June 2025 - FreeIPA-users - Fedora mailing-lists

Replacing SSL certificate giving me issues
by Ty zang 13 Jun '25

13 Jun '25

Hello all, I am hoping to get some help on my ssl certificate replacement issues that I am having on my IPA server. The SSL certificate that the web interface uses (third party signed) expired, and I am having a hell of a time getting it replaced properly. To add to the problems, my root and issuer expired a few months ago and have been replaced. This means that the new certificate has been signed by a different issuer. The stage: Server: Oracle Linux 7.9 IPA Version: 4.6.8 Certificate Info: Signed by my issuer (ICA) which is signed by the root, so server > issuer > root is the entire chain. Here is what I have done, in order, so far: # Create a pfx that includes the server name as SAN DNS name, and CN name. Standard process.. # Delete the old chain files that are expired certutil -D -d /etc/httpd/alias -n “MY OLD ROOT” certutil -D -d /etc/httpd/alias -n “MY OLD ISSUER” certutil -D -d /etc/pki/pki-tomcat/alias -n “MY OLD ROOT” certutil -D -d /etc/pki/pki-tomcat/alias -n “MY OLD ISSUER” certutil -D -d /etc/dirsrv/slapd-IDM-DOMAIN-COM -n “MY OLD ROOT” certutil -D -d /etc/dirsrv/slapd-IDM-DOMAIN-COM “MY OLD ISSUER” # Import the new chain files certutil -A -d /etc/httpd/alias -n “root” -t CT,C,C -a -I root.pem certutil -A -d /etc/httpd/alias -n “issuer” -t CT,C,C -a -I issuer.pem certutil -A -d /etc/pki/pki-tomcat/alias -n “root” -t CT,C,C -a -I root.pem certutil -A -d /etc/pki/pki-tomcat/alias -n “issuer” -t CT,C,C -a -I issuer.pem certutil -A -d /etc/dirsrv/slapd-IDM-DOMAIN-COM -n “root” -t CT,C,C -a -I root.pem certutil -A -d /etc/dirsrv/slapd-IDM-DOMAIN-COM “issuer” -t CT,C,C -a -I issuer.pem # Verified certutil -L -d /etc/httpd/alias certutil -L -d /etc/pki/pki-tomcat/alias certutil -L -d /etc/dirsrv/slapd-IDM-DOMAIN-COM # Start ipa as much as it can ipactl restart --ignore-service-failure # Install new cert ipa-server-certinstall -w ipa-srv-01.pfx ipa-server-certinstall -d ipa-srv-01.pfx # Restart things systemctl restart httpd dirsrv@* ipactl restart At this point, things look good. The ipactl status shows “running” on all services and the GUI comes up in my browser with a valid, https certificate. I am unable to log in and any type of “ipa” command ran from command line throws this error: ipa: ERROR: cannot connect to https://ipa-srv-01.domain.com/ipa/json: [SSL: CERTIFICATE_VERIFY_FAILED] The only error I can find is under /var/log/httpd/error_log: SSL Library Error: the server has rejected your certificate as expired INFO: 401 unauthorized: [SSL: CERTIFICATE_VERIFY FAILED] Oddly, I can run openssl s_client -showcerts -connect ipa….:443 and the certificate returned to me is the valid, new certificate and chain. Is there another location that I possibly missed? I have no idea what httpd is trying to use. I am really confused as to why openssl returns the proper cert but the commands are saying its expired? Thanks all!

1 0

Re: [EXTERNAL] Re: It ain't easy to dig a user's last login time info out of IdM/FreeIPA
by Shane Frasier 12 Jun '25

12 Jun '25

Hello, Apologies for reviving an old thread, but I was wondering if there is any way to turn this replication on for our local FreeIPA cluster? I'd like to use the krbLastAuthentication data to disable inactive users, but the timestamps are reset every time I upgrade the cluster. Thank you, Shane Frasier (maverick(a)maverickdolphin.com)

3 5

No valid Negotiate header in server response, keytabs regenerated
by Felix O 12 Jun '25

