Re: Testing requested - certificate checking tool

[SOLER SANGUESA Miguel]

Hello,

I have run the tool on an environment where I've installed my own certificate for HTTPS (following this tutorial: https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP), and it complains when find the root certificate of my certificate:
# python2 ipa-checkcerts.py
ipa: INFO: IPA version 4.6.4-10.el7
IPA version 4.6.4-10.el7
ipa: INFO: Check CA status
Check CA status
ipa: INFO: Check tracking
Check tracking
ipa: INFO: Check NSS trust
Check NSS trust
Traceback (most recent call last):
  File "ipa-checkcerts.py", line 931, in <module>
    sys.exit(c.run())
  File "ipa-checkcerts.py", line 190, in run
    self.check_trust()
  File "ipa-checkcerts.py", line 439, in check_trust
    expected = expected_trust[nickname]
KeyError: 'ICC-root'

Is this normal?
Because I have tried to add a RHEL 6 client and I get the error:
" Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
    Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
    Valid From:  Mon Jan 30 10:52:18 2017 UTC
    Valid Until: Fri Jan 30 10:52:18 2037 UTC

Joining realm failed: libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates"

Thanks & Regards.

Testing requested - certificate checking tool

[Rob Crittenden]

SOLER SANGUESA Miguel via FreeIPA-users wrote:
> Hello,
>
> I have run the tool on an environment where I’ve installed my own
> certificate for HTTPS (following this tutorial:
> https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP),
> and it complains when find the root certificate of my certificate:
>
> # python2 ipa-checkcerts.py
>
> ipa: INFO: IPA version 4.6.4-10.el7
>
> IPA version 4.6.4-10.el7
>
> ipa: INFO: Check CA status
>
> Check CA status
>
> ipa: INFO: Check tracking
>
> Check tracking
>
> ipa: INFO: Check NSS trust
>
> Check NSS trust
>
> Traceback (most recent call last):
>
> File "ipa-checkcerts.py", line 931, in <module>
>
> sys.exit(c.run())
>
> File "ipa-checkcerts.py", line 190, in run
>
> self.check_trust()
>
> File "ipa-checkcerts.py", line 439, in check_trust
>
> expected = expected_trust[nickname]
>
> KeyError: 'ICC-root'
>
> Is this normal?

No, I don't think I ever tested this scenario. I'll take a look.

I did confirm it also fails if you install CA-les.
> Because I have tried to add a RHEL 6 client and I get the error:
>
> " Successfully retrieved CA cert
>
> Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>
> Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>
> Valid From:  Mon Jan 30 10:52:18 2017 UTC
>
> Valid Until: Fri Jan 30 10:52:18 2037 UTC
>
> Joining realm failed: libcurl failed to execute the HTTP POST
> transaction.  Peer certificate cannot be authenticated with known CA
> certificates"

Use ipa-cacert-manage to install the CA of the 3rd party certs you added.

rob

Testing requested - certificate checking tool

[Rob Crittenden]

Rob Crittenden via FreeIPA-users wrote:
> SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > Hello,
> >
> > I have run the tool on an environment where I’ve installed my own
> > certificate for HTTPS (following this tutorial:
> > https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP),
> > and it complains when find the root certificate of my certificate:
> >
> > # python2 ipa-checkcerts.py
> >
> > ipa: INFO: IPA version 4.6.4-10.el7
> >
> > IPA version 4.6.4-10.el7
> >
> > ipa: INFO: Check CA status
> >
> > Check CA status
> >
> > ipa: INFO: Check tracking
> >
> > Check tracking
> >
> > ipa: INFO: Check NSS trust
> >
> > Check NSS trust
> >
> > Traceback (most recent call last):
> >
> > File "ipa-checkcerts.py", line 931, in <module>
> >
> > sys.exit(c.run())
> >
> > File "ipa-checkcerts.py", line 190, in run
> >
> > self.check_trust()
> >
> > File "ipa-checkcerts.py", line 439, in check_trust
> >
> > expected = expected_trust[nickname]
> >
> > KeyError: 'ICC-root'
> >
> > Is this normal?
>
> No, I don't think I ever tested this scenario. I'll take a look.
>
> I did confirm it also fails if you install CA-les.

I reproduced the error and worked around it. It should work now.

rob
> > Because I have tried to add a RHEL 6 client and I get the error:
> >
> > " Successfully retrieved CA cert
> >
> > Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >
> > Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >
> > Valid From:  Mon Jan 30 10:52:18 2017 UTC
> >
> > Valid Until: Fri Jan 30 10:52:18 2037 UTC
> >
> > Joining realm failed: libcurl failed to execute the HTTP POST
> > transaction.  Peer certificate cannot be authenticated with known CA
> > certificates"it is by design to provide
>
> Use ipa-cacert-manage to install the CA of the 3rd party certs you added.
>
> rob
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

Testing requested - certificate checking tool

[SOLER SANGUESA Miguel]

Hello,

Now it works and it shows the real problem I have. I have 2 master, I have changed the HTTP certificate on both (using  ipa-cacert-manage, ipa-certupdate and  ipa-server-certinstall as the manual says), but I one of them has som problems:
[root@masterWRONG ~]# python2 ipa-checkcerts.py
ipa: INFO: IPA version 4.6.4-10.el7
IPA version 4.6.4-10.el7
ipa: INFO: Check CA status
Check CA status
ipa: INFO: Check tracking
Check tracking
ipa: INFO: Check NSS trust
Check NSS trust
ICC-root not found, assuming 3rd party
ICC-Inter not found, assuming 3rd party
ipa: INFO: Check dates
Check dates
ipa: INFO: Checking certificates in CS.cfg
Checking certificates in CS.cfg
ICC-root not found, assuming 3rd party
ICC-Inter not found, assuming 3rd party
ipa: INFO: Comparing certificates to requests in LDAP
Comparing certificates to requests in LDAP
ipa: INFO: Checking RA certificate
Checking RA certificate
ipa: INFO: Checking authorities
Checking authorities
ipa: INFO: Checking host keytab
Checking host keytab
ipa: INFO: Validating certificates
Validating certificates
ipa: INFO: Checking renewal master
Checking renewal master
ipa: INFO: End-to-end cert API test
End-to-end cert API test
ipa: ERROR: ra.get_certificate(): EXCEPTION (Invalid Credential.)
ra.get_certificate(): EXCEPTION (Invalid Credential.)
ipa: INFO: Checking permissions and ownership
Checking permissions and ownership
ipa: INFO: Failures:
Failures:
ipa: INFO: RA agent description does not match 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected
RA agent description does not match 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected
ipa: INFO: cert-show of 1 failed: Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)
cert-show of 1 failed: Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)
ipa: INFO: Warnings:
Warnings:
ipa: INFO: Unknown certmonger ids: 20170817094736
Unknown certmonger ids: 20170817094736

The certificates that complains:
[root@masterGOOD ~]# ipa cert-show 2
  Issuing CA: ipa
  Certificate: MII....
  Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
  Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
  Not Before: Mon Jan 30 10:52:18 2017 UTC
  Not After: Sun Jan 20 10:52:18 2019 UTC
  Serial number: 2
  Serial number (hex): 0x2
  Revoked: False
[root@masterGOOD ~]# ipa cert-show 7
  Issuing CA: ipa
  Certificate: MII....
  Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
  Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
  Not Before: Mon Jan 30 10:53:02 2017 UTC
  Not After: Sun Jan 20 10:53:02 2019 UTC
  Serial number: 7
  Serial number (hex): 0x7
  Revoked: False
[root@masterGOOD ~]# ipa cert-show 268304389
  Issuing CA: ipa
  Certificate: MIID....
  Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
  Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
  Not Before: Mon Dec 24 07:24:20 2018 UTC
  Not After: Sun Dec 13 07:24:20 2020 UTC
  Serial number: 268304389
  Serial number (hex): 0xFFE0005
  Revoked: False

On the other master I get:
[root@masterGOOD ~]# python2 ipa-checkcerts.py
ipa: INFO: IPA version 4.6.4-10.el7
IPA version 4.6.4-10.el7
ipa: INFO: Check CA status
Check CA status
ipa: INFO: Check tracking
Check tracking
ipa: INFO: Check NSS trust
Check NSS trust
ICC-root not found, assuming 3rd party
ICC-Inter not found, assuming 3rd party
ipa: INFO: Check dates
Check dates
ipa: INFO: Checking certificates in CS.cfg
Checking certificates in CS.cfg
ICC-root not found, assuming 3rd party
ICC-Inter not found, assuming 3rd party
ipa: INFO: Comparing certificates to requests in LDAP
Comparing certificates to requests in LDAP
ipa: INFO: Checking RA certificate
Checking RA certificate
ipa: INFO: Checking authorities
Checking authorities
ipa: INFO: Checking host keytab
Checking host keytab
ipa: INFO: Validating certificates
Validating certificates
ipa: INFO: Checking renewal master
Checking renewal master
ipa: INFO: End-to-end cert API test
End-to-end cert API test
ipa: INFO: Checking permissions and ownership
Checking permissions and ownership
ipa: INFO: Failures:
Failures:
ipa: INFO: Unable to find request for serial 268304389
Unable to find request for serial 268304389
ipa: INFO: Unable to find request for serial 268304388
Unable to find request for serial 268304388
ipa: INFO: Unable to find request for serial 268304391
Unable to find request for serial 268304391
ipa: INFO: Unable to find request for serial 268304390
Unable to find request for serial 268304390
ipa: INFO: Unable to find request for serial 268304392
Unable to find request for serial 268304392
ipa: INFO: Warnings:
Warnings:
ipa: INFO: Unknown certmonger ids: 20170817101613
Unknown certmonger ids: 20170817101613

Where the serials correspond the following certs:
[root@masterGOOD ~]# ipa cert-show 268304389
  Issuing CA: ipa
  Certificate: MI....
  Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
  Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
  Not Before: Mon Dec 24 07:24:20 2018 UTC
  Not After: Sun Dec 13 07:24:20 2020 UTC
  Serial number: 268304389
  Serial number (hex): 0xFFE0005
  Revoked: False
[root@masterGOOD ~]# ipa cert-show 268304388
  Issuing CA: ipa
  Certificate: MII....
  Subject: CN=CA Audit,O=IPA.TESTAD.LOCAL
  Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
  Not Before: Mon Dec 24 07:25:10 2018 UTC
  Not After: Sun Dec 13 07:25:10 2020 UTC
  Serial number: 268304388
  Serial number (hex): 0xFFE0004
  Revoked: False
[root@masterGOOD ~]# ipa cert-show 268304391
  Issuing CA: ipa
  Certificate: MII....
  Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
  Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
  Not Before: Mon Dec 24 07:25:00 2018 UTC
  Not After: Sun Dec 13 07:25:00 2020 UTC
  Serial number: 268304391
  Serial number (hex): 0xFFE0007
  Revoked: False
[root@masterGOOD ~]# ipa cert-show 268304390
  Issuing CA: ipa
  Certificate: MII....
  Subject: CN=CA Subsystem,O=IPA.TESTAD.LOCAL
  Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
  Not Before: Mon Dec 24 07:24:41 2018 UTC
  Not After: Sun Dec 13 07:24:41 2020 UTC
  Serial number: 268304390
  Serial number (hex): 0xFFE0006
  Revoked: False
[root@masterGOOD ~]# ipa cert-show 268304392
  Issuing CA: ipa
  Certificate: MII....
  Subject: CN=masterGOOD.ipa.testad.local,O=IPA.TESTAD.LOCAL
  Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
  Not Before: Tue Dec 25 07:24:07 2018 UTC
  Not After: Mon Dec 14 07:24:07 2020 UTC
  Serial number: 268304392
  Serial number (hex): 0xFFE0008
  Revoked: False

I've checked that the following files are different on the 2 masters:
/var/lib/ipa/ra-agent.key
/var/lib/ipa/ra-agent.pem

It has been renewed on masterGOOD but not on masterWRONG:
[root@masterWRONG ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
        Serial Number: 7 (0x7)
            Not Before: Jan 30 10:53:02 2017 GMT
            Not After : Jan 20 10:53:02 2019 GMT
[root@masterGOOD ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
        Serial Number: 268304389 (0xffe0005)
            Not Before: Dec 24 07:24:20 2018 GMT
            Not After : Dec 13 07:24:20 2020 GMT
    		
When I execute "ipa cert-show" on masterWRONG I get the following error:
ipa: ERROR: Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)

I have added a RHEL 7 client to the domain, but I can not add RHEL 6 clients. The CA master was masterWRONG and I have changed to masterGOOD with the procedure explained on https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master
But it still can not add RHEL 6 on the domain.

How can I fix the issue? Is that happening because I changed the auto-signed HTTP certificate to a 3rd party certificate?

Thanks & Regards.

