8:38 a.m.
Hello I need to fix CA
Failed to authenticate to CA REST API
How I can reinstall/reconfigure only CA.
or export users(with hash passwords)/groups. and import on new installation.
Help me please.
10:44 a.m.
On 12/18/20 3:38 PM, Evg Hertz via FreeIPA-users wrote:
Hello I need to fix CA
Failed to authenticate to CA REST API
How I can reinstall/reconfigure only CA.
or export users(with hash passwords)/groups. and import on new installation.
Help me please.
Hi,
this error usually happens when the RA certificate is expired or
inconsistent with the entry stored in LDAP.
Can you provide more information regarding your deployment? How many
servers are installed, do they all provide the CA service? Which version
of IPA is installed?
Depending on the version, the RA cert can either be stored in
/var/lib/ipa/ra-agent.pem (ipa 4.5.0+) or in the NSS database
/etc/httpd/alias under the nickname ipaCert (older versions). You can
check if the certificate is expired with:
# getcert list -f /var/lib/ipa/ra-agent.pem | grep expires
or
# getcert list -d /etc/httpd/alias -n ipaCert | grep expires
If the certificate is not expired, you also need to check that the LDAP
entry is consistent:
# ldapsearch -D "cn=directory manager" -W -b o=ipaca "(uid=ipara)" dn
usercertificate description
The usercertificate must contain in a single line the same value as
stored in the RA cert, without the header and footer (that can be seen with
# cat /var/lib/ipa/ra-agent.pem
or
# certutil -L -d /etc/httpd/alias -n ipaCert -a
)
and the description must have the format:
description: 2;<cert serial>;<issuer>;<subject>
HTH,
flo
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
4:31 a.m.
getcert list -f /var/lib/ipa/ra-agent.pem | grep expires
expires: 2022-06-20 19:31:51 UTC
I dont find /var/lib/ipa/ra-agent.pem in output
ldapsearch -D "cn=directory manager" -W -b o=ipaca
9:54 a.m.
On 12/21/20 11:31 AM, Evg Hertz via FreeIPA-users wrote:
getcert list -f /var/lib/ipa/ra-agent.pem | grep expires
expires: 2022-06-20 19:31:51 UTC
I dont find /var/lib/ipa/ra-agent.pem in output
ldapsearch -D "cn=directory manager" -W -b o=ipaca
Hi,
please type the whole command with the search filter and the list of
requested attributes:
# ldapsearch -D "cn=directory manager" -W -b o=ipaca "(uid=ipara)" dn
usercertificate description
and compare with the output of:
# openssl x509 -text -in /var/lib/ipa/ra-agent.pem
(please keep in mind that openssl command will display subject and
issuer with the most specific rdn on the right, for instance
"O=DOMAIN.COM,CN=IPA RA", while the description attribute displays
serial and issuer with the most-specific rdn on the left like
"description: 2;7;CN=Certificate Authority,O=DOMAIN.COM;CN=IPA
RA,O=DOMAIN.COM").
flo
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
2:22 p.m.
