need help to install letsencrypt in freeipa on ubuntu 16.04

[Anush Jayan]

im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble installing letsencrypt
ssl key for https can anyone help me fix this

[Rob Crittenden]

Anush Jayan via FreeIPA-users wrote:
>  im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
> installing letsencrypt ssl key for https can anyone help me fix this
>  
It would help if you said what you tried and what you are seeing.

rob

[Anush Jayan]

 ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem

ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer

ipa-certupdate

ipa-server-certinstall -w fullchain.pem privkey.pem

then it askd me for directory manager password

then it was asking for something private key unlock password

here i got atuck i dont know which password to insert


On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:

>  Anush Jayan via FreeIPA-users wrote:
>  > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
>  installing letsencrypt ssl key for https can anyone help me fix this
>  >
>
>  It would help if you said what you tried and what you are seeing.
>
>  rob
>

[Rob Crittenden]

Anush Jayan wrote:
>  |ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem|
>  
>  |
>  
>  |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
>  
>  |
>  
>  |ipa-certupdate |
>  
>  |
>  
>  |ipa-server-certinstall -w fullchain.pem privkey.pem|
>  
>  |then it askd me for directory manager password|
>  
>  |then it was asking for something private key unlock password |
>  
>  |here i got atuck i dont know which password to insert| 
I can only assume that the private key is encrypted. You need to provide
the encryption key for it.

If you look at the contents of privkey.pem and it starts with:

-----BEGIN ENCRYPTED PRIVATE KEY-----

then it is encrypted.

rob

>  
>  |
>  
>  |
>  
>  |
>  
>  
>  On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com
>  <mailto:[e-mail]>> wrote:
>  
>      Anush Jayan via FreeIPA-users wrote:
>      > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
>      installing letsencrypt ssl key for https can anyone help me fix this
>      >
>  
>      It would help if you said what you tried and what you are seeing.
>  
>      rob
>

[Anush Jayan]

yes it is encrypted but i have created ssl using letsencrypt and it is
passwordless i dont know which password i should insert when it ask to
enter password for private key
do you know any other way by which i can use letsencrypt fullchain.pem
chain.pem and privkey pem as ssl

On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:

>  Anush Jayan wrote:
>  > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem|
>  >
>  > |
>  >
>  > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
>  >
>  > |
>  >
>  > |ipa-certupdate |
>  >
>  > |
>  >
>  > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>  >
>  > |then it askd me for directory manager password|
>  >
>  > |then it was asking for something private key unlock password |
>  >
>  > |here i got atuck i dont know which password to insert|
>
>  I can only assume that the private key is encrypted. You need to provide
>  the encryption key for it.
>
>  If you look at the contents of privkey.pem and it starts with:
>
>  -----BEGIN ENCRYPTED PRIVATE KEY-----
>
>  then it is encrypted.
>
>  rob
>
>  >
>  > |
>  >
>  > |
>  >
>  > |
>  >
>  >
>  > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com
>  > <mailto:[e-mail]>> wrote:
>  >
>  >     Anush Jayan via FreeIPA-users wrote:
>  >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
>  >     installing letsencrypt ssl key for https can anyone help me fix this
>  >     >
>  >
>  >     It would help if you said what you tried and what you are seeing.
>  >
>  >     rob
>  >
>
>

[Anush Jayan]

im getting this error when i use the same password  which i used for
directory manager password


Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert'
returned non-zero exit status 255
The ipa-server-certinstall command failed.


On Thu, Sep 27, 2018, 10:53 PM Anush Jayan <anush(a)matchpointgps.com&gt; wrote:

>  yes it is encrypted but i have created ssl using letsencrypt and it
> is
>  passwordless i dont know which password i should insert when it ask to
>  enter password for private key
>  do you know any other way by which i can use letsencrypt fullchain.pem
>  chain.pem and privkey pem as ssl
>
>  On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:
>
> > Anush Jayan wrote:
> > > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem|
> > >
> > > |
> > >
> > > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
> > >
> > > |
> > >
> > > |ipa-certupdate |
> > >
> > > |
> > >
> > > |ipa-server-certinstall -w fullchain.pem privkey.pem|
> > >
> > > |then it askd me for directory manager password|
> > >
> > > |then it was asking for something private key unlock password |
> > >
> > > |here i got atuck i dont know which password to insert|
> >
> > I can only assume that the private key is encrypted. You need to provide
> > the encryption key for it.
> >
> > If you look at the contents of privkey.pem and it starts with:
> >
> > -----BEGIN ENCRYPTED PRIVATE KEY-----
> >
> > then it is encrypted.
> >
> > rob
> >
> > >
> > > |
> > >
> > > |
> > >
> > > |
> > >
> > >
> > > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com
> > > <mailto:[e-mail]>> wrote:
> > >
> > >     Anush Jayan via FreeIPA-users wrote:
> > >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
> > >     installing letsencrypt ssl key for https can anyone help me fix this
> > >     >
> > >
> > >     It would help if you said what you tried and what you are seeing.
> > >
> > >     rob
> > >
> >
> >

[Rob Crittenden]

Anush Jayan via FreeIPA-users wrote:
>  im getting this error when i use the same password  which i used for
>  directory manager password
>  
>  
>  Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert'
>  returned non-zero exit status 255
>  The ipa-server-certinstall command failed. 
You might try passing -v to the command to get more output.

