6:53 p.m.
Hi,
Is it possible to apply wildcard SSL on v3.1 to be able to migrate to
recent free-ipa?
Reason being that, I need to backdate date to year before self-signed expired.
I have not been able to renew certificate so far.
Thanks.
8:05 p.m.
On Tue, Feb 13, 2018 at 08:53:10AM +0800, Umarzuki Mochlis via FreeIPA-users wrote:
Hi,
Is it possible to apply wildcard SSL on v3.1 to be able to migrate to
recent free-ipa?
Reason being that, I need to backdate date to year before self-signed expired.
I have not been able to renew certificate so far.
Hi Umarzuki,
Could you please give more info, specifically about which certs are
expired and what errors you are encountering while attempting to
renew them? Some hints about how to modify Dogtag certificate
profiles to issue wildcard certificates can be found here[1]. But
your description of the problem does not contain enough information
to make me confident that a wildcard cert will help.
[1]
https://frasertweedale.github.io/blog-redhat/posts/2017-06-26-freeipa-wil...
Cheers,
Fraser
2:08 a.m.
it stuck with "status: SUBMITTING" when I issue command "ipa-getcert
list" after I resubmit cert renew "get-cert resubmit -i ID"
2018-02-13 10:05 GMT+08:00 Fraser Tweedale <ftweedal(a)redhat.com>:
> On Tue, Feb 13, 2018 at 08:53:10AM +0800, Umarzuki Mochlis via FreeIPA-users wrote:
>> Hi,
>>
>> Is it possible to apply wildcard SSL on v3.1 to be able to migrate to
>> recent free-ipa?
>> Reason being that, I need to backdate date to year before self-signed expired.
>> I have not been able to renew certificate so far.
>>
> Hi Umarzuki,
>
> Could you please give more info, specifically about which certs are
> expired and what errors you are encountering while attempting to
> renew them? Some hints about how to modify Dogtag certificate
> profiles to issue wildcard certificates can be found here[1]. But
> your description of the problem does not contain enough information
> to make me confident that a wildcard cert will help.
>
> [1]
https://frasertweedale.github.io/blog-redhat/posts/2017-06-26-freeipa-wil...
>
> Cheers,
> Fraser
8:59 a.m.
Umarzuki Mochlis via FreeIPA-users wrote:
it stuck with "status: SUBMITTING" when I issue command
"ipa-getcert
list" after I resubmit cert renew "get-cert resubmit -i ID"
Which request is stuck? Can you provide the output of ipa-getcert list
-i ID?
rob
2018-02-13 10:05 GMT+08:00 Fraser Tweedale <ftweedal(a)redhat.com>:
> On Tue, Feb 13, 2018 at 08:53:10AM +0800, Umarzuki Mochlis via FreeIPA-users wrote:
>> Hi,
>>
>> Is it possible to apply wildcard SSL on v3.1 to be able to migrate to
>> recent free-ipa?
>> Reason being that, I need to backdate date to year before self-signed expired.
>> I have not been able to renew certificate so far.
>>
> Hi Umarzuki,
>
> Could you please give more info, specifically about which certs are
> expired and what errors you are encountering while attempting to
> renew them? Some hints about how to modify Dogtag certificate
> profiles to issue wildcard certificates can be found here[1]. But
> your description of the problem does not contain enough information
> to make me confident that a wildcard cert will help.
>
> [1]
https://frasertweedale.github.io/blog-redhat/posts/2017-06-26-freeipa-wil...
>
> Cheers,
> Fraser
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
9:15 a.m.
2018-02-13 22:59 GMT+08:00 Rob Crittenden <rcritten(a)redhat.com>:
Umarzuki Mochlis via FreeIPA-users wrote:
> it stuck with "status: SUBMITTING" when I issue command "ipa-getcert
> list" after I resubmit cert renew "get-cert resubmit -i ID"
Which request is stuck? Can you provide the output of ipa-getcert list
-i ID?
rob
these request still 'submitting' since service started. I resubmit
them one or two years ago.