ldapsearch -D "cn=directory manager" -W -b o=ipaca "(uid=ipara)" dn
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: (uid=ipara)
# requesting: dn
#
# ipara, people, ipaca
dn: uid=ipara,ou=people,o=ipaca
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
ldapsearch -D "cn=directory manager" -W -b o=ipaca "(uid=ipara)"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: (uid=ipara)
# requesting: ALL
#
# ipara, people, ipaca
dn: uid=ipara,ou=people,o=ipaca
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: cmsuser
uid: ipara
sn: ipara
cn: ipara
usertype: agentType
userstate: 1
userCertificate:: MIID4TCCAkmgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA2MRQwEgYDVQQKDAtM
T0MuRVBITC5CWTEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIwMDYzMDE5MzE1M
VoXDTIyMDYyMDE5MzE1MVowJzEUMBIGA1UECgwLTE9DLkVQSEwuQlkxDzANBgNVBAMTBklQQSBSQT
CCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALieCvFxG8rA+dpk3G2cXsaRAepgSYRwQy0
iXnzQm+c00ANABfCYdRog3XF2TXZzpUnEjG4BA0XGId/GV/jhROrMz3TMCYZASVlX1ucd3SrGpkNY
RqVMwQir8b8hdyzhO0BA4k2z+AIyJk2LP0RdHYb1I34e5D5ys1O9Hyi+VhBK1lfmLEyTB56nwp2wt
Y0PnK2OnQPQjKhS+FmDAciI3jOf0wUR0z+NY37JcX5HwaqHkVeitMS/rJoRBdXWU4f68cgHw5J6JP
3wB2HPLMRRLkXeRRdz1yrYAdNIfNEHsSEVrwjM8K76bu+aZ9Cdz8dlB4cVX4+44RR36pB/OVjcfh0
CAwEAAaOBiDCBhTAfBgNVHSMEGDAWgBRAqsIyAvQfYf69qbdaPaXhdXQT4jA9BggrBgEFBQcBAQQx
MC8wLQYIKwYBBQUHMAGGIWh0dHA6Ly9pcGEtY2EubG9jLmVwaGwuYnkvY2Evb2NzcDAOBgNVHQ8BA
f8EBAMCBLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBADiqrIuv4IqJ3C
Q0D4W9IT9irKPsuKMonbWBwZ53vF3FRLYNvg/WNghzLkHhIKLQ4/crJpqSjAvRtBj7tKY9weOJ7XJ
VWr/nC4SaShLGB8CCOVPfZ+AcOHRsNXODzixsni0RPPFgYzeuBb5VYOybqHsxWs6bAJ1dzWtSH7pb
TdicgdteVa+F/LPeHnstMRAuYldW8+/1f0eyzCI3InNk4jWp+AhfEkcxYGVuF/77/hVnpNK9wx+MN
OM9Rbb7v0a0IDcBqp/8jNzKOzXabwYYkc/58yIqPTntArGBb9+InRBDSzMAB6ggjtd4dmiKII5Cb4
gnjYZzVzVM3NwE8WjZcWu/pY3Ea3oiMYLvgQupIjOePVcEBkm5ASwSS3eC/OP2ofO139h7PjsGl/z
Qa0981ESnqlc+IxvqtB0ELnid2ryNg0VmugTZWf+TpCH44N3cl4gdfSickOcoX3Hv3FfFe98BNo/o
VmqTFOmllduUMjn8HJfLbpvLiIpbatoYvAvoBA==
description: 2;7;CN=Certificate Authority,O=DOMAIN.COM;CN=IPA RA,O=LOC.EPHL.B
Y
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
openssl x509 -text -in /var/lib/ipa/ra-agent.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 7 (0x7)
Signature Algorithm: sha256WithRSAEncryption
Issuer: O = DOMAIN.COM, CN = Certificate Authority
Validity
Not Before: Jun 30 19:31:51 2020 GMT
Not After : Jun 20 19:31:51 2022 GMT