-----Original Message-----
From: Rob Crittenden  
Sent: Thursday, January 03, 2019 21:22
To: FreeIPA users list 
Cc: SOLER SANGUESA Miguel 
Subject: Re: [Freeipa-users] Re: Testing requested - certificate checking tool

Rob Crittenden via FreeIPA-users wrote:
> SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > Hello,
> >
> > I have run the tool on an environment where I’ve installed my own 
> > certificate for HTTPS (following this tutorial:
> > https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDA
> > P), and it complains when find the root certificate of my 
> > certificate:
> >
> > # python2 ipa-checkcerts.py
> >
> > ipa: INFO: IPA version 4.6.4-10.el7
> >
> > IPA version 4.6.4-10.el7
> >
> > ipa: INFO: Check CA status
> >
> > Check CA status
> >
> > ipa: INFO: Check tracking
> >
> > Check tracking
> >
> > ipa: INFO: Check NSS trust
> >
> > Check NSS trust
> >
> > Traceback (most recent call last):
> >
> > File "ipa-checkcerts.py", line 931, in <module>
> >
> > sys.exit(c.run())
> >
> > File "ipa-checkcerts.py", line 190, in run
> >
> > self.check_trust()
> >
> > File "ipa-checkcerts.py", line 439, in check_trust
> >
> > expected = expected_trust[nickname]
> >
> > KeyError: 'ICC-root'
> >
> > Is this normal?
>
> No, I don't think I ever tested this scenario. I'll take a look.
>
> I did confirm it also fails if you install CA-les.

I reproduced the error and worked around it. It should work now.

rob
> > Because I have tried to add a RHEL 6 client and I get the error:
> >
> > " Successfully retrieved CA cert
> >
> > Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >
> > Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >
> > Valid From:  Mon Jan 30 10:52:18 2017 UTC
> >
> > Valid Until: Fri Jan 30 10:52:18 2037 UTC
> >
> > Joining realm failed: libcurl failed to execute the HTTP POST 
> > transaction.  Peer certificate cannot be authenticated with known CA 
> > certificates"it is by design to provide
>
> Use ipa-cacert-manage to install the CA of the 3rd party certs you added.
>
> rob
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to 
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: 
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedorahosted.org/archives/list/[e-mail]
> ahosted.org

Testing requested - certificate checking tool

[Florence Blanc-Renaud]

On 1/9/19 4:21 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> Hello,
>
> Now it works and it shows the real problem I have. I have 2 master, I have changed the HTTP certificate on both (using  ipa-cacert-manage, ipa-certupdate and  ipa-server-certinstall as the manual says), but I one of them has som problems:
> [root@masterWRONG ~]# python2 ipa-checkcerts.py
> ipa: INFO: IPA version 4.6.4-10.el7
> IPA version 4.6.4-10.el7
> ipa: INFO: Check CA status
> Check CA status
> ipa: INFO: Check tracking
> Check tracking
> ipa: INFO: Check NSS trust
> Check NSS trust
> ICC-root not found, assuming 3rd party
> ICC-Inter not found, assuming 3rd party
> ipa: INFO: Check dates
> Check dates
> ipa: INFO: Checking certificates in CS.cfg
> Checking certificates in CS.cfg
> ICC-root not found, assuming 3rd party
> ICC-Inter not found, assuming 3rd party
> ipa: INFO: Comparing certificates to requests in LDAP
> Comparing certificates to requests in LDAP
> ipa: INFO: Checking RA certificate
> Checking RA certificate
> ipa: INFO: Checking authorities
> Checking authorities
> ipa: INFO: Checking host keytab
> Checking host keytab
> ipa: INFO: Validating certificates
> Validating certificates
> ipa: INFO: Checking renewal master
> Checking renewal master
> ipa: INFO: End-to-end cert API test
> End-to-end cert API test
> ipa: ERROR: ra.get_certificate(): EXCEPTION (Invalid Credential.)
> ra.get_certificate(): EXCEPTION (Invalid Credential.)
> ipa: INFO: Checking permissions and ownership
> Checking permissions and ownership
> ipa: INFO: Failures:
> Failures:
> ipa: INFO: RA agent description does not match 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected
> RA agent description does not match 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected
> ipa: INFO: cert-show of 1 failed: Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)
> cert-show of 1 failed: Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)
> ipa: INFO: Warnings:
> Warnings:
> ipa: INFO: Unknown certmonger ids: 20170817094736
> Unknown certmonger ids: 20170817094736
>
> The certificates that complains:
> [root@masterGOOD ~]# ipa cert-show 2
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Jan 30 10:52:18 2017 UTC
>    Not After: Sun Jan 20 10:52:18 2019 UTC
>    Serial number: 2
>    Serial number (hex): 0x2
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 7
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Jan 30 10:53:02 2017 UTC
>    Not After: Sun Jan 20 10:53:02 2019 UTC
>    Serial number: 7
>    Serial number (hex): 0x7
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304389
>    Issuing CA: ipa
>    Certificate: MIID....
>    Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:24:20 2018 UTC
>    Not After: Sun Dec 13 07:24:20 2020 UTC
>    Serial number: 268304389
>    Serial number (hex): 0xFFE0005
>    Revoked: False
>
> On the other master I get:
> [root@masterGOOD ~]# python2 ipa-checkcerts.py
> ipa: INFO: IPA version 4.6.4-10.el7
> IPA version 4.6.4-10.el7
> ipa: INFO: Check CA status
> Check CA status
> ipa: INFO: Check tracking
> Check tracking
> ipa: INFO: Check NSS trust
> Check NSS trust
> ICC-root not found, assuming 3rd party
> ICC-Inter not found, assuming 3rd party
> ipa: INFO: Check dates
> Check dates
> ipa: INFO: Checking certificates in CS.cfg
> Checking certificates in CS.cfg
> ICC-root not found, assuming 3rd party
> ICC-Inter not found, assuming 3rd party
> ipa: INFO: Comparing certificates to requests in LDAP
> Comparing certificates to requests in LDAP
> ipa: INFO: Checking RA certificate
> Checking RA certificate
> ipa: INFO: Checking authorities
> Checking authorities
> ipa: INFO: Checking host keytab
> Checking host keytab
> ipa: INFO: Validating certificates
> Validating certificates
> ipa: INFO: Checking renewal master
> Checking renewal master
> ipa: INFO: End-to-end cert API test
> End-to-end cert API test
> ipa: INFO: Checking permissions and ownership
> Checking permissions and ownership
> ipa: INFO: Failures:
> Failures:
> ipa: INFO: Unable to find request for serial 268304389
> Unable to find request for serial 268304389
> ipa: INFO: Unable to find request for serial 268304388
> Unable to find request for serial 268304388
> ipa: INFO: Unable to find request for serial 268304391
> Unable to find request for serial 268304391
> ipa: INFO: Unable to find request for serial 268304390
> Unable to find request for serial 268304390
> ipa: INFO: Unable to find request for serial 268304392
> Unable to find request for serial 268304392
> ipa: INFO: Warnings:
> Warnings:
> ipa: INFO: Unknown certmonger ids: 20170817101613
> Unknown certmonger ids: 20170817101613
>
> Where the serials correspond the following certs:
> [root@masterGOOD ~]# ipa cert-show 268304389
>    Issuing CA: ipa
>    Certificate: MI....
>    Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:24:20 2018 UTC
>    Not After: Sun Dec 13 07:24:20 2020 UTC
>    Serial number: 268304389
>    Serial number (hex): 0xFFE0005
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304388
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=CA Audit,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:25:10 2018 UTC
>    Not After: Sun Dec 13 07:25:10 2020 UTC
>    Serial number: 268304388
>    Serial number (hex): 0xFFE0004
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304391
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:25:00 2018 UTC
>    Not After: Sun Dec 13 07:25:00 2020 UTC
>    Serial number: 268304391
>    Serial number (hex): 0xFFE0007
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304390
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=CA Subsystem,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:24:41 2018 UTC
>    Not After: Sun Dec 13 07:24:41 2020 UTC
>    Serial number: 268304390
>    Serial number (hex): 0xFFE0006
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304392
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=masterGOOD.ipa.testad.local,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Tue Dec 25 07:24:07 2018 UTC
>    Not After: Mon Dec 14 07:24:07 2020 UTC
>    Serial number: 268304392
>    Serial number (hex): 0xFFE0008
>    Revoked: False
>
> I've checked that the following files are different on the 2 masters:
> /var/lib/ipa/ra-agent.key
> /var/lib/ipa/ra-agent.pem
>
> It has been renewed on masterGOOD but not on masterWRONG:

You can manually copy ra-agent.key and ra-agent.pem from masterGOOD to 
masterWRONG (make a backup first of the files on masterWRONG). This 
should solve the 'ipa cert-show' issue on masterWRONG.
> [root@masterWRONG ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
>          Serial Number: 7 (0x7)
>              Not Before: Jan 30 10:53:02 2017 GMT
>              Not After : Jan 20 10:53:02 2019 GMT
> [root@masterGOOD ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
>          Serial Number: 268304389 (0xffe0005)
>              Not Before: Dec 24 07:24:20 2018 GMT
>              Not After : Dec 13 07:24:20 2020 GMT
>    		
> When I execute "ipa cert-show" on masterWRONG I get the following error:
> ipa: ERROR: Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)
>
> I have added a RHEL 7 client to the domain, but I can not add RHEL 6 clients. The CA master was masterWRONG and I have changed to masterGOOD with the procedure explained on https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master
> But it still can not add RHEL 6 on the domain.

Which error do you see when trying to add a RHEL6 client to the domain? 
Please provide ipaclient-install.log.

HTH,
flo
> How can I fix the issue? Is that happening because I changed the auto-signed HTTP certificate to a 3rd party certificate?
>
> Thanks & Regards.
>
> -----Original Message-----
> From: Rob Crittenden 
> Sent: Thursday, January 03, 2019 21:22
> To: FreeIPA users list 
> Cc: SOLER SANGUESA Miguel 
> Subject: Re: [Freeipa-users] Re: Testing requested - certificate checking tool
>
> Rob Crittenden via FreeIPA-users wrote:
> > SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > > Hello,
> > >
> > > I have run the tool on an environment where I’ve installed my own
> > > certificate for HTTPS (following this tutorial:
> > > https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDA
> > > P), and it complains when find the root certificate of my
> > > certificate:
> > >
> > > # python2 ipa-checkcerts.py
> > >
> > > ipa: INFO: IPA version 4.6.4-10.el7
> > >
> > > IPA version 4.6.4-10.el7
> > >
> > > ipa: INFO: Check CA status
> > >
> > > Check CA status
> > >
> > > ipa: INFO: Check tracking
> > >
> > > Check tracking
> > >
> > > ipa: INFO: Check NSS trust
> > >
> > > Check NSS trust
> > >
> > > Traceback (most recent call last):
> > >
> > > File "ipa-checkcerts.py", line 931, in <module>
> > >
> > > sys.exit(c.run())
> > >
> > > File "ipa-checkcerts.py", line 190, in run
> > >
> > > self.check_trust()
> > >
> > > File "ipa-checkcerts.py", line 439, in check_trust
> > >
> > > expected = expected_trust[nickname]
> > >
> > > KeyError: 'ICC-root'
> > >
> > > Is this normal?
> >
> > No, I don't think I ever tested this scenario. I'll take a look.
> >
> > I did confirm it also fails if you install CA-les.
>
> I reproduced the error and worked around it. It should work now.
>
> rob
> > > Because I have tried to add a RHEL 6 client and I get the error:
> > >
> > > " Successfully retrieved CA cert
> > >
> > > Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >
> > > Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >
> > > Valid From:  Mon Jan 30 10:52:18 2017 UTC
> > >
> > > Valid Until: Fri Jan 30 10:52:18 2037 UTC
> > >
> > > Joining realm failed: libcurl failed to execute the HTTP POST
> > > transaction.  Peer certificate cannot be authenticated with known CA
> > > certificates"it is by design to provide
> >
> > Use ipa-cacert-manage to install the CA of the 3rd party certs you added.
> >
> > rob
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]
> > ahosted.org
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

Testing requested - certificate checking tool

[SOLER SANGUESA Miguel]

Ipa cert-show is working now after copying the certificates, thanks.

The error I get is:
Joining realm failed: libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates

I have attached the full log with debug enabled, it complains about the certificate added for HTTP:
* About to connect() to masterGOOD.ipa.testad.local port 443 (#0)
*   Trying 192.168.107.171... * Connected to masterGOOD.ipa.testad.local (192.168.107.171) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/ipa/ca.crt
  CApath: none
* Certificate is signed by an untrusted issuer: 'CN=company - Secure Server CA 1 - G2,DC=svs,DC=company,DC=org'  <---------------- this CA was added by me because is the CA of the cert for HTTPD
* NSS error -8172
* Expire cleared
* Closing connection #0
libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates

2019-01-10T11:48:57Z ERROR Joining realm failed: XML-RPC CALL:

The certificates I have:
[root@masterWRONG ~]# certutil -L -d /etc/httpd/alias/
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
Signing-Cert                                                 u,u,u
CN=masterWRONG.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX u,u,u   <------- the one I added it
IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
ICC-root                                                     C,,      <--- root certificate of CN=masterWRONG.ipa.testad.local (added by me)
ICC-Inter                                                    C,,      <--- CA added of CN=masterWRONG.ipa.testad.local (added by me)

[root@masterGOOD ipa]# certutil -L -d /etc/httpd/alias/
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
CN=masterGOOD.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX CTu,Cu,Cu <------- the one I added it
IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
ICC-root                                                     C,,    <--- root certificate of CN=masterGOOD.ipa.testad.local (added by me)
ICC-Inter                                                    C,,    <--- CA added of CN=masterGOOD.ipa.testad.local (added by me)

Thanks & Regards.

