Certificate issuer has been marked as not trusted by the user

[Israel Brewster]

I recently had the certificates I use on my FreeIPA server expire, preventing ipa from
starting. So I replaced them with the new ones, and IPA still wouldn't start,
whereupon after some digging I discovered the new certificates came with new Intermediate
and root certificates. So I installed those using ipa-cacert-manage, ran ipa-certupdate,
and then re-installed my certificates using ipa-server-certinstall, all of which appeared
to work. However, the IPA service still won't start, with the issue apparently being
that pki-tomcat isn't starting properly. Looking at the
/var/log/pki/pki-tomcat/ca/debug file shows that the reason for this is:

Internal Database Error encountered: Could not connect to LDAP server host
freeipaserver-a.ravnalaska.net<http://freeipaserver-a.ravnalaska.net> port 636 Error
netscape.ldap.LDAPException: Unable to create socket:
org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been marked as not
trusted by the user. (-1)

Ok, sounds simple enough, so how do I mark the Peer's certificate issuer as trusted?
Thanks.
-----------------------------------------------
Israel Brewster
Systems Analyst II
5245 Airport Industrial Rd
Fairbanks, AK 99709
[phone]
-----------------------------------------------

[cid:[e-mail]]



[cid:[e-mail]]

[Rob Crittenden]

Israel Brewster via FreeIPA-users wrote:
>  I recently had the certificates I use on my FreeIPA server expire,
>  preventing ipa from starting. So I replaced them with the new ones, and
>  IPA still wouldn't start, whereupon after some digging I discovered the
>  new certificates came with new Intermediate and root certificates. So I
>  installed those using ipa-cacert-manage, ran ipa-certupdate, and then
>  re-installed my certificates using ipa-server-certinstall, all of which
>  appeared to work. However, the IPA service still won't start, with the
>  issue apparently being that pki-tomcat isn't starting properly. Looking
>  at the /var/log/pki/pki-tomcat/ca/debug file shows that the reason for
>  this is:
>  
>  Internal Database Error encountered: Could not connect to LDAP server
>  host freeipaserver-a.ravnalaska.net
>  <http://freeipaserver-a.ravnalaska.net> port 636 Error
>  netscape.ldap.LDAPException: Unable to create socket:
>  org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
>  SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been
>  marked as not trusted by the user. (-1)
>  
>  Ok, sounds simple enough, so how do I mark the Peer's certificate issuer
>  as trusted? Thanks. 
I think we need more information on your installation. Were you running
with 3rd party certificates for Apache/LDAP already? Why was the issuer
different?

Are the CA subsystem certificates still valid? `getcert list` should
show you.

rob

[Israel Brewster]

>  On Oct 5, 2018, at 3:53 PM, Rob Crittenden
> <rcritten(a)redhat.com&gt; wrote:
>  
>  Israel Brewster via FreeIPA-users wrote:
> > I recently had the certificates I use on my FreeIPA server expire,
> > preventing ipa from starting. So I replaced them with the new ones, and
> > IPA still wouldn't start, whereupon after some digging I discovered the
> > new certificates came with new Intermediate and root certificates. So I
> > installed those using ipa-cacert-manage, ran ipa-certupdate, and then
> > re-installed my certificates using ipa-server-certinstall, all of which
> > appeared to work. However, the IPA service still won't start, with the
> > issue apparently being that pki-tomcat isn't starting properly. Looking
> > at the /var/log/pki/pki-tomcat/ca/debug file shows that the reason for
> > this is:
> > 
> > Internal Database Error encountered: Could not connect to LDAP server
> > host freeipaserver-a.ravnalaska.net
> > <http://freeipaserver-a.ravnalaska.net> port 636 Error
> > netscape.ldap.LDAPException: Unable to create socket:
> > org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
> > SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been
> > marked as not trusted by the user. (-1)
> > 
> > Ok, sounds simple enough, so how do I mark the Peer's certificate issuer
> > as trusted? Thanks.
>  
>  I think we need more information on your installation. Were you running
>  with 3rd party certificates for Apache/LDAP already?
>  
Yep, been using our third party wildcard certificate for the past few years.