Subject: O = DOMAIN.COM, CN = IPA RA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:b8:9e:0a:f1:71:1b:ca:c0:f9:da:64:dc:6d:9c:
5e:c6:91:01:ea:60:49:84:70:43:2d:22:5e:7c:d0:
9b:e7:34:d0:03:40:05:f0:98:75:1a:20:dd:71:76:
4d:76:73:a5:49:c4:8c:6e:01:03:45:c6:21:df:c6:
57:f8:e1:44:ea:cc:cf:74:cc:09:86:40:49:59:57:
d6:e7:1d:dd:2a:c6:a6:43:58:46:a5:4c:c1:08:ab:
f1:bf:21:77:2c:e1:3b:40:40:e2:4d:b3:f8:02:32:
26:4d:8b:3f:44:5d:1d:86:f5:23:7e:1e:e4:3e:72:
b3:53:bd:1f:28:be:56:10:4a:d6:57:e6:2c:4c:93:
07:9e:a7:c2:9d:b0:b5:8d:0f:9c:ad:8e:9d:03:d0:
8c:a8:52:f8:59:83:01:c8:88:de:33:9f:d3:05:11:
d3:3f:8d:63:7e:c9:71:7e:47:c1:aa:87:91:57:a2:
b4:c4:bf:ac:9a:11:05:d5:d6:53:87:fa:f1:c8:07:
c3:92:7a:24:fd:f0:07:61:cf:2c:c4:51:2e:45:de:
45:17:73:d7:2a:d8:01:d3:48:7c:d1:07:b1:21:15:
af:08:cc:f0:ae:fa:6e:ef:9a:67:d0:9d:cf:c7:65:
07:87:15:5f:8f:b8:e1:14:77:ea:90:7f:39:58:dc:
7e:1d
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:40:AA:C2:32:02:F4:1F:61:FE:BD:A9:B7:5A:3D:A5:E1:75:74:13:E2
Authority Information Access:
OCSP - URI:http://ipa-ca.domain.com/ca/ocsp
X509v3 Key Usage: critical
Digital Signature, Key Encipherment, Data Encipherment
X509v3 Extended Key Usage:
TLS Web Client Authentication
Signature Algorithm: sha256WithRSAEncryption
38:aa:ac:8b:af:e0:8a:89:dc:24:34:0f:85:bd:21:3f:62:ac:
a3:ec:b8:a3:28:9d:b5:81:c1:9e:77:bc:5d:c5:44:b6:0d:be:
0f:d6:36:08:73:2e:41:e1:20:a2:d0:e3:f7:2b:26:9a:92:8c:
0b:d1:b4:18:fb:b4:a6:3d:c1:e3:89:ed:72:55:5a:bf:e7:0b:
84:9a:4a:12:c6:07:c0:82:39:53:df:67:e0:1c:38:74:6c:35:
73:83:ce:2c:6c:9e:2d:11:3c:f1:60:63:37:ae:05:be:55:60:
ec:9b:a8:7b:31:5a:ce:9b:00:9d:5d:cd:6b:52:1f:ba:5b:4d:
d8:9c:81:db:5e:55:af:85:fc:b3:de:1e:7b:2d:31:10:2e:62:
57:56:f3:ef:f5:7f:47:b2:cc:22:37:22:73:64:e2:35:a9:f8:
08:5f:12:47:31:60:65:6e:17:fe:fb:fe:15:67:a4:d2:bd:c3:
1f:8c:34:e3:3d:45:b6:fb:bf:46:b4:20:37:01:aa:9f:fc:8c:
dc:ca:3b:35:da:6f:06:18:91:cf:f9:f3:22:2a:3d:39:ed:02:
b1:81:6f:df:88:9d:10:43:4b:33:00:07:a8:20:8e:d7:78:76:
68:8a:20:8e:42:6f:88:27:8d:86:73:57:35:4c:dc:dc:04:f1:
68:d9:71:6b:bf:a5:8d:c4:6b:7a:22:31:82:ef:81:0b:a9:22:
33:9e:3d:57:04:06:49:b9:01:2c:12:4b:77:82:fc:e3:f6:a1:
f3:b5:df:d8:7b:3e:3b:06:97:fc:d0:6b:4f:7c:d4:44:a7:aa:
57:3e:23:1b:ea:b4:1d:04:2e:78:9d:da:bc:8d:83:45:66:ba:
04:d9:59:ff:93:a4:21:f8:e0:dd:dc:97:88:1d:7d:28:9c:90:
e7:28:5f:71:ef:dc:57:c5:7b:df:01:36:8f:e8:56:6a:93:14:
e9:a5:95:db:94:32:39:fc:1c:97:cb:6e:9b:cb:88:8a:5b:6a:
da:18:bc:0b:e8:04
