDAP and IPA RA appear to have identical certificates and serial number:
# ldapsearch -LLL -D 'cn=directory manager' -W -b uid=ipara,ou=People,o=ipaca userCertificate description dn: uid=ipara,ou=people,o=ipaca userCertificate:: MIID...Ovix8 description: 2;1878982672;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM
# openssl x509 -text -in /var/lib/ipa/ra-agent.pem Serial Number: 1878982672 (0x6fff0010) Validity Not Before: Aug 8 10:02:19 2022 GMT Not After : Jul 28 10:02:19 2024 GMT -----BEGIN CERTIFICATE----- MIID...Ovix8 -----END CERTIFICATE-----
PKI appear to have identical certificates in LDAP and /etc/pki/pki-tomcat/alias:
# certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' |grep Serial Serial Number: 1878982665 (0x6fff0009) # ldapsearch -LLL -D 'cn=directory manager' -W -b uid=pkidbuser,ou=people,o=ipaca userCertificate description seeAlso dn: uid=pkidbuser,ou=people,o=ipaca userCertificate:: MIID...eluPug== description: 2;1878982665;CN=Certificate Authority,O=EXAMPLE.COM;CN=CA Subsystem,O=EXAMPLE.COM seeAlso: CN=CA Subsystem,O=EXAMPLE.COM
And, the certificate in CS.cfg appears to match the caSigningCert in LDAP:
/var/lib/pki/pki-tomcat/ca/conf/CS.cfg: ca.signing.cert=MIID...yfc5a
# ldapsearch -LLL -D 'cn=directory manager' -W \ -b 'cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com' dn: cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com userCertificate:: MIID...yfc5a
Additional details:
# ldapsearch -LLL -D 'cn=directory manager' -W -b ou=authorities,ou=ca,o=ipaca dn: ou=authorities,ou=ca,o=ipaca ou: authorities objectClass: top objectClass: organizationalUnit
dn: cn=58d7a049-ada3-4146-b39a-84aa1b6f4add,ou=authorities,ou=ca,o=ipaca authoritySerial: 1878982673 description: Host authority authorityDN: CN=Certificate Authority,O=EXAMPLE.COM authorityEnabled: TRUE authorityKeyNickname: caSigningCert cert-pki-ca authorityID: 58d7a049-ada3-4146-b39a-84aa1b6f4add cn: 58d7a049-ada3-4146-b39a-84aa1b6f4add objectClass: authority objectClass: top
# ldapsearch -LLL -D 'cn=directory manager' -W -b cn=ipa,cn=cas,cn=ca,dc=example,dc=com dn: cn=ipa,cn=cas,cn=ca,dc=example,dc=com cn: ipa ipaCaId: 58d7a049-ada3-4146-b39a-84aa1b6f4add ipaCaSubjectDN: CN=Certificate Authority,O=EXAMPLE.COM objectClass: top objectClass: ipaca ipaCaIssuerDN: CN=Certificate Authority,O=EXAMPLE.COM description: IPA CA
# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI
Server-Cert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u ocspSigningCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu caSigningCert cert-pki-ca CTu,Cu,Cu EXAMPLE.COM IPA CA CTu,Cu,Cu EXAMPLE.COM IPA CA CTu,Cu,Cu
# certutil -L -d /etc/pki/pki-tomcat/alias -a -n 'EXAMPLE.COM IPA CA' 3 certificates
# certutil -L -d /etc/pki/pki-tomcat/alias -a -n 'caSigningCert cert-pki-ca' 3 certificates (identical with above 3 certificates)
# pki ca-cert-show 1878982672 Serial Number: 0x6fff0010 Subject DN: CN=IPA RA,O=EXAMPLE.COM Issuer DN: CN=Certificate Authority,O=EXAMPLE.COM Status: VALID Not Valid Before: Mon Aug 08 12:02:19 CEST 2022 Not Valid After: Sun Jul 28 12:02:19 CEST 2024
Hi,
On Tue, Aug 9, 2022 at 11:13 AM Erling Andersen via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Hi,
We have a problem connecting with CA REST API (403). Any ideas how to troubleshoot?