12 Jun '25

Hi, when trying to run any ipa cli commands, they fail with the message ipa: ERROR: No valid Negotiate header in server response. Trying to sign into the web ui fails by unknown error. The instance has had its certificates expired and then renewed using ipa-cert-fix, after which the problem occurred. I have regenerated the host keytab and gssproxy keytab using the following commands, to no success. (the command succeeds, but it doesn't help the issue) ipa-getkeytab -s ipa.example.com -p host/ipa.example.com(a)EXAMPLE.COM -k /etc/krb5.keytab ipa-getkeytab -s ipa.example.com -p HTTP/ipa.example.com(a)EXAMPLE.COM -k /var/lib/ipa/gssproxy/http.keytab Felix

1 0

Re: [EXTERNAL] Re: It ain't easy to dig a user's last login time info out of IdM/FreeIPA
by Shane Frasier 12 Jun '25

12 Jun '25

Hi Rob, When I perform step 1 I use, e.g.: ipa server-del --ignore-topology-disconnect ipa0.<domain> for id in $(ipa cert-find --sizelimit=0 --status=VALID --subject=ipa0.<domain> | grep "Serial number:" | sed "s/^\ *Serial number: //"); do ipa cert-revoke $id --revocation-reason=5; done ipa-replica-manage del ipa0.<domain> It occurred to me that perhaps the ipa server-del command is overly aggressive and causing the last authentication timestamps to be deleted. Should I drop that step? Would I then need to un-join ipa0 from the domain after the ipa-replica-manage command? If the process for this sort of in situ upgrade is documented someplace then feel free to simply point me there. I searched but didn't find it. Thank you, Shane

1 0

delete suborinate-id
by alexey safonov 12 Jun '25

12 Jun '25

Hi team, I accidentally created subordinateID and made some random user as an owner. So right now we are not using that function and I'd like to delete it. Could not find how to do that. any suggestions? Alex

3 2

User can't login with password when in alternate ID range
by Brian ONeill 11 Jun '25

11 Jun '25

I am setting up IPA to replace an ancient system where I'd like to preserve a handful of existing users UIDs that are in the 500 range. There are MANY files that would need to change otherwise. I'm starting with a pristine IPA install (AlmaLinux 9.6), with standard settings. To enable the users in the low UID range, I added a range: ipa idrange-add MYDOMAIN.COM_legacy_range --base-id 501 --range-size 99 --rid-base 300000 --secondary-rid-base 200000000 --type ipa-local And that seemed fine...I create a user in that range, set a password, etc. The user can log into the IPA GUI fine. Now, on a client, I can ssh with a key as that user, but I cannot login with a password at all. The user shows a ipantsecurityidentifier so that isn't missing. A user created in the default ID range works fine. The only thing I find in the logs is with sssd debug turned way up: (2025-06-11 9:43:43): [be[mydomain.com]] [sysdb_search_by_name] (0x0400): [RID#18] No such entry (2025-06-11 9:43:43): [be[mydomain.com]] [sysdb_cache_search_groups] (0x2000): [RID#18] Search groups with filter: (&(objectCategory=group)(ghost=pam_usertype_non_existent:@mydomain.com)) (2025-06-11 9:43:43): [be[mydomain.com]] [sysdb_cache_search_groups] (0x2000): [RID#18] No such entry (2025-06-11 9:43:43): [be[mydomain.com]] [sysdb_delete_user] (0x0400): [RID#18] Error: 2 (No such file or directory) (2025-06-11 9:43:43): [be[mydomain.com]] [sysdb_search_by_name] (0x0400): [RID#18] No such entry (2025-06-11 9:43:43): [be[mydomain.com]] [get_object_from_cache] (0x0200): [RID#18] Object wasn't found in cache (2025-06-11 9:43:43): [be[mydomain.com]] [ipa_id_get_account_info_orig_done] (0x0080): [RID#18] Object not found, ending request I'm not sure what is actually missing here. The user's GID corresponds to a group I created in IPA, no private group was created, and is a member of ipausers. Any ideas what else I'm missing?