This particular error in itself isn't treated as fatal.

rob

>  
>  
>  On Thu, Sep 27, 2018, 10:53 PM Anush Jayan <anush(a)matchpointgps.com
>  <mailto:[e-mail]>> wrote:
>  
>      yes it is encrypted but i have created ssl using letsencrypt and it
>      is passwordless i dont know which password i should insert when it
>      ask to enter password for private key
>      do you know any other way by which i can use letsencrypt
>      fullchain.pem chain.pem and privkey pem as ssl 
>  
>      On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden <rcritten(a)redhat.com
>      <mailto:[e-mail]>> wrote:
>  
>          Anush Jayan wrote:
>          > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem|
>          >
>          > |
>          >
>          > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
>          >
>          > |
>          >
>          > |ipa-certupdate |
>          >
>          > |
>          >
>          > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>          >
>          > |then it askd me for directory manager password|
>          >
>          > |then it was asking for something private key unlock password |
>          >
>          > |here i got atuck i dont know which password to insert|
>  
>          I can only assume that the private key is encrypted. You need to
>          provide
>          the encryption key for it.
>  
>          If you look at the contents of privkey.pem and it starts with:
>  
>          -----BEGIN ENCRYPTED PRIVATE KEY-----
>  
>          then it is encrypted.
>  
>          rob
>  
>          >
>          > |
>          >
>          > |
>          >
>          > |
>          >
>          >
>          > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
>          <rcritten(a)redhat.com <mailto:[e-mail]>
>          > <mailto:[e-mail] <mailto:[e-mail]>>>
> wrote:
>          >
>          >     Anush Jayan via FreeIPA-users wrote:
>          >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
>          having trouble
>          >     installing letsencrypt ssl key for https can anyone help
>          me fix this
>          >     >
>          >
>          >     It would help if you said what you tried and what you are
>          seeing.
>          >
>          >     rob
>          >
>  
>  
>  
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>

[Anush Jayan]

Hi,

ipa: DEBUG: stderr=certutil: could not find certificate named
"Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.

i got this error


Regards,
*Anush Jayan *
*Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*



On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:

>  Anush Jayan via FreeIPA-users wrote:
>  > im getting this error when i use the same password  which i used for
>  > directory manager password
>  >
>  >
>  > Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert'
>  > returned non-zero exit status 255
>  > The ipa-server-certinstall command failed.
>
>  You might try passing -v to the command to get more output.
>
>  This particular error in itself isn't treated as fatal.
>
>  rob
>
>  >
>  >
>  > On Thu, Sep 27, 2018, 10:53 PM Anush Jayan <anush(a)matchpointgps.com
>  > <mailto:[e-mail]>> wrote:
>  >
>  >     yes it is encrypted but i have created ssl using letsencrypt and it
>  >     is passwordless i dont know which password i should insert when it
>  >     ask to enter password for private key
>  >     do you know any other way by which i can use letsencrypt
>  >     fullchain.pem chain.pem and privkey pem as ssl
>  >
>  >     On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden <rcritten(a)redhat.com
>  >     <mailto:[e-mail]>> wrote:
>  >
>  >         Anush Jayan wrote:
>  >         > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
>  DTSRootCAX3.pem|
>  >         >
>  >         > |
>  >         >
>  >         > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
>  >         >
>  >         > |
>  >         >
>  >         > |ipa-certupdate |
>  >         >
>  >         > |
>  >         >
>  >         > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>  >         >
>  >         > |then it askd me for directory manager password|
>  >         >
>  >         > |then it was asking for something private key unlock password |
>  >         >
>  >         > |here i got atuck i dont know which password to insert|
>  >
>  >         I can only assume that the private key is encrypted. You need to
>  >         provide
>  >         the encryption key for it.
>  >
>  >         If you look at the contents of privkey.pem and it starts with:
>  >
>  >         -----BEGIN ENCRYPTED PRIVATE KEY-----
>  >
>  >         then it is encrypted.
>  >
>  >         rob
>  >
>  >         >
>  >         > |
>  >         >
>  >         > |
>  >         >
>  >         > |
>  >         >
>  >         >
>  >         > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
>  >         <rcritten(a)redhat.com <mailto:[e-mail]>
>  >         > <mailto:[e-mail]
> <mailto:[e-mail]>>>
>  wrote:
>  >         >
>  >         >     Anush Jayan via FreeIPA-users wrote:
>  >         >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
>  >         having trouble
>  >         >     installing letsencrypt ssl key for https can anyone help
>  >         me fix this
>  >         >     >
>  >         >
>  >         >     It would help if you said what you tried and what you are
>  >         seeing.
>  >         >
>  >         >     rob
>  >         >
>  >
>  >
>  >
>  > _______________________________________________
>  > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to
>  freeipa-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >
>
>

[Anush Jayan]

hi im getting this error what does this mean how can i fix it do u have any
idea

On Fri, Sep 28, 2018, 10:11 AM Anush Jayan <anush(a)matchpointgps.com&gt; wrote:

>  Hi,
>
>  ipa: DEBUG: stderr=certutil: could not find certificate named
>  "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.
>
>  i got this error
>
>
>  Regards,
>  *Anush Jayan *
>  *Devops Engineer*
>
>  *TRACKPOINT GPS PVT. LTD.*
>
>
>
>  On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden <rcritten(a)redhat.com&gt;
>  wrote:
>
> > Anush Jayan via FreeIPA-users wrote:
> > > im getting this error when i use the same password  which i used for
> > > directory manager password
> > >
> > >
> > > Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert'
> > > returned non-zero exit status 255
> > > The ipa-server-certinstall command failed.
> >
> > You might try passing -v to the command to get more output.
> >
> > This particular error in itself isn't treated as fatal.
> >
> > rob
> >
> > >
> > >
> > > On Thu, Sep 27, 2018, 10:53 PM Anush Jayan <anush(a)matchpointgps.com
> > > <mailto:[e-mail]>> wrote:
> > >
> > >     yes it is encrypted but i have created ssl using letsencrypt and it
> > >     is passwordless i dont know which password i should insert when it
> > >     ask to enter password for private key
> > >     do you know any other way by which i can use letsencrypt
> > >     fullchain.pem chain.pem and privkey pem as ssl
> > >
> > >     On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden <rcritten(a)redhat.com
> > >     <mailto:[e-mail]>> wrote:
> > >
> > >         Anush Jayan wrote:
> > >         > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
> > DTSRootCAX3.pem|
> > >         >
> > >         > |
> > >         >
> > >         > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
> > >         >
> > >         > |
> > >         >
> > >         > |ipa-certupdate |
> > >         >
> > >         > |
> > >         >
> > >         > |ipa-server-certinstall -w fullchain.pem privkey.pem|
> > >         >
> > >         > |then it askd me for directory manager password|
> > >         >
> > >         > |then it was asking for something private key unlock password
> > |
> > >         >
> > >         > |here i got atuck i dont know which password to insert|
> > >
> > >         I can only assume that the private key is encrypted. You need to
> > >         provide
> > >         the encryption key for it.
> > >
> > >         If you look at the contents of privkey.pem and it starts with:
> > >
> > >         -----BEGIN ENCRYPTED PRIVATE KEY-----
> > >
> > >         then it is encrypted.
> > >
> > >         rob
> > >
> > >         >
> > >         > |
> > >         >
> > >         > |
> > >         >
> > >         > |
> > >         >
> > >         >
> > >         > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
> > >         <rcritten(a)redhat.com <mailto:[e-mail]>
> > >         > <mailto:[e-mail]
> <mailto:[e-mail]>>>
> > wrote:
> > >         >
> > >         >     Anush Jayan via FreeIPA-users wrote:
> > >         >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
> > >         having trouble
> > >         >     installing letsencrypt ssl key for https can anyone help
> > >         me fix this
> > >         >     >
> > >         >
> > >         >     It would help if you said what you tried and what you are
> > >         seeing.
> > >         >
> > >         >     rob
> > >         >
> > >
> > >
> > >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > >
> >
> >

[Rob Crittenden]

Anush Jayan via FreeIPA-users wrote:
>  Hi,
>   
>  ipa: DEBUG: stderr=certutil: could not find certificate named
>  "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.
>  
>  i got this error 
You could try adding a cert with this nickname to see if it proceeds.
Take a cert, any cert, and add it using the Server-Cert nickname:

# certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i
/path/to/cert

Then run ipa-server-certinstall again.

rob

>  
>  
>  Regards,
>  *Anush Jayan *
>  *Devops Engineer*
>  *
>  *
>  *TRACKPOINT GPS PVT. LTD.*
>  
>  
>  
>  On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden <rcritten(a)redhat.com
>  <mailto:[e-mail]>> wrote:
>  
>      Anush Jayan via FreeIPA-users wrote:
>      > im getting this error when i use the same password  which i used for
>      > directory manager password
>      >
>      >
>      > Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert'
>      > returned non-zero exit status 255
>      > The ipa-server-certinstall command failed.
>  
>      You might try passing -v to the command to get more output.
>  
>      This particular error in itself isn't treated as fatal.
>  
>      rob
>  
>      >
>      >
>      > On Thu, Sep 27, 2018, 10:53 PM Anush Jayan
>      <anush(a)matchpointgps.com <mailto:[e-mail]>
>      > <mailto:[e-mail]
> <mailto:[e-mail]>>>
>      wrote:
>      >
>      >     yes it is encrypted but i have created ssl using letsencrypt
>      and it
>      >     is passwordless i dont know which password i should insert when it
>      >     ask to enter password for private key
>      >     do you know any other way by which i can use letsencrypt
>      >     fullchain.pem chain.pem and privkey pem as ssl 
>      >
>      >     On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden
>      <rcritten(a)redhat.com <mailto:[e-mail]>
>      >     <mailto:[e-mail] <mailto:[e-mail]>>>
> wrote:
>      >
>      >         Anush Jayan wrote:
>      >         > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
>      DTSRootCAX3.pem|
>      >         >
>      >         > |
>      >         >
>      >         > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
>      >         >
>      >         > |
>      >         >
>      >         > |ipa-certupdate |
>      >         >
>      >         > |
>      >         >
>      >         > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>      >         >
>      >         > |then it askd me for directory manager password|
>      >         >
>      >         > |then it was asking for something private key unlock
>      password |
>      >         >
>      >         > |here i got atuck i dont know which password to insert|
>      >
>      >         I can only assume that the private key is encrypted. You
>      need to
>      >         provide
>      >         the encryption key for it.
>      >
>      >         If you look at the contents of privkey.pem and it starts with:
>      >
>      >         -----BEGIN ENCRYPTED PRIVATE KEY-----
>      >
>      >         then it is encrypted.
>      >
>      >         rob
>      >
>      >         >
>      >         > |
>      >         >
>      >         > |
>      >         >
>      >         > |
>      >         >
>      >         >
>      >         > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
>      >         &lt;rcritten(a)redhat.com <mailto:[e-mail]>
>      <mailto:[e-mail] <mailto:[e-mail]>>
>      >         > <mailto:[e-mail] <mailto:[e-mail]>
>      <mailto:[e-mail] <mailto:[e-mail]>>>> wrote:
>      >         >
>      >         >     Anush Jayan via FreeIPA-users wrote:
>      >         >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
>      >         having trouble
>      >         >     installing letsencrypt ssl key for https can anyone help
>      >         me fix this
>      >         >     >
>      >         >
>      >         >     It would help if you said what you tried and what
>      you are
>      >         seeing.
>      >         >
>      >         >     rob
>      >         >
>      >
>      >
>      >
>      > _______________________________________________
>      > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>      > To unsubscribe send an email to
>      freeipa-users-leave(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>      > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>      > List Guidelines:
>      https://fedoraproject.org/wiki/Mailing_list_guidelines
>      > List Archives:
>      https://lists.fedorahosted.org/archives/list/[e-mail]...
>      >
>  
>  
>  
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>

[Anush Jayan]