>  Why was the issuer
>  different?
>  
I have no idea. That’s part of the reason it took me a while to get to this point - I
installed the new certificates, and they didn’t work. It wasn’t until I looked at the
intermediate certificate that came with our new certificate and realized *it* was
different, and that its issuer was also different than the previous root I had installed
that I realized there was a difference. As I mentioned, I went ahead and installed both
this new intermediate and the new root, thus leading me to this point.

>  
>  Are the CA subsystem certificates still valid? `getcert list` should
>  show you.
>  
As far as I can tell, all certificates on the system are valid, it’s just tomcat that
thinks *something* is MARKED as untrusted:

getcert list
Number of certificates and requests being tracked: 7.
Request ID '20170929183435':
	status: MONITORING
	stuck: no
	key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
	certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
	CA: SelfSign
	issuer: CN=freeipaserver-a.ravnalaska.net,O=RAVNALASKA.NET
	subject: CN=freeipaserver-a.ravnalaska.net,O=RAVNALASKA.NET
	expires: 2019-09-01 22:46:51 UTC
	principal name: krbtgt/RAVNALASKA.NET(a)RAVNALASKA.NET
	certificate template/profile: KDCs_PKINIT_Certs
	pre-save command: 
	post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
	track: yes
	auto-renew: yes
Request ID '20171107224634':
	status: MONITORING
	stuck: no
	key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
	certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
	CA: dogtag-ipa-ca-renew-agent
	issuer: CN=Certificate Authority,O=RAVNALASKA.NET
	subject: CN=CA Audit,O=RAVNALASKA.NET
	expires: 2020-04-21 22:47:49 UTC
	key usage: digitalSignature,nonRepudiation
	pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
	post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert
cert-pki-ca"
	track: yes
	auto-renew: yes
Request ID '20171107224635':
	status: MONITORING
	stuck: no
	key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
	certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
	CA: dogtag-ipa-ca-renew-agent
	issuer: CN=Certificate Authority,O=RAVNALASKA.NET
	subject: CN=OCSP Subsystem,O=RAVNALASKA.NET
	expires: 2020-04-21 22:46:58 UTC
	eku: id-kp-OCSPSigning
	pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
	post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert
cert-pki-ca"
	track: yes
	auto-renew: yes
Request ID '20171107224636':
	status: MONITORING
	stuck: no
	key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
	certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
	CA: dogtag-ipa-ca-renew-agent
	issuer: CN=Certificate Authority,O=RAVNALASKA.NET
	subject: CN=CA Subsystem,O=RAVNALASKA.NET
	expires: 2020-04-21 22:47:48 UTC
	key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
	eku: id-kp-serverAuth,id-kp-clientAuth
	pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
	post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert
cert-pki-ca"
	track: yes
	auto-renew: yes
Request ID '20171107224637':
	status: MONITORING
	stuck: no
	key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
	certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
	CA: dogtag-ipa-ca-renew-agent-reuse
	issuer: CN=GeoTrust RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US
	subject: CN=*.ravnalaska.net,OU=IT,O=Ravn Alaska,L=Anchorage,ST=Alaska,C=US
	expires: 2020-04-10 12:00:00 UTC
	dns: *.ravnalaska.net,ravnalaska.net
	key usage: digitalSignature,keyEncipherment
	eku: id-kp-serverAuth,id-kp-clientAuth
	pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
	post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert
cert-pki-ca"
	track: yes
	auto-renew: yes
Request ID '20171107224638':
	status: MONITORING
	stuck: no
	key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
	certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
	CA: dogtag-ipa-ca-renew-agent
	issuer: CN=Certificate Authority,O=RAVNALASKA.NET
	subject: CN=IPA RA,O=RAVNALASKA.NET
	expires: 2020-04-21 22:47:29 UTC
	key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
	eku: id-kp-serverAuth,id-kp-clientAuth
	pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
	post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
	track: yes
	auto-renew: yes
Request ID '20171107224639':
	status: MONITORING
	stuck: no
	key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
	certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
	CA: dogtag-ipa-ca-renew-agent
	issuer: CN=Certificate Authority,O=RAVNALASKA.NET
	subject: CN=freeipaserver-a.ravnalaska.net,O=RAVNALASKA.NET
	expires: 2020-04-21 22:46:50 UTC
	key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
	eku: id-kp-serverAuth,id-kp-clientAuth
	pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
	post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert
cert-pki-ca"
	track: yes
	auto-renew: yes