-----Original Message-----
From: Florence Blanc-Renaud  
Sent: Thursday, January 10, 2019 10:03
To: FreeIPA users list ; Rob Crittenden 
Cc: SOLER SANGUESA Miguel 
Subject: Re: [Freeipa-users] Re: Testing requested - certificate checking tool

On 1/9/19 4:21 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> Hello,
>
> Now it works and it shows the real problem I have. I have 2 master, I have changed the HTTP certificate on both (using  ipa-cacert-manage, ipa-certupdate and  ipa-server-certinstall as the manual says), but I one of them has som problems:
> [root@masterWRONG ~]# python2 ipa-checkcerts.py
> ipa: INFO: IPA version 4.6.4-10.el7
> IPA version 4.6.4-10.el7
> ipa: INFO: Check CA status
> Check CA status
> ipa: INFO: Check tracking
> Check tracking
> ipa: INFO: Check NSS trust
> Check NSS trust
> ICC-root not found, assuming 3rd party ICC-Inter not found, assuming 
> 3rd party
> ipa: INFO: Check dates
> Check dates
> ipa: INFO: Checking certificates in CS.cfg Checking certificates in 
> CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found, 
> assuming 3rd party
> ipa: INFO: Comparing certificates to requests in LDAP Comparing 
> certificates to requests in LDAP
> ipa: INFO: Checking RA certificate
> Checking RA certificate
> ipa: INFO: Checking authorities
> Checking authorities
> ipa: INFO: Checking host keytab
> Checking host keytab
> ipa: INFO: Validating certificates
> Validating certificates
> ipa: INFO: Checking renewal master
> Checking renewal master
> ipa: INFO: End-to-end cert API test
> End-to-end cert API test
> ipa: ERROR: ra.get_certificate(): EXCEPTION (Invalid Credential.)
> ra.get_certificate(): EXCEPTION (Invalid Credential.)
> ipa: INFO: Checking permissions and ownership Checking permissions and 
> ownership
> ipa: INFO: Failures:
> Failures:
> ipa: INFO: RA agent description does not match 
> 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA 
> RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate 
> Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected RA 
> agent description does not match 2;268304389;CN=Certificate 
> Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP and 
> 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA 
> RA,O=IPA.TESTAD.LOCAL expected
> ipa: INFO: cert-show of 1 failed: Certificate operation cannot be 
> completed: EXCEPTION (Invalid Credential.) cert-show of 1 failed: 
> Certificate operation cannot be completed: EXCEPTION (Invalid 
> Credential.)
> ipa: INFO: Warnings:
> Warnings:
> ipa: INFO: Unknown certmonger ids: 20170817094736 Unknown certmonger 
> ids: 20170817094736
>
> The certificates that complains:
> [root@masterGOOD ~]# ipa cert-show 2
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Jan 30 10:52:18 2017 UTC
>    Not After: Sun Jan 20 10:52:18 2019 UTC
>    Serial number: 2
>    Serial number (hex): 0x2
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 7
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Jan 30 10:53:02 2017 UTC
>    Not After: Sun Jan 20 10:53:02 2019 UTC
>    Serial number: 7
>    Serial number (hex): 0x7
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304389
>    Issuing CA: ipa
>    Certificate: MIID....
>    Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:24:20 2018 UTC
>    Not After: Sun Dec 13 07:24:20 2020 UTC
>    Serial number: 268304389
>    Serial number (hex): 0xFFE0005
>    Revoked: False
>
> On the other master I get:
> [root@masterGOOD ~]# python2 ipa-checkcerts.py
> ipa: INFO: IPA version 4.6.4-10.el7
> IPA version 4.6.4-10.el7
> ipa: INFO: Check CA status
> Check CA status
> ipa: INFO: Check tracking
> Check tracking
> ipa: INFO: Check NSS trust
> Check NSS trust
> ICC-root not found, assuming 3rd party ICC-Inter not found, assuming 
> 3rd party
> ipa: INFO: Check dates
> Check dates
> ipa: INFO: Checking certificates in CS.cfg Checking certificates in 
> CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found, 
> assuming 3rd party
> ipa: INFO: Comparing certificates to requests in LDAP Comparing 
> certificates to requests in LDAP
> ipa: INFO: Checking RA certificate
> Checking RA certificate
> ipa: INFO: Checking authorities
> Checking authorities
> ipa: INFO: Checking host keytab
> Checking host keytab
> ipa: INFO: Validating certificates
> Validating certificates
> ipa: INFO: Checking renewal master
> Checking renewal master
> ipa: INFO: End-to-end cert API test
> End-to-end cert API test
> ipa: INFO: Checking permissions and ownership Checking permissions and 
> ownership
> ipa: INFO: Failures:
> Failures:
> ipa: INFO: Unable to find request for serial 268304389 Unable to find 
> request for serial 268304389
> ipa: INFO: Unable to find request for serial 268304388 Unable to find 
> request for serial 268304388
> ipa: INFO: Unable to find request for serial 268304391 Unable to find 
> request for serial 268304391
> ipa: INFO: Unable to find request for serial 268304390 Unable to find 
> request for serial 268304390
> ipa: INFO: Unable to find request for serial 268304392 Unable to find 
> request for serial 268304392
> ipa: INFO: Warnings:
> Warnings:
> ipa: INFO: Unknown certmonger ids: 20170817101613 Unknown certmonger 
> ids: 20170817101613
>
> Where the serials correspond the following certs:
> [root@masterGOOD ~]# ipa cert-show 268304389
>    Issuing CA: ipa
>    Certificate: MI....
>    Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:24:20 2018 UTC
>    Not After: Sun Dec 13 07:24:20 2020 UTC
>    Serial number: 268304389
>    Serial number (hex): 0xFFE0005
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304388
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=CA Audit,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:25:10 2018 UTC
>    Not After: Sun Dec 13 07:25:10 2020 UTC
>    Serial number: 268304388
>    Serial number (hex): 0xFFE0004
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304391
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:25:00 2018 UTC
>    Not After: Sun Dec 13 07:25:00 2020 UTC
>    Serial number: 268304391
>    Serial number (hex): 0xFFE0007
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304390
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=CA Subsystem,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Mon Dec 24 07:24:41 2018 UTC
>    Not After: Sun Dec 13 07:24:41 2020 UTC
>    Serial number: 268304390
>    Serial number (hex): 0xFFE0006
>    Revoked: False
> [root@masterGOOD ~]# ipa cert-show 268304392
>    Issuing CA: ipa
>    Certificate: MII....
>    Subject: CN=masterGOOD.ipa.testad.local,O=IPA.TESTAD.LOCAL
>    Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
>    Not Before: Tue Dec 25 07:24:07 2018 UTC
>    Not After: Mon Dec 14 07:24:07 2020 UTC
>    Serial number: 268304392
>    Serial number (hex): 0xFFE0008
>    Revoked: False
>
> I've checked that the following files are different on the 2 masters:
> /var/lib/ipa/ra-agent.key
> /var/lib/ipa/ra-agent.pem
>
> It has been renewed on masterGOOD but not on masterWRONG:

You can manually copy ra-agent.key and ra-agent.pem from masterGOOD to masterWRONG (make a backup first of the files on masterWRONG). This should solve the 'ipa cert-show' issue on masterWRONG.
> [root@masterWRONG ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
>          Serial Number: 7 (0x7)
>              Not Before: Jan 30 10:53:02 2017 GMT
>              Not After : Jan 20 10:53:02 2019 GMT [root@masterGOOD ~]# 
> openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
>          Serial Number: 268304389 (0xffe0005)
>              Not Before: Dec 24 07:24:20 2018 GMT
>              Not After : Dec 13 07:24:20 2020 GMT
>    		
> When I execute "ipa cert-show" on masterWRONG I get the following error:
> ipa: ERROR: Certificate operation cannot be completed: EXCEPTION 
> (Invalid Credential.)
>
> I have added a RHEL 7 client to the domain, but I can not add RHEL 6 
> clients. The CA master was masterWRONG and I have changed to 
> masterGOOD with the procedure explained on 
> https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Maste
> r But it still can not add RHEL 6 on the domain.

Which error do you see when trying to add a RHEL6 client to the domain? 
Please provide ipaclient-install.log.

HTH,
flo
> How can I fix the issue? Is that happening because I changed the auto-signed HTTP certificate to a 3rd party certificate?
>
> Thanks & Regards.
>
> -----Original Message-----
> From: Rob Crittenden 
> Sent: Thursday, January 03, 2019 21:22
> To: FreeIPA users list 
> Cc: SOLER SANGUESA Miguel 
> Subject: Re: [Freeipa-users] Re: Testing requested - certificate 
> checking tool
>
> Rob Crittenden via FreeIPA-users wrote:
> > SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > > Hello,
> > >
> > > I have run the tool on an environment where I’ve installed my own 
> > > certificate for HTTPS (following this tutorial:
> > > https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LD
> > > A P), and it complains when find the root certificate of my
> > > certificate:
> > >
> > > # python2 ipa-checkcerts.py
> > >
> > > ipa: INFO: IPA version 4.6.4-10.el7
> > >
> > > IPA version 4.6.4-10.el7
> > >
> > > ipa: INFO: Check CA status
> > >
> > > Check CA status
> > >
> > > ipa: INFO: Check tracking
> > >
> > > Check tracking
> > >
> > > ipa: INFO: Check NSS trust
> > >
> > > Check NSS trust
> > >
> > > Traceback (most recent call last):
> > >
> > > File "ipa-checkcerts.py", line 931, in <module>
> > >
> > > sys.exit(c.run())
> > >
> > > File "ipa-checkcerts.py", line 190, in run
> > >
> > > self.check_trust()
> > >
> > > File "ipa-checkcerts.py", line 439, in check_trust
> > >
> > > expected = expected_trust[nickname]
> > >
> > > KeyError: 'ICC-root'
> > >
> > > Is this normal?
> >
> > No, I don't think I ever tested this scenario. I'll take a look.
> >
> > I did confirm it also fails if you install CA-les.
>
> I reproduced the error and worked around it. It should work now.
>
> rob
> > > Because I have tried to add a RHEL 6 client and I get the error:
> > >
> > > " Successfully retrieved CA cert
> > >
> > > Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >
> > > Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >
> > > Valid From:  Mon Jan 30 10:52:18 2017 UTC
> > >
> > > Valid Until: Fri Jan 30 10:52:18 2037 UTC
> > >
> > > Joining realm failed: libcurl failed to execute the HTTP POST 
> > > transaction.  Peer certificate cannot be authenticated with known CA 
> > > certificates"it is by design to provide
> >
> > Use ipa-cacert-manage to install the CA of the 3rd party certs you added.
> >
> > rob
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]
> > r
> > ahosted.org
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to 
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: 
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedorahosted.org/archives/list/[e-mail]
> ahosted.org

Testing requested - certificate checking tool

[Florence Blanc-Renaud]

On 1/10/19 3:24 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> Ipa cert-show is working now after copying the certificates, thanks.
>
> The error I get is:
> Joining realm failed: libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates
>
> I have attached the full log with debug enabled, it complains about the certificate added for HTTP:
> About to connect() to masterGOOD.ipa.testad.local port 443 (#0)
> Trying 192.168.107.171... * Connected to masterGOOD.ipa.testad.local (192.168.107.171) port 443 (#0)
> Initializing NSS with certpath: sql:/etc/pki/nssdb
> CAfile: /etc/ipa/ca.crt

What is the content of /etc/ipa/ca.crt on the client? I suspect it only 
contains the cert for "IPA.TESTAD.LOCAL IPA CA".
IIRC correctly, RHEL 6 clients download the cert from 
cn=CAcert,cn=ipa,cn=etc,$BASEDN (and this entry contains only IPA CA, 
not the external CAs).