Regards,
*Anush Jayan *
*Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*

certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i
/path/to/cert this  command is for centos if im not wrong im using ubuntu
16.04  so what should i  put instead of  /etc/httpd/alias

On Mon, Oct 1, 2018 at 7:27 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:

>  Anush Jayan via FreeIPA-users wrote:
>  > Hi,
>  >
>  > ipa: DEBUG: stderr=certutil: could not find certificate named
>  > "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.
>  >
>  > i got this error
>
>  You could try adding a cert with this nickname to see if it proceeds.
>  Take a cert, any cert, and add it using the Server-Cert nickname:
>
>  # certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i
>  /path/to/cert
>
>  Then run ipa-server-certinstall again.
>
>  rob
>
>  >
>  >
>  > Regards,
>  > *Anush Jayan *
>  > *Devops Engineer*
>  > *
>  > *
>  > *TRACKPOINT GPS PVT. LTD.*
>  >
>  >
>  >
>  > On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden <rcritten(a)redhat.com
>  > <mailto:[e-mail]>> wrote:
>  >
>  >     Anush Jayan via FreeIPA-users wrote:
>  >     > im getting this error when i use the same password  which i used
>  for
>  >     > directory manager password
>  >     >
>  >     >
>  >     > Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n
> Server-Cert'
>  >     > returned non-zero exit status 255
>  >     > The ipa-server-certinstall command failed.
>  >
>  >     You might try passing -v to the command to get more output.
>  >
>  >     This particular error in itself isn't treated as fatal.
>  >
>  >     rob
>  >
>  >     >
>  >     >
>  >     > On Thu, Sep 27, 2018, 10:53 PM Anush Jayan
>  >     <anush(a)matchpointgps.com <mailto:[e-mail]>
>  >     > <mailto:[e-mail]
> <mailto:[e-mail]>>>
>  >     wrote:
>  >     >
>  >     >     yes it is encrypted but i have created ssl using letsencrypt
>  >     and it
>  >     >     is passwordless i dont know which password i should insert
>  when it
>  >     >     ask to enter password for private key
>  >     >     do you know any other way by which i can use letsencrypt
>  >     >     fullchain.pem chain.pem and privkey pem as ssl
>  >     >
>  >     >     On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden
>  >     <rcritten(a)redhat.com <mailto:[e-mail]>
>  >     >     <mailto:[e-mail]
> <mailto:[e-mail]>>>
>  wrote:
>  >     >
>  >     >         Anush Jayan wrote:
>  >     >         > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
>  >     DTSRootCAX3.pem|
>  >     >         >
>  >     >         > |
>  >     >         >
>  >     >         > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install
>  ca.cer|
>  >     >         >
>  >     >         > |
>  >     >         >
>  >     >         > |ipa-certupdate |
>  >     >         >
>  >     >         > |
>  >     >         >
>  >     >         > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>  >     >         >
>  >     >         > |then it askd me for directory manager password|
>  >     >         >
>  >     >         > |then it was asking for something private key unlock
>  >     password |
>  >     >         >
>  >     >         > |here i got atuck i dont know which password to insert|
>  >     >
>  >     >         I can only assume that the private key is encrypted. You
>  >     need to
>  >     >         provide
>  >     >         the encryption key for it.
>  >     >
>  >     >         If you look at the contents of privkey.pem and it starts
>  with:
>  >     >
>  >     >         -----BEGIN ENCRYPTED PRIVATE KEY-----
>  >     >
>  >     >         then it is encrypted.
>  >     >
>  >     >         rob
>  >     >
>  >     >         >
>  >     >         > |
>  >     >         >
>  >     >         > |
>  >     >         >
>  >     >         > |
>  >     >         >
>  >     >         >
>  >     >         > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
>  >     >         <rcritten(a)redhat.com <mailto:[e-mail]>
>  >     <mailto:[e-mail] <mailto:[e-mail]>>
>  >     >         > <mailto:[e-mail]
> <mailto:[e-mail]>
>  >     <mailto:[e-mail] <mailto:[e-mail]>>>>
> wrote:
>  >     >         >
>  >     >         >     Anush Jayan via FreeIPA-users wrote:
>  >     >         >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
>  >     >         having trouble
>  >     >         >     installing letsencrypt ssl key for https can anyone
>  help
>  >     >         me fix this
>  >     >         >     >
>  >     >         >
>  >     >         >     It would help if you said what you tried and what
>  >     you are
>  >     >         seeing.
>  >     >         >
>  >     >         >     rob
>  >     >         >
>  >     >
>  >     >
>  >     >
>  >     > _______________________________________________
>  >     > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  >     <mailto:[e-mail]>
>  >     > To unsubscribe send an email to
>  >     freeipa-users-leave(a)lists.fedorahosted.org
>  >     <mailto:[e-mail]>
>  >     > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  >     > List Guidelines:
>  >     https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >     > List Archives:
>  >
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >     >
>  >
>  >
>  >
>  > _______________________________________________
>  > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to
>  freeipa-users-leave(a)lists.fedorahosted.org
>  > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >
>
>

[Rob Crittenden]

Anush Jayan wrote:
>  
>  Regards,
>  *Anush Jayan *
>  *Devops Engineer*
>  *
>  *
>  *TRACKPOINT GPS PVT. LTD.*
>  
>  certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i
>  /path/to/cert this  command is for centos if im not wrong im using
>  ubuntu 16.04  so what should i  put instead of  /etc/httpd/alias 
I think in Ubuntu the Apache database is in /etc/apache2/nssdb.