-----BEGIN CERTIFICATE-----
MIID4TCCAkmgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA2MRQwEgYDVQQKDAtMT0Mu
RVBITC5CWTEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIwMDYz
MDE5MzE1MVoXDTIyMDYyMDE5MzE1MVowJzEUMBIGA1UECgwLTE9DLkVQSEwuQlkx
DzANBgNVBAMTBklQQSBSQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
ALieCvFxG8rA+dpk3G2cXsaRAepgSYRwQy0iXnzQm+c00ANABfCYdRog3XF2TXZz
pUnEjG4BA0XGId/GV/jhROrMz3TMCYZASVlX1ucd3SrGpkNYRqVMwQir8b8hdyzh
O0BA4k2z+AIyJk2LP0RdHYb1I34e5D5ys1O9Hyi+VhBK1lfmLEyTB56nwp2wtY0P
nK2OnQPQjKhS+FmDAciI3jOf0wUR0z+NY37JcX5HwaqHkVeitMS/rJoRBdXWU4f6
8cgHw5J6JP3wB2HPLMRRLkXeRRdz1yrYAdNIfNEHsSEVrwjM8K76bu+aZ9Cdz8dl
B4cVX4+44RR36pB/OVjcfh0CAwEAAaOBiDCBhTAfBgNVHSMEGDAWgBRAqsIyAvQf
Yf69qbdaPaXhdXQT4jA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAGGIWh0dHA6
Ly9pcGEtY2EubG9jLmVwaGwuYnkvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBLAwEwYD
VR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBADiqrIuv4IqJ3CQ0
D4W9IT9irKPsuKMonbWBwZ53vF3FRLYNvg/WNghzLkHhIKLQ4/crJpqSjAvRtBj7
tKY9weOJ7XJVWr/nC4SaShLGB8CCOVPfZ+AcOHRsNXODzixsni0RPPFgYzeuBb5V
YOybqHsxWs6bAJ1dzWtSH7pbTdicgdteVa+F/LPeHnstMRAuYldW8+/1f0eyzCI3
InNk4jWp+AhfEkcxYGVuF/77/hVnpNK9wx+MNOM9Rbb7v0a0IDcBqp/8jNzKOzXa
bwYYkc/58yIqPTntArGBb9+InRBDSzMAB6ggjtd4dmiKII5Cb4gnjYZzVzVM3NwE
8WjZcWu/pY3Ea3oiMYLvgQupIjOePVcEBkm5ASwSS3eC/OP2ofO139h7PjsGl/zQ
a0981ESnqlc+IxvqtB0ELnid2ryNg0VmugTZWf+TpCH44N3cl4gdfSickOcoX3Hv
3FfFe98BNo/oVmqTFOmllduUMjn8HJfLbpvLiIpbatoYvAvoBA==
-----END CERTIFICATE-----
8:20 a.m.
ldapsearch -D "cn=directory manager" -W -b o=ipaca
"(uid=ipara)"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: (uid=ipara)
# requesting: ALL
#
# ipara, people, ipaca
dn: uid=ipara,ou=people,o=ipaca
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: cmsuser
uid: ipara
sn: ipara
cn: ipara
usertype: agentType
userstate: 1
userCertificate:: MIID4TCCAkmgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA2MRQwEgYDVQQKDAtM
T0MuRVBITC5CWTEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIwMDYzMDE5MzE1M
VoXDTIyMDYyMDE5MzE1MVowJzEUMBIGA1UECgwLTE9DLkVQSEwuQlkxDzANBgNVBAMTBklQQSBSQT
CCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALieCvFxG8rA+dpk3G2cXsaRAepgSYRwQy0
iXnzQm+c00ANABfCYdRog3XF2TXZzpUnEjG4BA0XGId/GV/jhROrMz3TMCYZASVlX1ucd3SrGpkNY
RqVMwQir8b8hdyzhO0BA4k2z+AIyJk2LP0RdHYb1I34e5D5ys1O9Hyi+VhBK1lfmLEyTB56nwp2wt
Y0PnK2OnQPQjKhS+FmDAciI3jOf0wUR0z+NY37JcX5HwaqHkVeitMS/rJoRBdXWU4f68cgHw5J6JP