To workaround the issue, you can do the following:
1. copy /etc/ipa/ca.crt from the master to the client on /tmp/ipa.crt 
(the file should contain the IPA CA + ICC-root + ICC-Inter).
2. enroll the client by providing --ca-cert-file=/tmp/ipa.crt

HTH,
flo
> CApath: none
> Certificate is signed by an untrusted issuer: 'CN=company - Secure Server CA 1 - G2,DC=svs,DC=company,DC=org'  <---------------- this CA was added by me because is the CA of the cert for HTTPD
> NSS error -8172
> Expire cleared
> Closing connection #0
>
> libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates
>
> 2019-01-10T11:48:57Z ERROR Joining realm failed: XML-RPC CALL:
>
> The certificates I have:
> [root@masterWRONG ~]# certutil -L -d /etc/httpd/alias/
> Certificate Nickname                                         Trust Attributes
>                                                               SSL,S/MIME,JAR/XPI
> Signing-Cert                                                 u,u,u
> CN=masterWRONG.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX u,u,u   <------- the one I added it
> IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
> ICC-root                                                     C,,      <--- root certificate of CN=masterWRONG.ipa.testad.local (added by me)
> ICC-Inter                                                    C,,      <--- CA added of CN=masterWRONG.ipa.testad.local (added by me)
>
> [root@masterGOOD ipa]# certutil -L -d /etc/httpd/alias/
> Certificate Nickname                                         Trust Attributes
>                                                               SSL,S/MIME,JAR/XPI
> CN=masterGOOD.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX CTu,Cu,Cu <------- the one I added it
> IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
> ICC-root                                                     C,,    <--- root certificate of CN=masterGOOD.ipa.testad.local (added by me)
> ICC-Inter                                                    C,,    <--- CA added of CN=masterGOOD.ipa.testad.local (added by me)
>
> Thanks & Regards.
>
> -----Original Message-----
> From: Florence Blanc-Renaud 
> Sent: Thursday, January 10, 2019 10:03
> To: FreeIPA users list ; Rob Crittenden 
> Cc: SOLER SANGUESA Miguel 
> Subject: Re: [Freeipa-users] Re: Testing requested - certificate checking tool
>
> On 1/9/19 4:21 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > Hello,
> >
> > Now it works and it shows the real problem I have. I have 2 master, I have changed the HTTP certificate on both (using  ipa-cacert-manage, ipa-certupdate and  ipa-server-certinstall as the manual says), but I one of them has som problems:
> > [root@masterWRONG ~]# python2 ipa-checkcerts.py
> > ipa: INFO: IPA version 4.6.4-10.el7
> > IPA version 4.6.4-10.el7
> > ipa: INFO: Check CA status
> > Check CA status
> > ipa: INFO: Check tracking
> > Check tracking
> > ipa: INFO: Check NSS trust
> > Check NSS trust
> > ICC-root not found, assuming 3rd party ICC-Inter not found, assuming
> > 3rd party
> > ipa: INFO: Check dates
> > Check dates
> > ipa: INFO: Checking certificates in CS.cfg Checking certificates in
> > CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found,
> > assuming 3rd party
> > ipa: INFO: Comparing certificates to requests in LDAP Comparing
> > certificates to requests in LDAP
> > ipa: INFO: Checking RA certificate
> > Checking RA certificate
> > ipa: INFO: Checking authorities
> > Checking authorities
> > ipa: INFO: Checking host keytab
> > Checking host keytab
> > ipa: INFO: Validating certificates
> > Validating certificates
> > ipa: INFO: Checking renewal master
> > Checking renewal master
> > ipa: INFO: End-to-end cert API test
> > End-to-end cert API test
> > ipa: ERROR: ra.get_certificate(): EXCEPTION (Invalid Credential.)
> > ra.get_certificate(): EXCEPTION (Invalid Credential.)
> > ipa: INFO: Checking permissions and ownership Checking permissions and
> > ownership
> > ipa: INFO: Failures:
> > Failures:
> > ipa: INFO: RA agent description does not match
> > 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA
> > RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate
> > Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected RA
> > agent description does not match 2;268304389;CN=Certificate
> > Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP and
> > 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA
> > RA,O=IPA.TESTAD.LOCAL expected
> > ipa: INFO: cert-show of 1 failed: Certificate operation cannot be
> > completed: EXCEPTION (Invalid Credential.) cert-show of 1 failed:
> > Certificate operation cannot be completed: EXCEPTION (Invalid
> > Credential.)
> > ipa: INFO: Warnings:
> > Warnings:
> > ipa: INFO: Unknown certmonger ids: 20170817094736 Unknown certmonger
> > ids: 20170817094736
> >
> > The certificates that complains:
> > [root@masterGOOD ~]# ipa cert-show 2
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Jan 30 10:52:18 2017 UTC
> >     Not After: Sun Jan 20 10:52:18 2019 UTC
> >     Serial number: 2
> >     Serial number (hex): 0x2
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 7
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Jan 30 10:53:02 2017 UTC
> >     Not After: Sun Jan 20 10:53:02 2019 UTC
> >     Serial number: 7
> >     Serial number (hex): 0x7
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304389
> >     Issuing CA: ipa
> >     Certificate: MIID....
> >     Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:24:20 2018 UTC
> >     Not After: Sun Dec 13 07:24:20 2020 UTC
> >     Serial number: 268304389
> >     Serial number (hex): 0xFFE0005
> >     Revoked: False
> >
> > On the other master I get:
> > [root@masterGOOD ~]# python2 ipa-checkcerts.py
> > ipa: INFO: IPA version 4.6.4-10.el7
> > IPA version 4.6.4-10.el7
> > ipa: INFO: Check CA status
> > Check CA status
> > ipa: INFO: Check tracking
> > Check tracking
> > ipa: INFO: Check NSS trust
> > Check NSS trust
> > ICC-root not found, assuming 3rd party ICC-Inter not found, assuming
> > 3rd party
> > ipa: INFO: Check dates
> > Check dates
> > ipa: INFO: Checking certificates in CS.cfg Checking certificates in
> > CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found,
> > assuming 3rd party
> > ipa: INFO: Comparing certificates to requests in LDAP Comparing
> > certificates to requests in LDAP
> > ipa: INFO: Checking RA certificate
> > Checking RA certificate
> > ipa: INFO: Checking authorities
> > Checking authorities
> > ipa: INFO: Checking host keytab
> > Checking host keytab
> > ipa: INFO: Validating certificates
> > Validating certificates
> > ipa: INFO: Checking renewal master
> > Checking renewal master
> > ipa: INFO: End-to-end cert API test
> > End-to-end cert API test
> > ipa: INFO: Checking permissions and ownership Checking permissions and
> > ownership
> > ipa: INFO: Failures:
> > Failures:
> > ipa: INFO: Unable to find request for serial 268304389 Unable to find
> > request for serial 268304389
> > ipa: INFO: Unable to find request for serial 268304388 Unable to find
> > request for serial 268304388
> > ipa: INFO: Unable to find request for serial 268304391 Unable to find
> > request for serial 268304391
> > ipa: INFO: Unable to find request for serial 268304390 Unable to find
> > request for serial 268304390
> > ipa: INFO: Unable to find request for serial 268304392 Unable to find
> > request for serial 268304392
> > ipa: INFO: Warnings:
> > Warnings:
> > ipa: INFO: Unknown certmonger ids: 20170817101613 Unknown certmonger
> > ids: 20170817101613
> >
> > Where the serials correspond the following certs:
> > [root@masterGOOD ~]# ipa cert-show 268304389
> >     Issuing CA: ipa
> >     Certificate: MI....
> >     Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:24:20 2018 UTC
> >     Not After: Sun Dec 13 07:24:20 2020 UTC
> >     Serial number: 268304389
> >     Serial number (hex): 0xFFE0005
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304388
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=CA Audit,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:25:10 2018 UTC
> >     Not After: Sun Dec 13 07:25:10 2020 UTC
> >     Serial number: 268304388
> >     Serial number (hex): 0xFFE0004
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304391
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:25:00 2018 UTC
> >     Not After: Sun Dec 13 07:25:00 2020 UTC
> >     Serial number: 268304391
> >     Serial number (hex): 0xFFE0007
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304390
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=CA Subsystem,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:24:41 2018 UTC
> >     Not After: Sun Dec 13 07:24:41 2020 UTC
> >     Serial number: 268304390
> >     Serial number (hex): 0xFFE0006
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304392
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=masterGOOD.ipa.testad.local,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Tue Dec 25 07:24:07 2018 UTC
> >     Not After: Mon Dec 14 07:24:07 2020 UTC
> >     Serial number: 268304392
> >     Serial number (hex): 0xFFE0008
> >     Revoked: False
> >
> > I've checked that the following files are different on the 2 masters:
> > /var/lib/ipa/ra-agent.key
> > /var/lib/ipa/ra-agent.pem
> >
> > It has been renewed on masterGOOD but not on masterWRONG:
>
> You can manually copy ra-agent.key and ra-agent.pem from masterGOOD to masterWRONG (make a backup first of the files on masterWRONG). This should solve the 'ipa cert-show' issue on masterWRONG.
> > [root@masterWRONG ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
> >           Serial Number: 7 (0x7)
> >               Not Before: Jan 30 10:53:02 2017 GMT
> >               Not After : Jan 20 10:53:02 2019 GMT [root@masterGOOD ~]#
> > openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
> >           Serial Number: 268304389 (0xffe0005)
> >               Not Before: Dec 24 07:24:20 2018 GMT
> >               Not After : Dec 13 07:24:20 2020 GMT
> >    		
> > When I execute "ipa cert-show" on masterWRONG I get the following error:
> > ipa: ERROR: Certificate operation cannot be completed: EXCEPTION
> > (Invalid Credential.)
> >
> > I have added a RHEL 7 client to the domain, but I can not add RHEL 6
> > clients. The CA master was masterWRONG and I have changed to
> > masterGOOD with the procedure explained on
> > https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Maste
> > r But it still can not add RHEL 6 on the domain.
>
> Which error do you see when trying to add a RHEL6 client to the domain?
> Please provide ipaclient-install.log.
>
> HTH,
> flo
> > How can I fix the issue? Is that happening because I changed the auto-signed HTTP certificate to a 3rd party certificate?
> >
> > Thanks & Regards.
> >
> > -----Original Message-----
> > From: Rob Crittenden 
> > Sent: Thursday, January 03, 2019 21:22
> > To: FreeIPA users list 
> > Cc: SOLER SANGUESA Miguel 
> > Subject: Re: [Freeipa-users] Re: Testing requested - certificate
> > checking tool
> >
> > Rob Crittenden via FreeIPA-users wrote:
> > > SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > > > Hello,
> > > >
> > > > I have run the tool on an environment where I’ve installed my own
> > > > certificate for HTTPS (following this tutorial:
> > > > https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LD
> > > > A P), and it complains when find the root certificate of my
> > > > certificate:
> > > >
> > > > # python2 ipa-checkcerts.py
> > > >
> > > > ipa: INFO: IPA version 4.6.4-10.el7
> > > >
> > > > IPA version 4.6.4-10.el7
> > > >
> > > > ipa: INFO: Check CA status
> > > >
> > > > Check CA status
> > > >
> > > > ipa: INFO: Check tracking
> > > >
> > > > Check tracking
> > > >
> > > > ipa: INFO: Check NSS trust
> > > >
> > > > Check NSS trust
> > > >
> > > > Traceback (most recent call last):
> > > >
> > > > File "ipa-checkcerts.py", line 931, in <module>
> > > >
> > > > sys.exit(c.run())
> > > >
> > > > File "ipa-checkcerts.py", line 190, in run
> > > >
> > > > self.check_trust()
> > > >
> > > > File "ipa-checkcerts.py", line 439, in check_trust
> > > >
> > > > expected = expected_trust[nickname]
> > > >
> > > > KeyError: 'ICC-root'
> > > >
> > > > Is this normal?
> > >
> > > No, I don't think I ever tested this scenario. I'll take a look.
> > >
> > > I did confirm it also fails if you install CA-les.
> >
> > I reproduced the error and worked around it. It should work now.
> >
> > rob
> > > > Because I have tried to add a RHEL 6 client and I get the error:
> > > >
> > > > " Successfully retrieved CA cert
> > > >
> > > > Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > > >
> > > > Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > > >
> > > > Valid From:  Mon Jan 30 10:52:18 2017 UTC
> > > >
> > > > Valid Until: Fri Jan 30 10:52:18 2037 UTC
> > > >
> > > > Joining realm failed: libcurl failed to execute the HTTP POST
> > > > transaction.  Peer certificate cannot be authenticated with known CA
> > > > certificates"it is by design to provide
> > >
> > > Use ipa-cacert-manage to install the CA of the 3rd party certs you added.
> > >
> > > rob
> > > _______________________________________________
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
> > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > > https://lists.fedorahosted.org/archives/list/[e-mail]
> > > r
> > > ahosted.org
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]
> > ahosted.org
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

Testing requested - certificate checking tool

[SOLER SANGUESA Miguel]

You are right, on the client /etc/ipa/ca.crt has just the IPA CA, but on the servers it has 3 certificates:
- IPA CA
- ICC-inter
- ICC-root

The workaround didn’t work, despite it seems that reads the new file:
2019-01-11T10:28:35Z DEBUG trying to retrieve CA cert from file /tmp/ipa.crt
2019-01-11T10:28:35Z DEBUG CA cert provided by user, use it!
2019-01-11T10:28:36Z DEBUG args=/usr/sbin/ipa-join -s masterGOOD.ipa.testad.local -b dc=ipa,dc=testad,dc=local -d -h client.svc.company.org

But finally I got the same result:
* About to connect() to masterGOOD.ipa.testad.local port 443 (#0)
*   Trying 192.168.107.171... * Connected to masterGOOD.ipa.testad.local (192.168.107.171) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/ipa/ca.crt
  CApath: none
* Certificate is signed by an untrusted issuer: 'CN=COMPANY - Secure Server CA 1 - G2,DC=svs,DC=unicc,DC=org'
* NSS error -8172
* Expire cleared
* Closing connection #0
libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates
2019-01-11T10:28:36Z ERROR Joining realm failed: XML-RPC CALL:

Anyway, I have overwrited /etc/ipa/ca.crt with the file from the masters and then the installation was OK.