>  
>  rob
>

[Israel Brewster]

On Oct 5, 2018, at 3:36 PM, Israel Brewster via FreeIPA-users
<[e-mail]<mailto:[e-mail]>>
wrote:

I recently had the certificates I use on my FreeIPA server expire, preventing ipa from
starting. So I replaced them with the new ones, and IPA still wouldn't start,
whereupon after some digging I discovered the new certificates came with new Intermediate
and root certificates. So I installed those using ipa-cacert-manage, ran ipa-certupdate,
and then re-installed my certificates using ipa-server-certinstall, all of which appeared
to work. However, the IPA service still won't start, with the issue apparently being
that pki-tomcat isn't starting properly. Looking at the
/var/log/pki/pki-tomcat/ca/debug file shows that the reason for this is:

Internal Database Error encountered: Could not connect to LDAP server host
freeipaserver-a.ravnalaska.net<http://freeipaserver-a.ravnalaska.net/> port 636
Error netscape.ldap.LDAPException: Unable to create socket:
org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been marked as not
trusted by the user. (-1)

Ok, sounds simple enough, so how do I mark the Peer's certificate issuer as trusted?
Thanks.

Ok, I managed to get this working by manually adding the new root CA certificate to the
/etc/pki/pki-tomcat/alias database and marking it as trusted there. For good measure, I
went ahead and ran ipa-certupdate again, and rebooted, but everything seems to be working
now.

-----------------------------------------------
Israel Brewster
Systems Analyst II
5245 Airport Industrial Rd
Fairbanks, AK 99709
[phone]
-----------------------------------------------

-----------------------------------------------
Israel Brewster
Systems Analyst II
5245 Airport Industrial Rd
Fairbanks, AK 99709
[phone]
-----------------------------------------------

<image001.jpg>



<image002.jpg>







<Israel Brewster.vcf>_______________________________________________
FreeIPA-users mailing list --
[e-mail]<mailto:[e-mail]>
To unsubscribe send an email to
[e-mail]<mailto:[e-mail]>
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...

[Rob Crittenden]

Israel Brewster via FreeIPA-users wrote:
>  On Oct 5, 2018, at 3:36 PM, Israel Brewster via FreeIPA-users
>  <freeipa-users(a)lists.fedorahosted.org
>  <mailto:[e-mail]>> wrote:
> >
> > I recently had the certificates I use on my FreeIPA server expire,
> > preventing ipa from starting. So I replaced them with the new ones,
> > and IPA still wouldn't start, whereupon after some digging I
> > discovered the new certificates came with new Intermediate and root
> > certificates. So I installed those using ipa-cacert-manage, ran
> > ipa-certupdate, and then re-installed my certificates
> > using ipa-server-certinstall, all of which appeared to work. However,
> > the IPA service still won't start, with the issue apparently being
> > that pki-tomcat isn't starting properly. Looking at
> > the /var/log/pki/pki-tomcat/ca/debug file shows that the reason for
> > this is:
> >
> > Internal Database Error encountered: Could not connect to LDAP server
> > host freeipaserver-a.ravnalaska.net
> > <http://freeipaserver-a.ravnalaska.net/> port 636 Error
> > netscape.ldap.LDAPException: Unable to create socket:
> > org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException:
> > SSL_ForceHandshake failed: (-8172) Peer's certificate issuer has been
> > marked as not trusted by the user. (-1)
> >
> > Ok, sounds simple enough, so how do I mark the Peer's certificate
> > issuer as trusted? Thanks.
>  
>  Ok, I managed to get this working by manually adding the new root CA
>  certificate to the /etc/pki/pki-tomcat/alias database and marking it as
>  trusted there. For good measure, I went ahead and ran ipa-certupdate
>  again, and rebooted, but everything seems to be working now. 
Ok cool, that's what I was going to suggest. I just didn't want to point
in in the wrong direction. Glad you're up and running again.

rob