[root@ipa ~]# ipa-getcert list | more
Number of certificates and requests being tracked: 7.
Request ID '20130112120232':
status: SUBMITTING
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-COM',nic
kname='Server-Cert',token='NSS Certificate
DB',pinfile='/etc/dirsrv/slapd-DOMAIN-COM/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-COM',nickname
='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=DOMAIN.COM
subject: CN=ipa.domain.com,O=DOMAIN.COM
expires: 2016-12-16 16:18:27 UTC
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv DOMAIN-COM
track: yes
auto-renew: yes
Request ID '20130112120734':
status: SUBMITTING
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Serve
r-Cert',token='NSS Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cer
t',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=DOMAIN.COM
subject: CN=ipa.domain.com,O=DOMAIN.COM
expires: 2016-12-16 16:18:27 UTC
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
2:55 p.m.
Umarzuki Mochlis wrote:
2018-02-13 22:59 GMT+08:00 Rob Crittenden
<rcritten(a)redhat.com>:
> Umarzuki Mochlis via FreeIPA-users wrote:
>> it stuck with "status: SUBMITTING" when I issue command
"ipa-getcert
>> list" after I resubmit cert renew "get-cert resubmit -i ID"
>
> Which request is stuck? Can you provide the output of ipa-getcert list
> -i ID?
>
> rob
these request still 'submitting' since service started. I resubmit
them one or two years ago.
The certs are certainly very expired at this point. Do these exist in
reality anymore?
# certutil -L -d /etc/dirsrv/slapd-DOMAIN-COM
# certutil -L -d /etc/httpd/alias
# grep NSSNickname /etc/httpd/conf.d/nss.conf
rob
[root@ipa ~]# ipa-getcert list | more
Number of certificates and requests being tracked: 7.
Request ID '20130112120232':
status: SUBMITTING
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-COM',nic
kname='Server-Cert',token='NSS Certificate
DB',pinfile='/etc/dirsrv/slapd-DOMAIN-COM/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-COM',nickname
='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=DOMAIN.COM
subject: CN=ipa.domain.com,O=DOMAIN.COM
expires: 2016-12-16 16:18:27 UTC
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv DOMAIN-COM
track: yes
auto-renew: yes
Request ID '20130112120734':
status: SUBMITTING
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Serve
r-Cert',token='NSS Certificate
DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cer
t',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=DOMAIN.COM
subject: CN=ipa.domain.com,O=DOMAIN.COM
expires: 2016-12-16 16:18:27 UTC
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
7:10 p.m.
2018-02-14 4:55 GMT+08:00 Rob Crittenden <rcritten(a)redhat.com>:
Umarzuki Mochlis wrote:
> 2018-02-13 22:59 GMT+08:00 Rob Crittenden <rcritten(a)redhat.com>:
>> Umarzuki Mochlis via FreeIPA-users wrote:
>>> it stuck with "status: SUBMITTING" when I issue command
"ipa-getcert
>>> list" after I resubmit cert renew "get-cert resubmit -i ID"
>>
>> Which request is stuck? Can you provide the output of ipa-getcert list
>> -i ID?
>>
>> rob
>
> these request still 'submitting' since service started. I resubmit
> them one or two years ago.
The certs are certainly very expired at this point. Do these exist in
reality anymore?
# certutil -L -d /etc/dirsrv/slapd-DOMAIN-COM
# certutil -L -d /etc/httpd/alias
# grep NSSNickname /etc/httpd/conf.d/nss.conf
rob
yes
[root@ipa ~]# certutil -L -d /etc/dirsrv/slapd-DOMAIN-COM
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Server-Cert u,u,u
DOMAIN.COM IPA CA CT,,C
[root@ipa ~]# certutil -L -d /etc/httpd/alias
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Signing-Cert u,u,u
DOMAIN.COM IPA CA CT,C,C
ipaCert u,u,u
Server-Cert u,u,u
[root@ipa ~]# grep NSSNickname /etc/httpd/conf.d/nss.conf
NSSNickname Server-Cert
2:34 p.m.