Now just I want to know:
1) can I do something to fix permanently the problem and not to copy the certificate on all new RHEL 6 servers before install client?
2) if the problem was caused because I installed wrongly the certificates. Can you  please let me know the correct way?
3) if it is a bug. Has been fixed on newer releases or it is planned on future releases?

Thank you very much.

On 1/10/19 3:24 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> Ipa cert-show is working now after copying the certificates, thanks.
>
> The error I get is:
> Joining realm failed: libcurl failed to execute the HTTP POST 
> transaction.  Peer certificate cannot be authenticated with known CA 
> certificates
>
> I have attached the full log with debug enabled, it complains about the certificate added for HTTP:
> About to connect() to masterGOOD.ipa.testad.local port 443 (#0)
> Trying 192.168.107.171... * Connected to masterGOOD.ipa.testad.local (192.168.107.171) port 443 (#0)
> Initializing NSS with certpath: sql:/etc/pki/nssdb
> CAfile: /etc/ipa/ca.crt

What is the content of /etc/ipa/ca.crt on the client? I suspect it only contains the cert for "IPA.TESTAD.LOCAL IPA CA".
IIRC correctly, RHEL 6 clients download the cert from cn=CAcert,cn=ipa,cn=etc,$BASEDN (and this entry contains only IPA CA, not the external CAs).

To workaround the issue, you can do the following:
1. copy /etc/ipa/ca.crt from the master to the client on /tmp/ipa.crt (the file should contain the IPA CA + ICC-root + ICC-Inter).
2. enroll the client by providing --ca-cert-file=/tmp/ipa.crt

HTH,
flo
> CApath: none
> Certificate is signed by an untrusted issuer: 'CN=company - Secure
>
> Server CA 1 - G2,DC=svs,DC=company,DC=org'  <---------------- this CA 
> was added by me because is the CA of the cert for HTTPD
> NSS error -8172
> Expire cleared
> Closing connection #0
>
> libcurl failed to execute the HTTP POST transaction.  Peer certificate 
> cannot be authenticated with known CA certificates
>
> 2019-01-10T11:48:57Z ERROR Joining realm failed: XML-RPC CALL:
>
> The certificates I have:
> [root@masterWRONG ~]# certutil -L -d /etc/httpd/alias/
> Certificate Nickname                                         Trust Attributes
>                                                               SSL,S/MIME,JAR/XPI
> Signing-Cert                                                 u,u,u
> CN=masterWRONG.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX u,u,u   <------- the one I added it
> IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
> ICC-root                                                     C,,      <--- root certificate of CN=masterWRONG.ipa.testad.local (added by me)
> ICC-Inter                                                    C,,      <--- CA added of CN=masterWRONG.ipa.testad.local (added by me)
>
> [root@masterGOOD ipa]# certutil -L -d /etc/httpd/alias/
> Certificate Nickname                                         Trust Attributes
>
> SSL,S/MIME,JAR/XPI CN=masterGOOD.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX CTu,Cu,Cu <------- the one I added it
> IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
> ICC-root                                                     C,,    <--- root certificate of CN=masterGOOD.ipa.testad.local (added by me)
> ICC-Inter                                                    C,,    <--- CA added of CN=masterGOOD.ipa.testad.local (added by me)
>
> Thanks & Regards.
>
> -----Original Message-----
> From: Florence Blanc-Renaud 
> Sent: Thursday, January 10, 2019 10:03
> To: FreeIPA users list ; Rob 
> Crittenden 
> Cc: SOLER SANGUESA Miguel 
> Subject: Re: [Freeipa-users] Re: Testing requested - certificate 
> checking tool
>
> On 1/9/19 4:21 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > Hello,
> >
> > Now it works and it shows the real problem I have. I have 2 master, I have changed the HTTP certificate on both (using  ipa-cacert-manage, ipa-certupdate and  ipa-server-certinstall as the manual says), but I one of them has som problems:
> > [root@masterWRONG ~]# python2 ipa-checkcerts.py
> > ipa: INFO: IPA version 4.6.4-10.el7
> > IPA version 4.6.4-10.el7
> > ipa: INFO: Check CA status
> > Check CA status
> > ipa: INFO: Check tracking
> > Check tracking
> > ipa: INFO: Check NSS trust
> > Check NSS trust
> > ICC-root not found, assuming 3rd party ICC-Inter not found, assuming 
> > 3rd party
> > ipa: INFO: Check dates
> > Check dates
> > ipa: INFO: Checking certificates in CS.cfg Checking certificates in 
> > CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found, 
> > assuming 3rd party
> > ipa: INFO: Comparing certificates to requests in LDAP Comparing 
> > certificates to requests in LDAP
> > ipa: INFO: Checking RA certificate
> > Checking RA certificate
> > ipa: INFO: Checking authorities
> > Checking authorities
> > ipa: INFO: Checking host keytab
> > Checking host keytab
> > ipa: INFO: Validating certificates
> > Validating certificates
> > ipa: INFO: Checking renewal master
> > Checking renewal master
> > ipa: INFO: End-to-end cert API test
> > End-to-end cert API test
> > ipa: ERROR: ra.get_certificate(): EXCEPTION (Invalid Credential.)
> > ra.get_certificate(): EXCEPTION (Invalid Credential.)
> > ipa: INFO: Checking permissions and ownership Checking permissions 
> > and ownership
> > ipa: INFO: Failures:
> > Failures:
> > ipa: INFO: RA agent description does not match 
> > 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA
> > RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate 
> > Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected RA 
> > agent description does not match 2;268304389;CN=Certificate 
> > Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP and 
> > 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA
> > RA,O=IPA.TESTAD.LOCAL expected
> > ipa: INFO: cert-show of 1 failed: Certificate operation cannot be
> > completed: EXCEPTION (Invalid Credential.) cert-show of 1 failed:
> > Certificate operation cannot be completed: EXCEPTION (Invalid
> > Credential.)
> > ipa: INFO: Warnings:
> > Warnings:
> > ipa: INFO: Unknown certmonger ids: 20170817094736 Unknown certmonger
> > ids: 20170817094736
> >
> > The certificates that complains:
> > [root@masterGOOD ~]# ipa cert-show 2
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Jan 30 10:52:18 2017 UTC
> >     Not After: Sun Jan 20 10:52:18 2019 UTC
> >     Serial number: 2
> >     Serial number (hex): 0x2
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 7
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Jan 30 10:53:02 2017 UTC
> >     Not After: Sun Jan 20 10:53:02 2019 UTC
> >     Serial number: 7
> >     Serial number (hex): 0x7
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304389
> >     Issuing CA: ipa
> >     Certificate: MIID....
> >     Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:24:20 2018 UTC
> >     Not After: Sun Dec 13 07:24:20 2020 UTC
> >     Serial number: 268304389
> >     Serial number (hex): 0xFFE0005
> >     Revoked: False
> >
> > On the other master I get:
> > [root@masterGOOD ~]# python2 ipa-checkcerts.py
> > ipa: INFO: IPA version 4.6.4-10.el7
> > IPA version 4.6.4-10.el7
> > ipa: INFO: Check CA status
> > Check CA status
> > ipa: INFO: Check tracking
> > Check tracking
> > ipa: INFO: Check NSS trust
> > Check NSS trust
> > ICC-root not found, assuming 3rd party ICC-Inter not found, assuming 
> > 3rd party
> > ipa: INFO: Check dates
> > Check dates
> > ipa: INFO: Checking certificates in CS.cfg Checking certificates in 
> > CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found, 
> > assuming 3rd party
> > ipa: INFO: Comparing certificates to requests in LDAP Comparing 
> > certificates to requests in LDAP
> > ipa: INFO: Checking RA certificate
> > Checking RA certificate
> > ipa: INFO: Checking authorities
> > Checking authorities
> > ipa: INFO: Checking host keytab
> > Checking host keytab
> > ipa: INFO: Validating certificates
> > Validating certificates
> > ipa: INFO: Checking renewal master
> > Checking renewal master
> > ipa: INFO: End-to-end cert API test
> > End-to-end cert API test
> > ipa: INFO: Checking permissions and ownership Checking permissions 
> > and ownership
> > ipa: INFO: Failures:
> > Failures:
> > ipa: INFO: Unable to find request for serial 268304389 Unable to find 
> > request for serial 268304389
> > ipa: INFO: Unable to find request for serial 268304388 Unable to find 
> > request for serial 268304388
> > ipa: INFO: Unable to find request for serial 268304391 Unable to find 
> > request for serial 268304391
> > ipa: INFO: Unable to find request for serial 268304390 Unable to find 
> > request for serial 268304390
> > ipa: INFO: Unable to find request for serial 268304392 Unable to find 
> > request for serial 268304392
> > ipa: INFO: Warnings:
> > Warnings:
> > ipa: INFO: Unknown certmonger ids: 20170817101613 Unknown certmonger
> > ids: 20170817101613
> >
> > Where the serials correspond the following certs:
> > [root@masterGOOD ~]# ipa cert-show 268304389
> >     Issuing CA: ipa
> >     Certificate: MI....
> >     Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:24:20 2018 UTC
> >     Not After: Sun Dec 13 07:24:20 2020 UTC
> >     Serial number: 268304389
> >     Serial number (hex): 0xFFE0005
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304388
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=CA Audit,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:25:10 2018 UTC
> >     Not After: Sun Dec 13 07:25:10 2020 UTC
> >     Serial number: 268304388
> >     Serial number (hex): 0xFFE0004
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304391
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:25:00 2018 UTC
> >     Not After: Sun Dec 13 07:25:00 2020 UTC
> >     Serial number: 268304391
> >     Serial number (hex): 0xFFE0007
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304390
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=CA Subsystem,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Mon Dec 24 07:24:41 2018 UTC
> >     Not After: Sun Dec 13 07:24:41 2020 UTC
> >     Serial number: 268304390
> >     Serial number (hex): 0xFFE0006
> >     Revoked: False
> > [root@masterGOOD ~]# ipa cert-show 268304392
> >     Issuing CA: ipa
> >     Certificate: MII....
> >     Subject: CN=masterGOOD.ipa.testad.local,O=IPA.TESTAD.LOCAL
> >     Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> >     Not Before: Tue Dec 25 07:24:07 2018 UTC
> >     Not After: Mon Dec 14 07:24:07 2020 UTC
> >     Serial number: 268304392
> >     Serial number (hex): 0xFFE0008
> >     Revoked: False
> >
> > I've checked that the following files are different on the 2 masters:
> > /var/lib/ipa/ra-agent.key
> > /var/lib/ipa/ra-agent.pem
> >
> > It has been renewed on masterGOOD but not on masterWRONG:
>
> You can manually copy ra-agent.key and ra-agent.pem from masterGOOD to masterWRONG (make a backup first of the files on masterWRONG). This should solve the 'ipa cert-show' issue on masterWRONG.
> > [root@masterWRONG ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
> >           Serial Number: 7 (0x7)
> >               Not Before: Jan 30 10:53:02 2017 GMT
> >               Not After : Jan 20 10:53:02 2019 GMT [root@masterGOOD 
> > ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
> >           Serial Number: 268304389 (0xffe0005)
> >               Not Before: Dec 24 07:24:20 2018 GMT
> >               Not After : Dec 13 07:24:20 2020 GMT
> >    		
> > When I execute "ipa cert-show" on masterWRONG I get the following error:
> > ipa: ERROR: Certificate operation cannot be completed: EXCEPTION 
> > (Invalid Credential.)
> >
> > I have added a RHEL 7 client to the domain, but I can not add RHEL 6 
> > clients. The CA master was masterWRONG and I have changed to 
> > masterGOOD with the procedure explained on 
> > https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Mast
> > e r But it still can not add RHEL 6 on the domain.
>
> Which error do you see when trying to add a RHEL6 client to the domain?
> Please provide ipaclient-install.log.
>
> HTH,
> flo
> > How can I fix the issue? Is that happening because I changed the auto-signed HTTP certificate to a 3rd party certificate?
> >
> > Thanks & Regards.
> >
> > -----Original Message-----
> > From: Rob Crittenden 
> > Sent: Thursday, January 03, 2019 21:22
> > To: FreeIPA users list 
> > Cc: SOLER SANGUESA Miguel 
> > Subject: Re: [Freeipa-users] Re: Testing requested - certificate 
> > checking tool
> >
> > Rob Crittenden via FreeIPA-users wrote:
> > > SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > > > Hello,
> > > >
> > > > I have run the tool on an environment where I’ve installed my own 
> > > > certificate for HTTPS (following this tutorial:
> > > > https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/L
> > > > D A P), and it complains when find the root certificate of my
> > > > certificate:
> > > >
> > > > # python2 ipa-checkcerts.py
> > > >
> > > > ipa: INFO: IPA version 4.6.4-10.el7
> > > >
> > > > IPA version 4.6.4-10.el7
> > > >
> > > > ipa: INFO: Check CA status
> > > >
> > > > Check CA status
> > > >
> > > > ipa: INFO: Check tracking
> > > >
> > > > Check tracking
> > > >
> > > > ipa: INFO: Check NSS trust
> > > >
> > > > Check NSS trust
> > > >
> > > > Traceback (most recent call last):
> > > >
> > > > File "ipa-checkcerts.py", line 931, in <module>
> > > >
> > > > sys.exit(c.run())
> > > >
> > > > File "ipa-checkcerts.py", line 190, in run
> > > >
> > > > self.check_trust()
> > > >
> > > > File "ipa-checkcerts.py", line 439, in check_trust
> > > >
> > > > expected = expected_trust[nickname]
> > > >
> > > > KeyError: 'ICC-root'
> > > >
> > > > Is this normal?
> > >
> > > No, I don't think I ever tested this scenario. I'll take a look.
> > >
> > > I did confirm it also fails if you install CA-les.
> >
> > I reproduced the error and worked around it. It should work now.
> >
> > rob
> > > > Because I have tried to add a RHEL 6 client and I get the error:
> > > >
> > > > " Successfully retrieved CA cert
> > > >
> > > > Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > > >
> > > > Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > > >
> > > > Valid From:  Mon Jan 30 10:52:18 2017 UTC
> > > >
> > > > Valid Until: Fri Jan 30 10:52:18 2037 UTC
> > > >
> > > > Joining realm failed: libcurl failed to execute the HTTP POST 
> > > > transaction.  Peer certificate cannot be authenticated with known 
> > > > CA certificates"it is by design to provide
> > >
> > > Use ipa-cacert-manage to install the CA of the 3rd party certs you added.
> > >
> > > rob
> > > _______________________________________________
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
> > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > > https://lists.fedorahosted.org/archives/list/[e-mail]
> > > o
> > > r
> > > ahosted.org
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]
> > r
> > ahosted.org
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to 
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: 
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedorahosted.org/archives/list/[e-mail]
> ahosted.org