Setup: IPA 4.9.8 on CentOS Stream 8, two IPA CA servers Only looking at the CA renewal master (ipa1.example.com)
# ipa cert-show 1 ipa: DEBUG: trying https://ipa1.example.com/ipa/session/json ipa: ERROR: Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)
# pki-healthcheck Internal server error 403 Client Error: 403 for url: http://ipa1.example.com:80/ca/rest/securityDomain/domainInfo [ { "source": "pki.server.healthcheck.meta.csconfig", "check": "CADogtagCertsConfigCheck", "result": "ERROR", "uuid": "58153e6c-98ed-4264-a622-e8f6e23d58ca", "when": "20220809080611Z", "duration": "0.164052", "kw": { "key": "ca_signing", "nickname": "caSigningCert cert-pki-ca", "directive": "ca.signing.cert", "configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg", "msg": "Certificate 'caSigningCert cert-pki-ca' does not match the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg" } } ]
This error means that the certificate with nickname 'caSigningCert cert-pki-ca' in /etc/pki/pki-tomcat/alias is not consistent with the one stored in the directive ca.signing.cert=... in the file /var/lib/pki/pki-tomcat/ca/conf/CS.cfg.
LDAP and IPA RA appear to have identical certificates and serial number:
# ldapsearch -LLL -D 'cn=directory manager' -W -b uid=ipara,ou=People,o=ipaca userCertificate description dn: uid=ipara,ou=people,o=ipaca userCertificate:: MIID...Ovix8 description: 2;1878982672;CN=Certificate Authority,O=EXAMPLE.COM;CN=IPA RA,O=EXAMPLE.COM
# openssl x509 -text -in /var/lib/ipa/ra-agent.pem Serial Number: 1878982672 (0x6fff0010) Validity Not Before: Aug 8 10:02:19 2022 GMT Not After : Jul 28 10:02:19 2024 GMT -----BEGIN CERTIFICATE----- MIID...Ovix8 -----END CERTIFICATE-----
PKI appear to have identical certificates in LDAP and /etc/pki/pki-tomcat/alias:
# certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' |grep Serial Serial Number: 1878982665 (0x6fff0009)
# ldapsearch -LLL -D 'cn=directory manager' -W -b uid=pkidbuser,ou=people,o=ipaca userCertificate description seeAlso dn: uid=pkidbuser,ou=people,o=ipaca userCertificate:: MIID...eluPug== description: 2;1878982665;CN=Certificate Authority,O=EXAMPLE.COM;CN=CA Subsystem,O=EXAMPLE.COM seeAlso: CN=CA Subsystem,O=EXAMPLE.COM
And, the certificate in CS.cfg appears to match the caSigningCert in LDAP:
/var/lib/pki/pki-tomcat/ca/conf/CS.cfg: ca.signing.cert=MIID...yfc5a
# ldapsearch -LLL -D 'cn=directory manager' -W \ -b 'cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com' dn: cn=caSigningCert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com userCertificate:: MIID...yfc5a
Additional details:
# ldapsearch -LLL -D 'cn=directory manager' -W -b ou=authorities,ou=ca,o=ipaca dn: ou=authorities,ou=ca,o=ipaca ou: authorities objectClass: top objectClass: organizationalUnit
dn: cn=58d7a049-ada3-4146-b39a-84aa1b6f4add,ou=authorities,ou=ca,o=ipaca authoritySerial: 1878982673 description: Host authority authorityDN: CN=Certificate Authority,O=EXAMPLE.COM authorityEnabled: TRUE authorityKeyNickname: caSigningCert cert-pki-ca authorityID: 58d7a049-ada3-4146-b39a-84aa1b6f4add cn: 58d7a049-ada3-4146-b39a-84aa1b6f4add objectClass: authority objectClass: top
# ldapsearch -LLL -D 'cn=directory manager' -W -b cn=ipa,cn=cas,cn=ca,dc=example,dc=com dn: cn=ipa,cn=cas,cn=ca,dc=example,dc=com cn: ipa ipaCaId: 58d7a049-ada3-4146-b39a-84aa1b6f4add ipaCaSubjectDN: CN=Certificate Authority,O=EXAMPLE.COM objectClass: top objectClass: ipaca ipaCaIssuerDN: CN=Certificate Authority,O=EXAMPLE.COM description: IPA CA
# certutil -L -d /etc/pki/pki-tomcat/alias/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Server-Cert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u ocspSigningCert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu caSigningCert cert-pki-ca CTu,Cu,Cu EXAMPLE.COM IPA CA CTu,Cu,Cu EXAMPLE.COM IPA CA CTu,Cu,Cu
Since there are multiple certs for IPA CA and caSigningCert
cert-pki-ca, I assume that the CA has already been renewed a few times. Is the most recent one consistent with the directive ca.signing.cert=... in the file /var/lib/pki/pki-tomcat/ca/conf/CS.cfg ?