Umarzuki Mochlis wrote:
2018-02-14 4:55 GMT+08:00 Rob Crittenden
<rcritten(a)redhat.com>:
> Umarzuki Mochlis wrote:
>> 2018-02-13 22:59 GMT+08:00 Rob Crittenden <rcritten(a)redhat.com>:
>>> Umarzuki Mochlis via FreeIPA-users wrote:
>>>> it stuck with "status: SUBMITTING" when I issue command
"ipa-getcert
>>>> list" after I resubmit cert renew "get-cert resubmit -i
ID"
>>>
>>> Which request is stuck? Can you provide the output of ipa-getcert list
>>> -i ID?
>>>
>>> rob
>>
>> these request still 'submitting' since service started. I resubmit
>> them one or two years ago.
>
> The certs are certainly very expired at this point. Do these exist in
> reality anymore?
>
> # certutil -L -d /etc/dirsrv/slapd-DOMAIN-COM
> # certutil -L -d /etc/httpd/alias
> # grep NSSNickname /etc/httpd/conf.d/nss.conf
>
> rob
>
yes
[root@ipa ~]# certutil -L -d /etc/dirsrv/slapd-DOMAIN-COM
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Server-Cert u,u,u
DOMAIN.COM IPA CA CT,,C
[root@ipa ~]# certutil -L -d /etc/httpd/alias
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Signing-Cert u,u,u
DOMAIN.COM IPA CA CT,C,C
ipaCert u,u,u
Server-Cert u,u,u
[root@ipa ~]# grep NSSNickname /etc/httpd/conf.d/nss.conf
NSSNickname Server-Cert
Let me circle back around. So your certs are currently expired and not
working? I assume then that your IPA master is basically dead, and has
been for 2 years?
Your best bet would be to stop ntpd, go back in time, restart httpd,
tomcat andcertmonger to kick off renewal again. Watch the syslog for any
messages from certmonger.
Assuming the certs all get renewed return to current time and run ipactl
restart.
rob
5:26 p.m.
2018-02-15 4:34 GMT+08:00 Rob Crittenden <rcritten(a)redhat.com>:
Let me circle back around. So your certs are currently expired and not
working? I assume then that your IPA master is basically dead, and has
been for 2 years?
Your best bet would be to stop ntpd, go back in time, restart httpd,
tomcat andcertmonger to kick off renewal again. Watch the syslog for any
messages from certmonger.
Assuming the certs all get renewed return to current time and run ipactl
restart.
rob
These are messages after I restarted httpd, tomcat & cermonger
Feb 15 07:15:41 ipa systemd[1]: Stopping Apache Tomcat Web Application
Container...
Feb 15 07:15:41 ipa systemd[1]: tomcat.service: main process exited,
code=exited, status=143/n/a
Feb 15 07:15:41 ipa systemd[1]: Unit tomcat.service entered failed state
Feb 15 07:15:41 ipa systemd[1]: Starting Apache Tomcat Web Application
Container...
Feb 15 07:15:41 ipa systemd[1]: Started Apache Tomcat Web Application Container.
Feb 15 07:15:48 ipa systemd[1]: Stopping Certificate monitoring and
PKI enrollment...
Feb 15 07:15:48 ipa systemd[1]: Starting Certificate monitoring and
PKI enrollment...
Feb 15 07:15:48 ipa systemd[1]: Started Certificate monitoring and PKI
enrollment.
Feb 15 07:15:49 ipa certmonger[21863]: 2015-02-15 07:15:49 [21863]
Server failed request, will retry: 4301 (RPC failed at server.
Certificate operation cannot be completed: Unable to communicate with
CMS (Not Found)).
Feb 15 07:15:49 ipa certmonger[21863]: 2015-02-15 07:15:49 [21863]
Server failed request, will retry: 4301 (RPC failed at server.
Certificate operation cannot be completed: Unable to communicate with
CMS (Not Found)).
2262
days inactive
2263
days old
freeipa-users@lists.fedorahosted.org
8 comments
3 participants
participants (3)
-
Fraser Tweedale -
Rob Crittenden -
Umarzuki Mochlis