rob

>  
>  On Mon, Oct 1, 2018 at 7:27 PM Rob Crittenden <rcritten(a)redhat.com
>  <mailto:[e-mail]>> wrote:
>  
>      Anush Jayan via FreeIPA-users wrote:
>      > Hi,
>      >  
>      > ipa: DEBUG: stderr=certutil: could not find certificate named
>      > "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad
> database.
>      >
>      > i got this error
>  
>      You could try adding a cert with this nickname to see if it proceeds.
>      Take a cert, any cert, and add it using the Server-Cert nickname:
>  
>      # certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i
>      /path/to/cert
>  
>      Then run ipa-server-certinstall again.
>  
>      rob
>  
>      >
>      >
>      > Regards,
>      > *Anush Jayan *
>      > *Devops Engineer*
>      > *
>      > *
>      > *TRACKPOINT GPS PVT. LTD.*
>      >
>      >
>      >
>      > On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden
>      <rcritten(a)redhat.com <mailto:[e-mail]>
>      > <mailto:[e-mail] <mailto:[e-mail]>>>
> wrote:
>      >
>      >     Anush Jayan via FreeIPA-users wrote:
>      >     > im getting this error when i use the same password  which i
>      used for
>      >     > directory manager password
>      >     >
>      >     >
>      >     > Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n
>      Server-Cert'
>      >     > returned non-zero exit status 255
>      >     > The ipa-server-certinstall command failed.
>      >
>      >     You might try passing -v to the command to get more output.
>      >
>      >     This particular error in itself isn't treated as fatal.
>      >
>      >     rob
>      >
>      >     >
>      >     >
>      >     > On Thu, Sep 27, 2018, 10:53 PM Anush Jayan
>      >     &lt;anush(a)matchpointgps.com <mailto:[e-mail]>
>      <mailto:[e-mail] <mailto:[e-mail]>>
>      >     > <mailto:[e-mail]
>      <mailto:[e-mail]> <mailto:[e-mail]
>      <mailto:[e-mail]>>>>
>      >     wrote:
>      >     >
>      >     >     yes it is encrypted but i have created ssl using letsencrypt
>      >     and it
>      >     >     is passwordless i dont know which password i should
>      insert when it
>      >     >     ask to enter password for private key
>      >     >     do you know any other way by which i can use letsencrypt
>      >     >     fullchain.pem chain.pem and privkey pem as ssl 
>      >     >
>      >     >     On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden
>      >     &lt;rcritten(a)redhat.com <mailto:[e-mail]>
>      <mailto:[e-mail] <mailto:[e-mail]>>
>      >     >     <mailto:[e-mail] <mailto:[e-mail]>
>      <mailto:[e-mail] <mailto:[e-mail]>>>> wrote:
>      >     >
>      >     >         Anush Jayan wrote:
>      >     >         > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
>      >     DTSRootCAX3.pem|
>      >     >         >
>      >     >         > |
>      >     >         >
>      >     >         > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install
>      ca.cer|
>      >     >         >
>      >     >         > |
>      >     >         >
>      >     >         > |ipa-certupdate |
>      >     >         >
>      >     >         > |
>      >     >         >
>      >     >         > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>      >     >         >
>      >     >         > |then it askd me for directory manager password|
>      >     >         >
>      >     >         > |then it was asking for something private key unlock
>      >     password |
>      >     >         >
>      >     >         > |here i got atuck i dont know which password to
>      insert|
>      >     >
>      >     >         I can only assume that the private key is encrypted. You
>      >     need to
>      >     >         provide
>      >     >         the encryption key for it.
>      >     >
>      >     >         If you look at the contents of privkey.pem and it
>      starts with:
>      >     >
>      >     >         -----BEGIN ENCRYPTED PRIVATE KEY-----
>      >     >
>      >     >         then it is encrypted.
>      >     >
>      >     >         rob
>      >     >
>      >     >         >
>      >     >         > |
>      >     >         >
>      >     >         > |
>      >     >         >
>      >     >         > |
>      >     >         >
>      >     >         >
>      >     >         > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
>      >     >         &lt;rcritten(a)redhat.com <mailto:[e-mail]>
>      <mailto:[e-mail] <mailto:[e-mail]>>
>      >     <mailto:[e-mail] <mailto:[e-mail]>
>      <mailto:[e-mail] <mailto:[e-mail]>>>
>      >     >         > <mailto:[e-mail]
>      <mailto:[e-mail]> <mailto:[e-mail]
>      <mailto:[e-mail]>>
>      >     <mailto:[e-mail] <mailto:[e-mail]>
>      <mailto:[e-mail] <mailto:[e-mail]>>>>>
> wrote:
>      >     >         >
>      >     >         >     Anush Jayan via FreeIPA-users wrote:
>      >     >         >     > im currently using freeipa 4.3.1 on ubuntu
>      16.04 im
>      >     >         having trouble
>      >     >         >     installing letsencrypt ssl key for https can
>      anyone help
>      >     >         me fix this
>      >     >         >     >
>      >     >         >
>      >     >         >     It would help if you said what you tried and what
>      >     you are
>      >     >         seeing.
>      >     >         >
>      >     >         >     rob
>      >     >         >
>      >     >
>      >     >
>      >     >
>      >     > _______________________________________________
>      >     > FreeIPA-users mailing list --
>      freeipa-users(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>      >     <mailto:[e-mail]
>      <mailto:[e-mail]>>
>      >     > To unsubscribe send an email to
>      >     freeipa-users-leave(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>      >     <mailto:[e-mail]
>      <mailto:[e-mail]>>
>      >     > Fedora Code of Conduct:
>      https://getfedora.org/code-of-conduct.html
>      >     > List Guidelines:
>      >     https://fedoraproject.org/wiki/Mailing_list_guidelines
>      >     > List Archives:
>      >   
>       https://lists.fedorahosted.org/archives/list/[e-mail]
>      >     >
>      >
>      >
>      >
>      > _______________________________________________
>      > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>      > To unsubscribe send an email to
>      freeipa-users-leave(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>      > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>      > List Guidelines:
>      https://fedoraproject.org/wiki/Mailing_list_guidelines
>      > List Archives:
>      https://lists.fedorahosted.org/archives/list/[e-mail]...
>      >
>