flo
# certutil -L -d /etc/pki/pki-tomcat/alias -a -n 'EXAMPLE.COM IPA CA'
3 certificates
# certutil -L -d /etc/pki/pki-tomcat/alias -a -n 'caSigningCert cert-pki-ca' 3 certificates (identical with above 3 certificates)
# pki ca-cert-show 1878982672 Serial Number: 0x6fff0010 Subject DN: CN=IPA RA,O=EXAMPLE.COM Issuer DN: CN=Certificate Authority,O=EXAMPLE.COM Status: VALID Not Valid Before: Mon Aug 08 12:02:19 CEST 2022 Not Valid After: Sun Jul 28 12:02:19 CEST 2024 _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
There are three certs for IPA CA in /etc/pki/pki-tomcat/alias/, the latest (from Aug 08 2022) is consistent with ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg.
Erling Andersen via FreeIPA-users wrote:
There are three certs for IPA CA in /etc/pki/pki-tomcat/alias/, the latest (from Aug 08 2022) is consistent with ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg.
I wouldn't focus on this. I don't believe this will cause any problems, much less an authorization error.
Have you tried ipa-healthcheck? It has more IPA-specific checks.
Also check the secrets in /etc/httpd/conf.d/ipa-pki-proxy.conf vs the values in /etc/pki/pki-tomcat/server.xml . There was an issue where the secrets got out-of-sync (see list archives for details).
rob
Thanks! Setting requiredSecret in /etc/pki/pki-tomcat/server.xml equal to secret improved things a little bit!
# ipa-healthcheck --severity ERROR [ { "source": "ipahealthcheck.ipa.certs", "check": "IPADogtagCertsMatchCheck", "result": "ERROR", "uuid": "7336ec84-03c6-4ddf-adb2-1070159fbaf8", "when": "20220825123343Z", "duration": "0.081966", "kw": { "key": "caSigningCert cert-pki-ca", "nickname": "caSigningCert cert-pki-ca", "dbdir": "/etc/pki/pki-tomcat/alias", "msg": "{nickname} certificate in NSS DB {dbdir} does not match entry in LDAP" } }, { "source": "pki.server.healthcheck.meta.csconfig", "check": "CADogtagCertsConfigCheck", "result": "ERROR", "uuid": "4972c614-31d5-4472-8de7-b0cc522e2db6", "when": "20220825123359Z", "duration": "0.156108", "kw": { "key": "ca_signing", "nickname": "caSigningCert cert-pki-ca", "directive": "ca.signing.cert", "configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg", "msg": "Certificate 'caSigningCert cert-pki-ca' does not match the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg" } } ]
freeipa-users@lists.fedorahosted.org
-
Erling Andersen -
Florence Blanc-Renaud -
Rob Crittenden