Testing requested - certificate checking tool

[Florence Blanc-Renaud]

On 1/11/19 12:12 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> You are right, on the client /etc/ipa/ca.crt has just the IPA CA, but on the servers it has 3 certificates:
> IPA CA
> ICC-inter
> ICC-root
>
> The workaround didn’t work, despite it seems that reads the new file:
> 2019-01-11T10:28:35Z DEBUG trying to retrieve CA cert from file /tmp/ipa.crt
> 2019-01-11T10:28:35Z DEBUG CA cert provided by user, use it!
> 2019-01-11T10:28:36Z DEBUG args=/usr/sbin/ipa-join -s masterGOOD.ipa.testad.local -b dc=ipa,dc=testad,dc=local -d -h client.svc.company.org
>
> But finally I got the same result:
> About to connect() to masterGOOD.ipa.testad.local port 443 (#0)
> Trying 192.168.107.171... * Connected to masterGOOD.ipa.testad.local (192.168.107.171) port 443 (#0)
> Initializing NSS with certpath: sql:/etc/pki/nssdb
> CAfile: /etc/ipa/ca.crt
> CApath: none
> Certificate is signed by an untrusted issuer: 'CN=COMPANY - Secure Server CA 1 - G2,DC=svs,DC=unicc,DC=org'
> NSS error -8172
> Expire cleared
> Closing connection #0
>
> libcurl failed to execute the HTTP POST transaction.  Peer certificate cannot be authenticated with known CA certificates
> 2019-01-11T10:28:36Z ERROR Joining realm failed: XML-RPC CALL:
>
> Anyway, I have overwrited /etc/ipa/ca.crt with the file from the masters and then the installation was OK.
>
> Now just I want to know:
> can I do something to fix permanently the problem and not to copy the certificate on all new RHEL 6 servers before install client?
> if the problem was caused because I installed wrongly the certificates. Can you  please let me know the correct way?
> if it is a bug. Has been fixed on newer releases or it is planned on future releases?

Hi,

this behavior is a limitation of RHEL 6, please see the note in 
"Managing certificates and certificate authorities" in IdM guide for 
RHEL 6 [1]:
---
Using more than one certificate authority (CA) signing certificate 
within your IdM environment is not supported in Red Hat Enterprise Linux 
6. To support this configuration, upgrade your IdM systems to Red Hat 
Enterprise Linux 7.
---

This has been solved in RHEL 7, and RHEL 7 clients are able to enroll 
even if multiple CAs are defined (IPA CA and the CA for the apache/ldap 
certs).

Hope this clarifies,
flo

[1] 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/htm...
> Thank you very much.
>
> On 1/10/19 3:24 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > Ipa cert-show is working now after copying the certificates, thanks.
> >
> > The error I get is:
> > Joining realm failed: libcurl failed to execute the HTTP POST
> > transaction.  Peer certificate cannot be authenticated with known CA
> > certificates
> >
> > I have attached the full log with debug enabled, it complains about the certificate added for HTTP:
> > About to connect() to masterGOOD.ipa.testad.local port 443 (#0)
> > Trying 192.168.107.171... * Connected to masterGOOD.ipa.testad.local (192.168.107.171) port 443 (#0)
> > Initializing NSS with certpath: sql:/etc/pki/nssdb
> > CAfile: /etc/ipa/ca.crt
>
> What is the content of /etc/ipa/ca.crt on the client? I suspect it only contains the cert for "IPA.TESTAD.LOCAL IPA CA".
> IIRC correctly, RHEL 6 clients download the cert from cn=CAcert,cn=ipa,cn=etc,$BASEDN (and this entry contains only IPA CA, not the external CAs).
>
> To workaround the issue, you can do the following:
> copy /etc/ipa/ca.crt from the master to the client on /tmp/ipa.crt (the file should contain the IPA CA + ICC-root + ICC-Inter).
> enroll the client by providing --ca-cert-file=/tmp/ipa.crt
>
> HTH,
> flo
> > CApath: none
> > Certificate is signed by an untrusted issuer: 'CN=company - Secure
> >
> > Server CA 1 - G2,DC=svs,DC=company,DC=org'  <---------------- this CA
> > was added by me because is the CA of the cert for HTTPD
> > NSS error -8172
> > Expire cleared
> > Closing connection #0
> >
> > libcurl failed to execute the HTTP POST transaction.  Peer certificate
> > cannot be authenticated with known CA certificates
> >
> > 2019-01-10T11:48:57Z ERROR Joining realm failed: XML-RPC CALL:
> >
> > The certificates I have:
> > [root@masterWRONG ~]# certutil -L -d /etc/httpd/alias/
> > Certificate Nickname                                         Trust Attributes
> >                                                                SSL,S/MIME,JAR/XPI
> > Signing-Cert                                                 u,u,u
> > CN=masterWRONG.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX u,u,u   <------- the one I added it
> > IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
> > ICC-root                                                     C,,      <--- root certificate of CN=masterWRONG.ipa.testad.local (added by me)
> > ICC-Inter                                                    C,,      <--- CA added of CN=masterWRONG.ipa.testad.local (added by me)
> >
> > [root@masterGOOD ipa]# certutil -L -d /etc/httpd/alias/
> > Certificate Nickname                                         Trust Attributes
> >
> > SSL,S/MIME,JAR/XPI CN=masterGOOD.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX CTu,Cu,Cu <------- the one I added it
> > IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
> > ICC-root                                                     C,,    <--- root certificate of CN=masterGOOD.ipa.testad.local (added by me)
> > ICC-Inter                                                    C,,    <--- CA added of CN=masterGOOD.ipa.testad.local (added by me)
> >
> > Thanks & Regards.
> >
> > -----Original Message-----
> > From: Florence Blanc-Renaud 
> > Sent: Thursday, January 10, 2019 10:03
> > To: FreeIPA users list ; Rob
> > Crittenden 
> > Cc: SOLER SANGUESA Miguel 
> > Subject: Re: [Freeipa-users] Re: Testing requested - certificate
> > checking tool
> >
> > On 1/9/19 4:21 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > > Hello,
> > >
> > > Now it works and it shows the real problem I have. I have 2 master, I have changed the HTTP certificate on both (using  ipa-cacert-manage, ipa-certupdate and  ipa-server-certinstall as the manual says), but I one of them has som problems:
> > > [root@masterWRONG ~]# python2 ipa-checkcerts.py
> > > ipa: INFO: IPA version 4.6.4-10.el7
> > > IPA version 4.6.4-10.el7
> > > ipa: INFO: Check CA status
> > > Check CA status
> > > ipa: INFO: Check tracking
> > > Check tracking
> > > ipa: INFO: Check NSS trust
> > > Check NSS trust
> > > ICC-root not found, assuming 3rd party ICC-Inter not found, assuming
> > > 3rd party
> > > ipa: INFO: Check dates
> > > Check dates
> > > ipa: INFO: Checking certificates in CS.cfg Checking certificates in
> > > CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found,
> > > assuming 3rd party
> > > ipa: INFO: Comparing certificates to requests in LDAP Comparing
> > > certificates to requests in LDAP
> > > ipa: INFO: Checking RA certificate
> > > Checking RA certificate
> > > ipa: INFO: Checking authorities
> > > Checking authorities
> > > ipa: INFO: Checking host keytab
> > > Checking host keytab
> > > ipa: INFO: Validating certificates
> > > Validating certificates
> > > ipa: INFO: Checking renewal master
> > > Checking renewal master
> > > ipa: INFO: End-to-end cert API test
> > > End-to-end cert API test
> > > ipa: ERROR: ra.get_certificate(): EXCEPTION (Invalid Credential.)
> > > ra.get_certificate(): EXCEPTION (Invalid Credential.)
> > > ipa: INFO: Checking permissions and ownership Checking permissions
> > > and ownership
> > > ipa: INFO: Failures:
> > > Failures:
> > > ipa: INFO: RA agent description does not match
> > > 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA
> > > RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate
> > > Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected RA
> > > agent description does not match 2;268304389;CN=Certificate
> > > Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP and
> > > 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA
> > > RA,O=IPA.TESTAD.LOCAL expected
> > > ipa: INFO: cert-show of 1 failed: Certificate operation cannot be
> > > completed: EXCEPTION (Invalid Credential.) cert-show of 1 failed:
> > > Certificate operation cannot be completed: EXCEPTION (Invalid
> > > Credential.)
> > > ipa: INFO: Warnings:
> > > Warnings:
> > > ipa: INFO: Unknown certmonger ids: 20170817094736 Unknown certmonger
> > > ids: 20170817094736
> > >
> > > The certificates that complains:
> > > [root@masterGOOD ~]# ipa cert-show 2
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Jan 30 10:52:18 2017 UTC
> > >      Not After: Sun Jan 20 10:52:18 2019 UTC
> > >      Serial number: 2
> > >      Serial number (hex): 0x2
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 7
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Jan 30 10:53:02 2017 UTC
> > >      Not After: Sun Jan 20 10:53:02 2019 UTC
> > >      Serial number: 7
> > >      Serial number (hex): 0x7
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304389
> > >      Issuing CA: ipa
> > >      Certificate: MIID....
> > >      Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:24:20 2018 UTC
> > >      Not After: Sun Dec 13 07:24:20 2020 UTC
> > >      Serial number: 268304389
> > >      Serial number (hex): 0xFFE0005
> > >      Revoked: False
> > >
> > > On the other master I get:
> > > [root@masterGOOD ~]# python2 ipa-checkcerts.py
> > > ipa: INFO: IPA version 4.6.4-10.el7
> > > IPA version 4.6.4-10.el7
> > > ipa: INFO: Check CA status
> > > Check CA status
> > > ipa: INFO: Check tracking
> > > Check tracking
> > > ipa: INFO: Check NSS trust
> > > Check NSS trust
> > > ICC-root not found, assuming 3rd party ICC-Inter not found, assuming
> > > 3rd party
> > > ipa: INFO: Check dates
> > > Check dates
> > > ipa: INFO: Checking certificates in CS.cfg Checking certificates in
> > > CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found,
> > > assuming 3rd party
> > > ipa: INFO: Comparing certificates to requests in LDAP Comparing
> > > certificates to requests in LDAP
> > > ipa: INFO: Checking RA certificate
> > > Checking RA certificate
> > > ipa: INFO: Checking authorities
> > > Checking authorities
> > > ipa: INFO: Checking host keytab
> > > Checking host keytab
> > > ipa: INFO: Validating certificates
> > > Validating certificates
> > > ipa: INFO: Checking renewal master
> > > Checking renewal master
> > > ipa: INFO: End-to-end cert API test
> > > End-to-end cert API test
> > > ipa: INFO: Checking permissions and ownership Checking permissions
> > > and ownership
> > > ipa: INFO: Failures:
> > > Failures:
> > > ipa: INFO: Unable to find request for serial 268304389 Unable to find
> > > request for serial 268304389
> > > ipa: INFO: Unable to find request for serial 268304388 Unable to find
> > > request for serial 268304388
> > > ipa: INFO: Unable to find request for serial 268304391 Unable to find
> > > request for serial 268304391
> > > ipa: INFO: Unable to find request for serial 268304390 Unable to find
> > > request for serial 268304390
> > > ipa: INFO: Unable to find request for serial 268304392 Unable to find
> > > request for serial 268304392
> > > ipa: INFO: Warnings:
> > > Warnings:
> > > ipa: INFO: Unknown certmonger ids: 20170817101613 Unknown certmonger
> > > ids: 20170817101613
> > >
> > > Where the serials correspond the following certs:
> > > [root@masterGOOD ~]# ipa cert-show 268304389
> > >      Issuing CA: ipa
> > >      Certificate: MI....
> > >      Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:24:20 2018 UTC
> > >      Not After: Sun Dec 13 07:24:20 2020 UTC
> > >      Serial number: 268304389
> > >      Serial number (hex): 0xFFE0005
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304388
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=CA Audit,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:25:10 2018 UTC
> > >      Not After: Sun Dec 13 07:25:10 2020 UTC
> > >      Serial number: 268304388
> > >      Serial number (hex): 0xFFE0004
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304391
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:25:00 2018 UTC
> > >      Not After: Sun Dec 13 07:25:00 2020 UTC
> > >      Serial number: 268304391
> > >      Serial number (hex): 0xFFE0007
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304390
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=CA Subsystem,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:24:41 2018 UTC
> > >      Not After: Sun Dec 13 07:24:41 2020 UTC
> > >      Serial number: 268304390
> > >      Serial number (hex): 0xFFE0006
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304392
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=masterGOOD.ipa.testad.local,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Tue Dec 25 07:24:07 2018 UTC
> > >      Not After: Mon Dec 14 07:24:07 2020 UTC
> > >      Serial number: 268304392
> > >      Serial number (hex): 0xFFE0008
> > >      Revoked: False
> > >
> > > I've checked that the following files are different on the 2 masters:
> > > /var/lib/ipa/ra-agent.key
> > > /var/lib/ipa/ra-agent.pem
> > >
> > > It has been renewed on masterGOOD but not on masterWRONG:
> >
> > You can manually copy ra-agent.key and ra-agent.pem from masterGOOD to masterWRONG (make a backup first of the files on masterWRONG). This should solve the 'ipa cert-show' issue on masterWRONG.
> > > [root@masterWRONG ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
> > >            Serial Number: 7 (0x7)
> > >                Not Before: Jan 30 10:53:02 2017 GMT
> > >                Not After : Jan 20 10:53:02 2019 GMT [root@masterGOOD
> > > ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
> > >            Serial Number: 268304389 (0xffe0005)
> > >                Not Before: Dec 24 07:24:20 2018 GMT
> > >                Not After : Dec 13 07:24:20 2020 GMT
> > >    		
> > > When I execute "ipa cert-show" on masterWRONG I get the following error:
> > > ipa: ERROR: Certificate operation cannot be completed: EXCEPTION
> > > (Invalid Credential.)
> > >
> > > I have added a RHEL 7 client to the domain, but I can not add RHEL 6
> > > clients. The CA master was masterWRONG and I have changed to
> > > masterGOOD with the procedure explained on
> > > https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Mast
> > > e r But it still can not add RHEL 6 on the domain.
> >
> > Which error do you see when trying to add a RHEL6 client to the domain?
> > Please provide ipaclient-install.log.
> >
> > HTH,
> > flo
> > > How can I fix the issue? Is that happening because I changed the auto-signed HTTP certificate to a 3rd party certificate?
> > >
> > > Thanks & Regards.
> > >
> > > -----Original Message-----
> > > From: Rob Crittenden 
> > > Sent: Thursday, January 03, 2019 21:22
> > > To: FreeIPA users list 
> > > Cc: SOLER SANGUESA Miguel 
> > > Subject: Re: [Freeipa-users] Re: Testing requested - certificate
> > > checking tool
> > >
> > > Rob Crittenden via FreeIPA-users wrote:
> > > > SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > > > > Hello,
> > > > >
> > > > > I have run the tool on an environment where I’ve installed my own
> > > > > certificate for HTTPS (following this tutorial:
> > > > > https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/L
> > > > > D A P), and it complains when find the root certificate of my
> > > > > certificate:
> > > > >
> > > > > # python2 ipa-checkcerts.py
> > > > >
> > > > > ipa: INFO: IPA version 4.6.4-10.el7
> > > > >
> > > > > IPA version 4.6.4-10.el7
> > > > >
> > > > > ipa: INFO: Check CA status
> > > > >
> > > > > Check CA status
> > > > >
> > > > > ipa: INFO: Check tracking
> > > > >
> > > > > Check tracking
> > > > >
> > > > > ipa: INFO: Check NSS trust
> > > > >
> > > > > Check NSS trust
> > > > >
> > > > > Traceback (most recent call last):
> > > > >
> > > > > File "ipa-checkcerts.py", line 931, in <module>
> > > > >
> > > > > sys.exit(c.run())
> > > > >
> > > > > File "ipa-checkcerts.py", line 190, in run
> > > > >
> > > > > self.check_trust()
> > > > >
> > > > > File "ipa-checkcerts.py", line 439, in check_trust
> > > > >
> > > > > expected = expected_trust[nickname]
> > > > >
> > > > > KeyError: 'ICC-root'
> > > > >
> > > > > Is this normal?
> > > >
> > > > No, I don't think I ever tested this scenario. I'll take a look.
> > > >
> > > > I did confirm it also fails if you install CA-les.
> > >
> > > I reproduced the error and worked around it. It should work now.
> > >
> > > rob
> > > > > Because I have tried to add a RHEL 6 client and I get the error:
> > > > >
> > > > > " Successfully retrieved CA cert
> > > > >
> > > > > Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > > > >
> > > > > Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > > > >
> > > > > Valid From:  Mon Jan 30 10:52:18 2017 UTC
> > > > >
> > > > > Valid Until: Fri Jan 30 10:52:18 2037 UTC
> > > > >
> > > > > Joining realm failed: libcurl failed to execute the HTTP POST
> > > > > transaction.  Peer certificate cannot be authenticated with known
> > > > > CA certificates"it is by design to provide
> > > >
> > > > Use ipa-cacert-manage to install the CA of the 3rd party certs you added.
> > > >
> > > > rob
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]
> > > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > > List Guidelines:
> > > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > > > https://lists.fedorahosted.org/archives/list/[e-mail]
> > > > o
> > > > r
> > > > ahosted.org
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
> > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > > https://lists.fedorahosted.org/archives/list/[e-mail]
> > > r
> > > ahosted.org
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]
> > ahosted.org
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