[Anush Jayan]

hi

can you tell me how can i install lets encrypt ssl certificate on freeipa
4.3  on Ubuntu 16.04 or centos 7.5 can you please guide me so that my web
ui load without any https warning

On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:

>  Anush Jayan via FreeIPA-users wrote:
>  > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
>  installing letsencrypt ssl key for https can anyone help me fix this
>  >
>
>  It would help if you said what you tried and what you are seeing.
>
>  rob
>

[Anush Jayan]

hi im getting duplicate certificate error



ipa: DEBUG: stderr=
ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L
ipa: DEBUG: Process finished, return code=0
ipa: DEBUG: stdout=
Certificate Nickname                                         Trust
Attributes
 SSL,S/MIME,JAR/XPI

MPGPSDC.COM <http://mpgpsdc.com/> IPA CA
       CT,C,C
CN=DST Root CA X3,O=Digital Signature Trust Co.              C,,
CN=freeipa.do-blr.mpgpsdc.com <http://ut-nagios01.do-blr.mpgpsdc.com/>
                      u,u,u
CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US           ,,

ipa: DEBUG: stderr=
ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
 File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 171,
in execute
    return_value = self.run()
  File
"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
line 110, in run
    self.install_dirsrv_cert()
  File
"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
line 129, in install_dirsrv_cert
    'restart_dirsrv %s' % serverid)
  File
"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
line 180, in import_cert
    command)
  File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py", line
302, in track_server_cert
    request_id = certmonger.start_tracking(nickname, self.secdir,
password_file, command)
  File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py", line
357, in start_tracking
    result = cm.obj_if.add_request(params)
  File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145, in
__call__
    **keywords)
  File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line 651, in
call_blocking
    message, timeout)

ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: The
ipa-server-certinstall command failed, exception: DBusException:
org.fedorahosted.certmonger.duplicate: Certificate at same location is
already used by request with nickname "20181011115500".
ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
org.fedorahosted.certmonger.duplicate: Certificate at same location is
already used by request with nickname "20181011115500".
ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: The
ipa-server-certinstall command failed.


On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:

>  Anush Jayan via FreeIPA-users wrote:
>  > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
>  installing letsencrypt ssl key for https can anyone help me fix this
>  >
>
>  It would help if you said what you tried and what you are seeing.
>
>  rob
>

[Rob Crittenden]

Anush Jayan wrote:
>  hi im getting duplicate certificate error 
>  
>  
>  
>  ipa: DEBUG: stderr=
>  ipa: DEBUG: Starting external process
>  ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L
>  ipa: DEBUG: Process finished, return code=0
>  ipa: DEBUG: stdout=
>  Certificate Nickname                                         Trust
>  Attributes                                                           
>   SSL,S/MIME,JAR/XPI
>  
>  MPGPSDC.COM <http://mpgpsdc.com/> IPA CA                               
>             CT,C,C
>  CN=DST Root CA X3,O=Digital Signature Trust Co.              C,,
>  CN=freeipa.do-blr.mpgpsdc.com <http://ut-nagios01.do-blr.mpgpsdc.com/> 
>                            u,u,u
>  CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US           ,,
>  
>  ipa: DEBUG: stderr=
>  ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: 
>   File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line
>  171, in execute
>      return_value = self.run()
>    File
>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>  line 110, in run
>      self.install_dirsrv_cert()
>    File
>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>  line 129, in install_dirsrv_cert
>      'restart_dirsrv %s' % serverid)
>    File
>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>  line 180, in import_cert
>      command)
>    File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py",
>  line 302, in track_server_cert
>      request_id = certmonger.start_tracking(nickname, self.secdir,
>  password_file, command)
>    File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py", line
>  357, in start_tracking
>      result = cm.obj_if.add_request(params)
>    File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145, in
>  __call__
>      **keywords)
>    File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line 651,
>  in call_blocking
>      message, timeout)
>  
>  ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
>  The ipa-server-certinstall command failed, exception: DBusException:
>  org.fedorahosted.certmonger.duplicate: Certificate at same location is
>  already used by request with nickname "20181011115500".
>  ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
>  org.fedorahosted.certmonger.duplicate: Certificate at same location is
>  already used by request with nickname "20181011115500".
>  ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
>  The ipa-server-certinstall command failed. 
You just need to tell certmonger to stop tracking the old one:

# getcert stop-tracking -i 20181011115500

rob

>  
>  
>  On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com
>  <mailto:[e-mail]>> wrote:
>  
>      Anush Jayan via FreeIPA-users wrote:
>      > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
>      installing letsencrypt ssl key for https can anyone help me fix this
>      >
>  
>      It would help if you said what you tried and what you are seeing.
>  
>      rob
>

[Anush Jayan]

i did that but still its not serving page in https what should i do

On Fri, Oct 12, 2018, 8:12 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:

>  Anush Jayan wrote:
>  > hi im getting duplicate certificate error
>  >
>  >
>  >
>  > ipa: DEBUG: stderr=
>  > ipa: DEBUG: Starting external process
>  > ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L
>  > ipa: DEBUG: Process finished, return code=0
>  > ipa: DEBUG: stdout=
>  > Certificate Nickname                                         Trust
>  > Attributes
>  >  SSL,S/MIME,JAR/XPI
>  >
>  > MPGPSDC.COM <http://mpgpsdc.com/> IPA CA
>  >            CT,C,C
>  > CN=DST Root CA X3,O=Digital Signature Trust Co.              C,,
>  > CN=freeipa.do-blr.mpgpsdc.com <http://ut-nagios01.do-blr.mpgpsdc.com/>
>  >                           u,u,u
>  > CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US           ,,
>  >
>  > ipa: DEBUG: stderr=
>  > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
>  >  File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line
>  > 171, in execute
>  >     return_value = self.run()
>  >   File
>  >
>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>  > line 110, in run
>  >     self.install_dirsrv_cert()
>  >   File
>  >
>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>  > line 129, in install_dirsrv_cert
>  >     'restart_dirsrv %s' % serverid)
>  >   File
>  >
>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>  > line 180, in import_cert
>  >     command)
>  >   File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py",
>  > line 302, in track_server_cert
>  >     request_id = certmonger.start_tracking(nickname, self.secdir,
>  > password_file, command)
>  >   File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py", line
>  > 357, in start_tracking
>  >     result = cm.obj_if.add_request(params)
>  >   File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145, in
>  > __call__
>  >     **keywords)
>  >   File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line 651,
>  > in call_blocking
>  >     message, timeout)
>  >
>  > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
>  > The ipa-server-certinstall command failed, exception: DBusException:
>  > org.fedorahosted.certmonger.duplicate: Certificate at same location is
>  > already used by request with nickname "20181011115500".
>  > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
>  > org.fedorahosted.certmonger.duplicate: Certificate at same location is
>  > already used by request with nickname "20181011115500".
>  > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
>  > The ipa-server-certinstall command failed.
>
>  You just need to tell certmonger to stop tracking the old one:
>
>  # getcert stop-tracking -i 20181011115500
>
>  rob
>
>  >
>  >
>  > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com
>  > <mailto:[e-mail]>> wrote:
>  >
>  >     Anush Jayan via FreeIPA-users wrote:
>  >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
>  >     installing letsencrypt ssl key for https can anyone help me fix this
>  >     >
>  >
>  >     It would help if you said what you tried and what you are seeing.
>  >
>  >     rob
>  >
>
>

[Anush Jayan]

On Sat, Oct 13, 2018, 8:45 PM Anush Jayan <anush(a)matchpointgps.com&gt; wrote:

>  i did that but still its not serving page in https what should i do
>
>  On Fri, Oct 12, 2018, 8:12 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:
>
> > Anush Jayan wrote:
> > > hi im getting duplicate certificate error
> > >
> > >
> > >
> > > ipa: DEBUG: stderr=
> > > ipa: DEBUG: Starting external process
> > > ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L
> > > ipa: DEBUG: Process finished, return code=0
> > > ipa: DEBUG: stdout=
> > > Certificate Nickname                                         Trust
> > > Attributes
> > >  SSL,S/MIME,JAR/XPI
> > >
> > > MPGPSDC.COM <http://mpgpsdc.com/> IPA CA
> > >            CT,C,C
> > > CN=DST Root CA X3,O=Digital Signature Trust Co.              C,,
> > > CN=freeipa.do-blr.mpgpsdc.com <http://ut-nagios01.do-blr.mpgpsdc.com/>
> > >                           u,u,u
> > > CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US           ,,
> > >
> > > ipa: DEBUG: stderr=
> > > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
> > >  File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line
> > > 171, in execute
> > >     return_value = self.run()
> > >   File
> > >
> >
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> > > line 110, in run
> > >     self.install_dirsrv_cert()
> > >   File
> > >
> >
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> > > line 129, in install_dirsrv_cert
> > >     'restart_dirsrv %s' % serverid)
> > >   File
> > >
> >
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> > > line 180, in import_cert
> > >     command)
> > >   File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py",
> > > line 302, in track_server_cert
> > >     request_id = certmonger.start_tracking(nickname, self.secdir,
> > > password_file, command)
> > >   File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py",
> line
> > > 357, in start_tracking
> > >     result = cm.obj_if.add_request(params)
> > >   File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145,
> in
> > > __call__
> > >     **keywords)
> > >   File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line
> 651,
> > > in call_blocking
> > >     message, timeout)
> > >
> > > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
> > > The ipa-server-certinstall command failed, exception: DBusException:
> > > org.fedorahosted.certmonger.duplicate: Certificate at same location is
> > > already used by request with nickname "20181011115500".
> > > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
> > > org.fedorahosted.certmonger.duplicate: Certificate at same location is
> > > already used by request with nickname "20181011115500".
> > > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
> > > The ipa-server-certinstall command failed.
> >
> > You just need to tell certmonger to stop tracking the old one:
> >
> > # getcert stop-tracking -i 20181011115500
> >
> > rob
> >
> > >
> > >
> > > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com
> > > <mailto:[e-mail]>> wrote:
> > >
> > >     Anush Jayan via FreeIPA-users wrote:
> > >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
> > >     installing letsencrypt ssl key for https can anyone help me fix this
> > >     >
> > >
> > >     It would help if you said what you tried and what you are seeing.
> > >
> > >     rob
> > >
> >
> >

[Anush Jayan]

from where can i get Server-Cert file for freeipa or how can i create it
Regards,
*Anush Jayan *
*Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*



On Mon, Oct 15, 2018 at 9:20 AM Anush Jayan <anush(a)matchpointgps.com&gt; wrote:

>  On Sat, Oct 13, 2018, 8:45 PM Anush Jayan <anush(a)matchpointgps.com&gt; wrote:
>
> > i did that but still its not serving page in https what should i do
> >
> > On Fri, Oct 12, 2018, 8:12 PM Rob Crittenden <rcritten(a)redhat.com&gt; wrote:
> >
> >> Anush Jayan wrote:
> >> > hi im getting duplicate certificate error
> >> >
> >> >
> >> >
> >> > ipa: DEBUG: stderr=
> >> > ipa: DEBUG: Starting external process
> >> > ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L
> >> > ipa: DEBUG: Process finished, return code=0
> >> > ipa: DEBUG: stdout=
> >> > Certificate Nickname                                         Trust
> >> > Attributes
> >> >  SSL,S/MIME,JAR/XPI
> >> >
> >> > MPGPSDC.COM <http://mpgpsdc.com/> IPA CA
> >>
> >> >            CT,C,C
> >> > CN=DST Root CA X3,O=Digital Signature Trust Co.              C,,
> >> > CN=freeipa.do-blr.mpgpsdc.com <http://ut-nagios01.do-blr.mpgpsdc.com/
> >> >
> >> >                           u,u,u
> >> > CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US           ,,
> >> >
> >> > ipa: DEBUG: stderr=
> >> > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
> >> >  File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py",
> line
> >> > 171, in execute
> >> >     return_value = self.run()
> >> >   File
> >> >
> >>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> >> > line 110, in run
> >> >     self.install_dirsrv_cert()
> >> >   File
> >> >
> >>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> >> > line 129, in install_dirsrv_cert
> >> >     'restart_dirsrv %s' % serverid)
> >> >   File
> >> >
> >>
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> >> > line 180, in import_cert
> >> >     command)
> >> >   File
> "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py",
> >> > line 302, in track_server_cert
> >> >     request_id = certmonger.start_tracking(nickname, self.secdir,
> >> > password_file, command)
> >> >   File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py",
> line
> >> > 357, in start_tracking
> >> >     result = cm.obj_if.add_request(params)
> >> >   File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line
> 145, in
> >> > __call__
> >> >     **keywords)
> >> >   File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line
> 651,
> >> > in call_blocking
> >> >     message, timeout)
> >> >
> >> > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
> >> > The ipa-server-certinstall command failed, exception: DBusException:
> >> > org.fedorahosted.certmonger.duplicate: Certificate at same location is
> >> > already used by request with nickname "20181011115500".
> >> > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
> >> > org.fedorahosted.certmonger.duplicate: Certificate at same location is
> >> > already used by request with nickname "20181011115500".
> >> > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
> >> > The ipa-server-certinstall command failed.
> >>
> >> You just need to tell certmonger to stop tracking the old one:
> >>
> >> # getcert stop-tracking -i 20181011115500
> >>
> >> rob
> >>
> >> >
> >> >
> >> > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com
> >> > <mailto:[e-mail]>> wrote:
> >> >
> >> >     Anush Jayan via FreeIPA-users wrote:
> >> >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im having
> >> trouble
> >> >     installing letsencrypt ssl key for https can anyone help me fix
> >> this
> >> >     >
> >> >
> >> >     It would help if you said what you tried and what you are seeing.
> >> >
> >> >     rob
> >> >
> >>
> >>

[Rob Crittenden]

Anush Jayan wrote:
>  i did that but still its not serving page in https what should i do
Removing the existing tracking by itself won't do anything. Re-run
ipa-server-certinstall.

rob

>  
>  On Fri, Oct 12, 2018, 8:12 PM Rob Crittenden <rcritten(a)redhat.com
>  <mailto:[e-mail]>> wrote:
>  
>      Anush Jayan wrote:
>      > hi im getting duplicate certificate error 
>      >
>      >
>      >
>      > ipa: DEBUG: stderr=
>      > ipa: DEBUG: Starting external process
>      > ipa: DEBUG: args=/usr/bin/certutil -d
>      /etc/dirsrv/slapd-MPGPSDC-COM/ -L
>      > ipa: DEBUG: Process finished, return code=0
>      > ipa: DEBUG: stdout=
>      > Certificate Nickname                                         Trust
>      > Attributes                                                           
>      >  SSL,S/MIME,JAR/XPI
>      >
>      > MPGPSDC.COM <http://MPGPSDC.COM> <http://mpgpsdc.com/> IPA CA     
>                               
>      >            CT,C,C
>      > CN=DST Root CA X3,O=Digital Signature Trust Co.              C,,
>      > CN=freeipa.do-blr.mpgpsdc.com <http://freeipa.do-blr.mpgpsdc.com>
>      <http://ut-nagios01.do-blr.mpgpsdc.com/> 
>      >                           u,u,u
>      > CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US           ,,
>      >
>      > ipa: DEBUG: stderr=
>      > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall:
>      DEBUG: 
>      >  File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line
>      > 171, in execute
>      >     return_value = self.run()
>      >   File
>      >
>     
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>      > line 110, in run
>      >     self.install_dirsrv_cert()
>      >   File
>      >
>     
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>      > line 129, in install_dirsrv_cert
>      >     'restart_dirsrv %s' % serverid)
>      >   File
>      >
>     
> "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
>      > line 180, in import_cert
>      >     command)
>      >   File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py",
>      > line 302, in track_server_cert
>      >     request_id = certmonger.start_tracking(nickname, self.secdir,
>      > password_file, command)
>      >   File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py",
>      line
>      > 357, in start_tracking
>      >     result = cm.obj_if.add_request(params)
>      >   File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line
>      145, in
>      > __call__
>      >     **keywords)
>      >   File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line
>      651,
>      > in call_blocking
>      >     message, timeout)
>      >
>      > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
>      > The ipa-server-certinstall command failed, exception: DBusException:
>      > org.fedorahosted.certmonger.duplicate: Certificate at same location is
>      > already used by request with nickname "20181011115500".
>      > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
>      > org.fedorahosted.certmonger.duplicate: Certificate at same location is
>      > already used by request with nickname "20181011115500".
>      > ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
>      > The ipa-server-certinstall command failed.
>  
>      You just need to tell certmonger to stop tracking the old one:
>  
>      # getcert stop-tracking -i 20181011115500
>  
>      rob
>  
>      >
>      >
>      > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten(a)redhat.com
>      <mailto:[e-mail]>
>      > <mailto:[e-mail] <mailto:[e-mail]>>>
> wrote:
>      >
>      >     Anush Jayan via FreeIPA-users wrote:
>      >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im having
>      trouble
>      >     installing letsencrypt ssl key for https can anyone help me
>      fix this
>      >     >
>      >
>      >     It would help if you said what you tried and what you are seeing.
>      >
>      >     rob
>      >
>