3wB2HPLMRRLkXeRRdz1yrYAdNIfNEHsSEVrwjM8K76bu+aZ9Cdz8dlB4cVX4+44RR36pB/OVjcfh0
CAwEAAaOBiDCBhTAfBgNVHSMEGDAWgBRAqsIyAvQfYf69qbdaPaXhdXQT4jA9BggrBgEFBQcBAQQx
MC8wLQYIKwYBBQUHMAGGIWh0dHA6Ly9pcGEtY2EubG9jLmVwaGwuYnkvY2Evb2NzcDAOBgNVHQ8BA
f8EBAMCBLAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBADiqrIuv4IqJ3C
Q0D4W9IT9irKPsuKMonbWBwZ53vF3FRLYNvg/WNghzLkHhIKLQ4/crJpqSjAvRtBj7tKY9weOJ7XJ
VWr/nC4SaShLGB8CCOVPfZ+AcOHRsNXODzixsni0RPPFgYzeuBb5VYOybqHsxWs6bAJ1dzWtSH7pb
TdicgdteVa+F/LPeHnstMRAuYldW8+/1f0eyzCI3InNk4jWp+AhfEkcxYGVuF/77/hVnpNK9wx+MN
OM9Rbb7v0a0IDcBqp/8jNzKOzXabwYYkc/58yIqPTntArGBb9+InRBDSzMAB6ggjtd4dmiKII5Cb4
gnjYZzVzVM3NwE8WjZcWu/pY3Ea3oiMYLvgQupIjOePVcEBkm5ASwSS3eC/OP2ofO139h7PjsGl/z
Qa0981ESnqlc+IxvqtB0ELnid2ryNg0VmugTZWf+TpCH44N3cl4gdfSickOcoX3Hv3FfFe98BNo/o
VmqTFOmllduUMjn8HJfLbpvLiIpbatoYvAvoBA==
description: 2;7;CN=Certificate Authority,O=DOMAIN.COM;CN=IPA RA,O=LOC.EPHL.B
Y
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
openssl x509 -text -in /var/lib/ipa/ra-agent.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 7 (0x7)
Signature Algorithm: sha256WithRSAEncryption
Issuer: O = DOMAIN.COM, CN = Certificate Authority
Validity
Not Before: Jun 30 19:31:51 2020 GMT
Not After : Jun 20 19:31:51 2022 GMT
Subject: O = DOMAIN.COM, CN = IPA RA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:b8:9e:0a:f1:71:1b:ca:c0:f9:da:64:dc:6d:9c:
5e:c6:91:01:ea:60:49:84:70:43:2d:22:5e:7c:d0:
9b:e7:34:d0:03:40:05:f0:98:75:1a:20:dd:71:76:
4d:76:73:a5:49:c4:8c:6e:01:03:45:c6:21:df:c6:
57:f8:e1:44:ea:cc:cf:74:cc:09:86:40:49:59:57:
d6:e7:1d:dd:2a:c6:a6:43:58:46:a5:4c:c1:08:ab:
f1:bf:21:77:2c:e1:3b:40:40:e2:4d:b3:f8:02:32:
26:4d:8b:3f:44:5d:1d:86:f5:23:7e:1e:e4:3e:72:
b3:53:bd:1f:28:be:56:10:4a:d6:57:e6:2c:4c:93:
07:9e:a7:c2:9d:b0:b5:8d:0f:9c:ad:8e:9d:03:d0:
8c:a8:52:f8:59:83:01:c8:88:de:33:9f:d3:05:11:
d3:3f:8d:63:7e:c9:71:7e:47:c1:aa:87:91:57:a2:
b4:c4:bf:ac:9a:11:05:d5:d6:53:87:fa:f1:c8:07:
c3:92:7a:24:fd:f0:07:61:cf:2c:c4:51:2e:45:de:
45:17:73:d7:2a:d8:01:d3:48:7c:d1:07:b1:21:15:
af:08:cc:f0:ae:fa:6e:ef:9a:67:d0:9d:cf:c7:65:
07:87:15:5f:8f:b8:e1:14:77:ea:90:7f:39:58:dc:
7e:1d
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:40:AA:C2:32:02:F4:1F:61:FE:BD:A9:B7:5A:3D:A5:E1:75:74:13:E2
Authority Information Access:
OCSP - URI:http://ipa-ca.domain.com/ca/ocsp
X509v3 Key Usage: critical
Digital Signature, Key Encipherment, Data Encipherment
X509v3 Extended Key Usage:
TLS Web Client Authentication