Testing requested - certificate checking tool

[SOLER SANGUESA Miguel]

Yes, it is clear. Thank you very much.

On 1/11/19 12:12 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> You are right, on the client /etc/ipa/ca.crt has just the IPA CA, but on the servers it has 3 certificates:
> IPA CA
> ICC-inter
> ICC-root
>
> The workaround didn’t work, despite it seems that reads the new file:
> 2019-01-11T10:28:35Z DEBUG trying to retrieve CA cert from file 
> /tmp/ipa.crt 2019-01-11T10:28:35Z DEBUG CA cert provided by user, use it!
> 2019-01-11T10:28:36Z DEBUG args=/usr/sbin/ipa-join -s 
> masterGOOD.ipa.testad.local -b dc=ipa,dc=testad,dc=local -d -h 
> client.svc.company.org
>
> But finally I got the same result:
> About to connect() to masterGOOD.ipa.testad.local port 443 (#0)
> Trying 192.168.107.171... * Connected to masterGOOD.ipa.testad.local (192.168.107.171) port 443 (#0)
> Initializing NSS with certpath: sql:/etc/pki/nssdb
> CAfile: /etc/ipa/ca.crt
> CApath: none
> Certificate is signed by an untrusted issuer: 'CN=COMPANY - Secure Server CA 1 - G2,DC=svs,DC=unicc,DC=org'
> NSS error -8172
> Expire cleared
> Closing connection #0
>
> libcurl failed to execute the HTTP POST transaction.  Peer certificate 
> cannot be authenticated with known CA certificates 2019-01-11T10:28:36Z ERROR Joining realm failed: XML-RPC CALL:
>
> Anyway, I have overwrited /etc/ipa/ca.crt with the file from the masters and then the installation was OK.
>
> Now just I want to know:
> can I do something to fix permanently the problem and not to copy the certificate on all new RHEL 6 servers before install client?
> if the problem was caused because I installed wrongly the certificates. Can you  please let me know the correct way?
> if it is a bug. Has been fixed on newer releases or it is planned on future releases?

Hi,

this behavior is a limitation of RHEL 6, please see the note in "Managing certificates and certificate authorities" in IdM guide for RHEL 6 [1]:
---
Using more than one certificate authority (CA) signing certificate within your IdM environment is not supported in Red Hat Enterprise Linux 6. To support this configuration, upgrade your IdM systems to Red Hat Enterprise Linux 7.
---

This has been solved in RHEL 7, and RHEL 7 clients are able to enroll even if multiple CAs are defined (IPA CA and the CA for the apache/ldap certs).