3 2

DNS resolution for external IP fail on replica
by sebastien chanson 11 Jun '25

11 Jun '25

Hi, I search the threads but was not able to find an answer, I apologies if my question is trivial. I have a very simple free ipa setup with two ipa servers in two different networks in two different locations. The second one was created using the following commands: 1) ipa-client-install --mkhomedir --no-ntp --enable-dns-updates to join the server to the domain 2) ipa-replica-install --setup-dns --no-forwarder --setup-ca I have a DNS global configuration setup with public dns configured and forward first option set. I have no forwarder defined at the individual level for dns server. I have no forward zones defined However my replica does not seems to be able to forward dns request to public DNS for dfomains outside my inernal domain. It needs the other freeipa server which is problematic when I have a connexion loss between the two location. Nslookup exemples: user> nslookup google.com 10.178.127.3 (initial freeip server) Server: 10.178.127.3 Address: 10.178.127.3#53 Non-authoritative answer: Name: google.com Address: 172.217.20.206 Name: google.com Address: 2a00:1450:4007:810::200e user> nslookup google.com 192.168.0.3 (replica server) Server: 192.168.0.3 Address: 192.168.0.3#53 ** server can't find google.com: REFUSED I do not know what I did wrong, when I read the documentation it seems to be the default behaviour for a server, replica or not to forward request for domain they do not manage. Any suggestions will be appreciated.

1 1

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 10 Jun '25

10 Jun '25

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

3 4

After upgrad to 9.6 FreeIPA don't start
by Günther J. Niederwimmer 09 Jun '25

09 Jun '25

Hallo Liste, I'm running Oracle 9.5, but since updating to 9.6, FreeIPA hasn't worked anymore. The replica server survived the upgrade. I've tried it three times now, restoring a backup and updating to 9.6, with the same result. The IPA server is the older installation, around 9.2. How can I fix this? Any help is appreciated. -- mit freundlichen Grüßen / best regards Günther J. Niederwimmer

4 8

Freeipa-Let's Encrypt certificates renovation issue
by Z Altzibar 07 Jun '25

07 Jun '25

Hi, First of all, sorry about my english. I'm not native speaker of this language. I'm having problems to renew the certificates for two servers we have with freeipa (master and replica). The previous certificates were expired in 29 may 2025. We created a new LE certificates that gives a next suite of certificates: cert.pem chain.pem fullchain.pem privkey.pem That certificates apparently are right (they expired date is on 01 september of 2025) But when I try to install them in the freeipa infrastructure, using this commands: ipa-cacert-manage install -t C,, /root/certs/xxxx.xxx/chain.pem ipa-certupdate ipa-server-certinstall -w -d /root/certs/xxxx.xxx/privkey.pem /root/certs/xxxx.xxx/fullchain.pem --pin='xxx' -p "xxx" the ipa-certupdate command gives me an error: Connection to https://xxxxxxx.xxxx.xxx/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1133) Also, I can see in ipactl status that pki-tomcatd is stopped (The pki logs gives me an error of expired cert): Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: STOPPED ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING 1 service(s) are not running And using certutil I can see: certutil -L -d /etc/dirsrv/slapd-XXXX-XXX/ -n "CN=xxxx.xxx" Validity: Not Before: Fri Feb 28 23:02:34 2025 Not After : Thu May 29 23:02:33 2025 The basic infraestructure is on Almalinux 9: NAME="AlmaLinux" VERSION="9.5 (Teal Serval)" ID="almalinux" ID_LIKE="rhel centos fedora" VERSION_ID="9.5" PLATFORM_ID="platform:el9" PRETTY_NAME="AlmaLinux 9.5 (Teal Serval)" ANSI_COLOR="0;34" LOGO="fedora-logo-icon" CPE_NAME="cpe:/o:almalinux:almalinux:9::baseos" HOME_URL="https://almalinux.org/" DOCUMENTATION_URL="https://wiki.almalinux.org/" BUG_REPORT_URL="https://bugs.almalinux.org/" ALMALINUX_MANTISBT_PROJECT="AlmaLinux-9" ALMALINUX_MANTISBT_PROJECT_VERSION="9.5" REDHAT_SUPPORT_PRODUCT="AlmaLinux" REDHAT_SUPPORT_PRODUCT_VERSION="9.5" SUPPORT_END=2032-06-01 I tried several solution found on googling (like set time before expiring "original" certs) but nothing nothing works. I appreciate any support you can provide on this

2 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2025