Hope this clarifies,
flo

[1]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/htm...
> Thank you very much.
>
> On 1/10/19 3:24 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > Ipa cert-show is working now after copying the certificates, thanks.
> >
> > The error I get is:
> > Joining realm failed: libcurl failed to execute the HTTP POST 
> > transaction.  Peer certificate cannot be authenticated with known CA 
> > certificates
> >
> > I have attached the full log with debug enabled, it complains about the certificate added for HTTP:
> > About to connect() to masterGOOD.ipa.testad.local port 443 (#0)
> > Trying 192.168.107.171... * Connected to masterGOOD.ipa.testad.local (192.168.107.171) port 443 (#0)
> > Initializing NSS with certpath: sql:/etc/pki/nssdb
> > CAfile: /etc/ipa/ca.crt
>
> What is the content of /etc/ipa/ca.crt on the client? I suspect it only contains the cert for "IPA.TESTAD.LOCAL IPA CA".
> IIRC correctly, RHEL 6 clients download the cert from cn=CAcert,cn=ipa,cn=etc,$BASEDN (and this entry contains only IPA CA, not the external CAs).
>
> To workaround the issue, you can do the following:
> copy /etc/ipa/ca.crt from the master to the client on /tmp/ipa.crt (the file should contain the IPA CA + ICC-root + ICC-Inter).
> enroll the client by providing --ca-cert-file=/tmp/ipa.crt
>
> HTH,
> flo
> > CApath: none
> > Certificate is signed by an untrusted issuer: 'CN=company - Secure
> >
> > Server CA 1 - G2,DC=svs,DC=company,DC=org'  <---------------- this CA 
> > was added by me because is the CA of the cert for HTTPD
> > NSS error -8172
> > Expire cleared
> > Closing connection #0
> >
> > libcurl failed to execute the HTTP POST transaction.  Peer 
> > certificate cannot be authenticated with known CA certificates
> >
> > 2019-01-10T11:48:57Z ERROR Joining realm failed: XML-RPC CALL:
> >
> > The certificates I have:
> > [root@masterWRONG ~]# certutil -L -d /etc/httpd/alias/
> > Certificate Nickname                                         Trust Attributes
> >                                                                SSL,S/MIME,JAR/XPI
> > Signing-Cert                                                 u,u,u
> > CN=masterWRONG.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX u,u,u   <------- the one I added it
> > IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
> > ICC-root                                                     C,,      <--- root certificate of CN=masterWRONG.ipa.testad.local (added by me)
> > ICC-Inter                                                    C,,      <--- CA added of CN=masterWRONG.ipa.testad.local (added by me)
> >
> > [root@masterGOOD ipa]# certutil -L -d /etc/httpd/alias/
> > Certificate Nickname                                         Trust Attributes
> >
> > SSL,S/MIME,JAR/XPI CN=masterGOOD.ipa.testad.local,OU=OPPV,O=company,L=XXXX,ST=XXXX,C=XX CTu,Cu,Cu <------- the one I added it
> > IPA.TESTAD.LOCAL IPA CA                                      CT,C,C
> > ICC-root                                                     C,,    <--- root certificate of CN=masterGOOD.ipa.testad.local (added by me)
> > ICC-Inter                                                    C,,    <--- CA added of CN=masterGOOD.ipa.testad.local (added by me)
> >
> > Thanks & Regards.
> >
> > -----Original Message-----
> > From: Florence Blanc-Renaud 
> > Sent: Thursday, January 10, 2019 10:03
> > To: FreeIPA users list ; Rob 
> > Crittenden 
> > Cc: SOLER SANGUESA Miguel 
> > Subject: Re: [Freeipa-users] Re: Testing requested - certificate 
> > checking tool
> >
> > On 1/9/19 4:21 PM, SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > > Hello,
> > >
> > > Now it works and it shows the real problem I have. I have 2 master, I have changed the HTTP certificate on both (using  ipa-cacert-manage, ipa-certupdate and  ipa-server-certinstall as the manual says), but I one of them has som problems:
> > > [root@masterWRONG ~]# python2 ipa-checkcerts.py
> > > ipa: INFO: IPA version 4.6.4-10.el7
> > > IPA version 4.6.4-10.el7
> > > ipa: INFO: Check CA status
> > > Check CA status
> > > ipa: INFO: Check tracking
> > > Check tracking
> > > ipa: INFO: Check NSS trust
> > > Check NSS trust
> > > ICC-root not found, assuming 3rd party ICC-Inter not found, assuming 
> > > 3rd party
> > > ipa: INFO: Check dates
> > > Check dates
> > > ipa: INFO: Checking certificates in CS.cfg Checking certificates in 
> > > CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found, 
> > > assuming 3rd party
> > > ipa: INFO: Comparing certificates to requests in LDAP Comparing 
> > > certificates to requests in LDAP
> > > ipa: INFO: Checking RA certificate
> > > Checking RA certificate
> > > ipa: INFO: Checking authorities
> > > Checking authorities
> > > ipa: INFO: Checking host keytab
> > > Checking host keytab
> > > ipa: INFO: Validating certificates
> > > Validating certificates
> > > ipa: INFO: Checking renewal master
> > > Checking renewal master
> > > ipa: INFO: End-to-end cert API test
> > > End-to-end cert API test
> > > ipa: ERROR: ra.get_certificate(): EXCEPTION (Invalid Credential.)
> > > ra.get_certificate(): EXCEPTION (Invalid Credential.)
> > > ipa: INFO: Checking permissions and ownership Checking permissions 
> > > and ownership
> > > ipa: INFO: Failures:
> > > Failures:
> > > ipa: INFO: RA agent description does not match 
> > > 2;268304389;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA
> > > RA,O=IPA.TESTAD.LOCAL in LDAP and 2;7;CN=Certificate 
> > > Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL expected 
> > > RA agent description does not match 2;268304389;CN=Certificate 
> > > Authority,O=IPA.TESTAD.LOCAL;CN=IPA RA,O=IPA.TESTAD.LOCAL in LDAP 
> > > and 2;7;CN=Certificate Authority,O=IPA.TESTAD.LOCAL;CN=IPA
> > > RA,O=IPA.TESTAD.LOCAL expected
> > > ipa: INFO: cert-show of 1 failed: Certificate operation cannot be
> > > completed: EXCEPTION (Invalid Credential.) cert-show of 1 failed:
> > > Certificate operation cannot be completed: EXCEPTION (Invalid
> > > Credential.)
> > > ipa: INFO: Warnings:
> > > Warnings:
> > > ipa: INFO: Unknown certmonger ids: 20170817094736 Unknown certmonger
> > > ids: 20170817094736
> > >
> > > The certificates that complains:
> > > [root@masterGOOD ~]# ipa cert-show 2
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Jan 30 10:52:18 2017 UTC
> > >      Not After: Sun Jan 20 10:52:18 2019 UTC
> > >      Serial number: 2
> > >      Serial number (hex): 0x2
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 7
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Jan 30 10:53:02 2017 UTC
> > >      Not After: Sun Jan 20 10:53:02 2019 UTC
> > >      Serial number: 7
> > >      Serial number (hex): 0x7
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304389
> > >      Issuing CA: ipa
> > >      Certificate: MIID....
> > >      Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:24:20 2018 UTC
> > >      Not After: Sun Dec 13 07:24:20 2020 UTC
> > >      Serial number: 268304389
> > >      Serial number (hex): 0xFFE0005
> > >      Revoked: False
> > >
> > > On the other master I get:
> > > [root@masterGOOD ~]# python2 ipa-checkcerts.py
> > > ipa: INFO: IPA version 4.6.4-10.el7
> > > IPA version 4.6.4-10.el7
> > > ipa: INFO: Check CA status
> > > Check CA status
> > > ipa: INFO: Check tracking
> > > Check tracking
> > > ipa: INFO: Check NSS trust
> > > Check NSS trust
> > > ICC-root not found, assuming 3rd party ICC-Inter not found, assuming 
> > > 3rd party
> > > ipa: INFO: Check dates
> > > Check dates
> > > ipa: INFO: Checking certificates in CS.cfg Checking certificates in 
> > > CS.cfg ICC-root not found, assuming 3rd party ICC-Inter not found, 
> > > assuming 3rd party
> > > ipa: INFO: Comparing certificates to requests in LDAP Comparing 
> > > certificates to requests in LDAP
> > > ipa: INFO: Checking RA certificate
> > > Checking RA certificate
> > > ipa: INFO: Checking authorities
> > > Checking authorities
> > > ipa: INFO: Checking host keytab
> > > Checking host keytab
> > > ipa: INFO: Validating certificates
> > > Validating certificates
> > > ipa: INFO: Checking renewal master
> > > Checking renewal master
> > > ipa: INFO: End-to-end cert API test
> > > End-to-end cert API test
> > > ipa: INFO: Checking permissions and ownership Checking permissions 
> > > and ownership
> > > ipa: INFO: Failures:
> > > Failures:
> > > ipa: INFO: Unable to find request for serial 268304389 Unable to 
> > > find request for serial 268304389
> > > ipa: INFO: Unable to find request for serial 268304388 Unable to 
> > > find request for serial 268304388
> > > ipa: INFO: Unable to find request for serial 268304391 Unable to 
> > > find request for serial 268304391
> > > ipa: INFO: Unable to find request for serial 268304390 Unable to 
> > > find request for serial 268304390
> > > ipa: INFO: Unable to find request for serial 268304392 Unable to 
> > > find request for serial 268304392
> > > ipa: INFO: Warnings:
> > > Warnings:
> > > ipa: INFO: Unknown certmonger ids: 20170817101613 Unknown certmonger
> > > ids: 20170817101613
> > >
> > > Where the serials correspond the following certs:
> > > [root@masterGOOD ~]# ipa cert-show 268304389
> > >      Issuing CA: ipa
> > >      Certificate: MI....
> > >      Subject: CN=IPA RA,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:24:20 2018 UTC
> > >      Not After: Sun Dec 13 07:24:20 2020 UTC
> > >      Serial number: 268304389
> > >      Serial number (hex): 0xFFE0005
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304388
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=CA Audit,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:25:10 2018 UTC
> > >      Not After: Sun Dec 13 07:25:10 2020 UTC
> > >      Serial number: 268304388
> > >      Serial number (hex): 0xFFE0004
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304391
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=OCSP Subsystem,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:25:00 2018 UTC
> > >      Not After: Sun Dec 13 07:25:00 2020 UTC
> > >      Serial number: 268304391
> > >      Serial number (hex): 0xFFE0007
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304390
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=CA Subsystem,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Mon Dec 24 07:24:41 2018 UTC
> > >      Not After: Sun Dec 13 07:24:41 2020 UTC
> > >      Serial number: 268304390
> > >      Serial number (hex): 0xFFE0006
> > >      Revoked: False
> > > [root@masterGOOD ~]# ipa cert-show 268304392
> > >      Issuing CA: ipa
> > >      Certificate: MII....
> > >      Subject: CN=masterGOOD.ipa.testad.local,O=IPA.TESTAD.LOCAL
> > >      Issuer: CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > >      Not Before: Tue Dec 25 07:24:07 2018 UTC
> > >      Not After: Mon Dec 14 07:24:07 2020 UTC
> > >      Serial number: 268304392
> > >      Serial number (hex): 0xFFE0008
> > >      Revoked: False
> > >
> > > I've checked that the following files are different on the 2 masters:
> > > /var/lib/ipa/ra-agent.key
> > > /var/lib/ipa/ra-agent.pem
> > >
> > > It has been renewed on masterGOOD but not on masterWRONG:
> >
> > You can manually copy ra-agent.key and ra-agent.pem from masterGOOD to masterWRONG (make a backup first of the files on masterWRONG). This should solve the 'ipa cert-show' issue on masterWRONG.
> > > [root@masterWRONG ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
> > >            Serial Number: 7 (0x7)
> > >                Not Before: Jan 30 10:53:02 2017 GMT
> > >                Not After : Jan 20 10:53:02 2019 GMT [root@masterGOOD 
> > > ~]# openssl x509 -in /var/lib/ipa/ra-agent.pem -text -noout | egrep "Serial|Not"
> > >            Serial Number: 268304389 (0xffe0005)
> > >                Not Before: Dec 24 07:24:20 2018 GMT
> > >                Not After : Dec 13 07:24:20 2020 GMT
> > >    		
> > > When I execute "ipa cert-show" on masterWRONG I get the following error:
> > > ipa: ERROR: Certificate operation cannot be completed: EXCEPTION 
> > > (Invalid Credential.)
> > >
> > > I have added a RHEL 7 client to the domain, but I can not add RHEL 6 
> > > clients. The CA master was masterWRONG and I have changed to 
> > > masterGOOD with the procedure explained on 
> > > https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Mas
> > > t e r But it still can not add RHEL 6 on the domain.
> >
> > Which error do you see when trying to add a RHEL6 client to the domain?
> > Please provide ipaclient-install.log.
> >
> > HTH,
> > flo
> > > How can I fix the issue? Is that happening because I changed the auto-signed HTTP certificate to a 3rd party certificate?
> > >
> > > Thanks & Regards.
> > >
> > > -----Original Message-----
> > > From: Rob Crittenden 
> > > Sent: Thursday, January 03, 2019 21:22
> > > To: FreeIPA users list 
> > > Cc: SOLER SANGUESA Miguel 
> > > Subject: Re: [Freeipa-users] Re: Testing requested - certificate 
> > > checking tool
> > >
> > > Rob Crittenden via FreeIPA-users wrote:
> > > > SOLER SANGUESA Miguel via FreeIPA-users wrote:
> > > > > Hello,
> > > > >
> > > > > I have run the tool on an environment where I’ve installed my own 
> > > > > certificate for HTTPS (following this tutorial:
> > > > > https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/
> > > > > L D A P), and it complains when find the root certificate of my
> > > > > certificate:
> > > > >
> > > > > # python2 ipa-checkcerts.py
> > > > >
> > > > > ipa: INFO: IPA version 4.6.4-10.el7
> > > > >
> > > > > IPA version 4.6.4-10.el7
> > > > >
> > > > > ipa: INFO: Check CA status
> > > > >
> > > > > Check CA status
> > > > >
> > > > > ipa: INFO: Check tracking
> > > > >
> > > > > Check tracking
> > > > >
> > > > > ipa: INFO: Check NSS trust
> > > > >
> > > > > Check NSS trust
> > > > >
> > > > > Traceback (most recent call last):
> > > > >
> > > > > File "ipa-checkcerts.py", line 931, in <module>
> > > > >
> > > > > sys.exit(c.run())
> > > > >
> > > > > File "ipa-checkcerts.py", line 190, in run
> > > > >
> > > > > self.check_trust()
> > > > >
> > > > > File "ipa-checkcerts.py", line 439, in check_trust
> > > > >
> > > > > expected = expected_trust[nickname]
> > > > >
> > > > > KeyError: 'ICC-root'
> > > > >
> > > > > Is this normal?
> > > >
> > > > No, I don't think I ever tested this scenario. I'll take a look.
> > > >
> > > > I did confirm it also fails if you install CA-les.
> > >
> > > I reproduced the error and worked around it. It should work now.
> > >
> > > rob
> > > > > Because I have tried to add a RHEL 6 client and I get the error:
> > > > >
> > > > > " Successfully retrieved CA cert
> > > > >
> > > > > Subject:     CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > > > >
> > > > > Issuer:      CN=Certificate Authority,O=IPA.TESTAD.LOCAL
> > > > >
> > > > > Valid From:  Mon Jan 30 10:52:18 2017 UTC
> > > > >
> > > > > Valid Until: Fri Jan 30 10:52:18 2037 UTC
> > > > >
> > > > > Joining realm failed: libcurl failed to execute the HTTP POST 
> > > > > transaction.  Peer certificate cannot be authenticated with known 
> > > > > CA certificates"it is by design to provide
> > > >
> > > > Use ipa-cacert-manage to install the CA of the 3rd party certs you added.
> > > >
> > > > rob
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]
> > > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > > List Guidelines:
> > > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > > List Archives:
> > > > https://lists.fedorahosted.org/archives/list/[e-mail]
> > > > d
> > > > o
> > > > r
> > > > ahosted.org
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> > > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > > List Guidelines:
> > > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> > > https://lists.fedorahosted.org/archives/list/[e-mail]
> > > o
> > > r
> > > ahosted.org
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]
> > r
> > ahosted.org
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to 
> [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: 
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedorahosted.org/archives/list/[e-mail]
> ahosted.org