Signature Algorithm: sha256WithRSAEncryption
38:aa:ac:8b:af:e0:8a:89:dc:24:34:0f:85:bd:21:3f:62:ac:
a3:ec:b8:a3:28:9d:b5:81:c1:9e:77:bc:5d:c5:44:b6:0d:be:
0f:d6:36:08:73:2e:41:e1:20:a2:d0:e3:f7:2b:26:9a:92:8c:
0b:d1:b4:18:fb:b4:a6:3d:c1:e3:89:ed:72:55:5a:bf:e7:0b:
84:9a:4a:12:c6:07:c0:82:39:53:df:67:e0:1c:38:74:6c:35:
73:83:ce:2c:6c:9e:2d:11:3c:f1:60:63:37:ae:05:be:55:60:
ec:9b:a8:7b:31:5a:ce:9b:00:9d:5d:cd:6b:52:1f:ba:5b:4d:
d8:9c:81:db:5e:55:af:85:fc:b3:de:1e:7b:2d:31:10:2e:62:
57:56:f3:ef:f5:7f:47:b2:cc:22:37:22:73:64:e2:35:a9:f8:
08:5f:12:47:31:60:65:6e:17:fe:fb:fe:15:67:a4:d2:bd:c3:
1f:8c:34:e3:3d:45:b6:fb:bf:46:b4:20:37:01:aa:9f:fc:8c:
dc:ca:3b:35:da:6f:06:18:91:cf:f9:f3:22:2a:3d:39:ed:02:
b1:81:6f:df:88:9d:10:43:4b:33:00:07:a8:20:8e:d7:78:76:
68:8a:20:8e:42:6f:88:27:8d:86:73:57:35:4c:dc:dc:04:f1:
68:d9:71:6b:bf:a5:8d:c4:6b:7a:22:31:82:ef:81:0b:a9:22:
33:9e:3d:57:04:06:49:b9:01:2c:12:4b:77:82:fc:e3:f6:a1:
f3:b5:df:d8:7b:3e:3b:06:97:fc:d0:6b:4f:7c:d4:44:a7:aa:
57:3e:23:1b:ea:b4:1d:04:2e:78:9d:da:bc:8d:83:45:66:ba:
04:d9:59:ff:93:a4:21:f8:e0:dd:dc:97:88:1d:7d:28:9c:90:
e7:28:5f:71:ef:dc:57:c5:7b:df:01:36:8f:e8:56:6a:93:14:
e9:a5:95:db:94:32:39:fc:1c:97:cb:6e:9b:cb:88:8a:5b:6a:
da:18:bc:0b:e8:04
-----BEGIN CERTIFICATE-----
MIID4TCCAkmgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA2MRQwEgYDVQQKDAtMT0Mu
RVBITC5CWTEeMBwGA1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTIwMDYz
MDE5MzE1MVoXDTIyMDYyMDE5MzE1MVowJzEUMBIGA1UECgwLTE9DLkVQSEwuQlkx
DzANBgNVBAMTBklQQSBSQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
ALieCvFxG8rA+dpk3G2cXsaRAepgSYRwQy0iXnzQm+c00ANABfCYdRog3XF2TXZz
pUnEjG4BA0XGId/GV/jhROrMz3TMCYZASVlX1ucd3SrGpkNYRqVMwQir8b8hdyzh
O0BA4k2z+AIyJk2LP0RdHYb1I34e5D5ys1O9Hyi+VhBK1lfmLEyTB56nwp2wtY0P
nK2OnQPQjKhS+FmDAciI3jOf0wUR0z+NY37JcX5HwaqHkVeitMS/rJoRBdXWU4f6
8cgHw5J6JP3wB2HPLMRRLkXeRRdz1yrYAdNIfNEHsSEVrwjM8K76bu+aZ9Cdz8dl
B4cVX4+44RR36pB/OVjcfh0CAwEAAaOBiDCBhTAfBgNVHSMEGDAWgBRAqsIyAvQf
Yf69qbdaPaXhdXQT4jA9BggrBgEFBQcBAQQxMC8wLQYIKwYBBQUHMAGGIWh0dHA6
Ly9pcGEtY2EubG9jLmVwaGwuYnkvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBLAwEwYD
VR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggGBADiqrIuv4IqJ3CQ0
D4W9IT9irKPsuKMonbWBwZ53vF3FRLYNvg/WNghzLkHhIKLQ4/crJpqSjAvRtBj7
tKY9weOJ7XJVWr/nC4SaShLGB8CCOVPfZ+AcOHRsNXODzixsni0RPPFgYzeuBb5V
YOybqHsxWs6bAJ1dzWtSH7pbTdicgdteVa+F/LPeHnstMRAuYldW8+/1f0eyzCI3
InNk4jWp+AhfEkcxYGVuF/77/hVnpNK9wx+MNOM9Rbb7v0a0IDcBqp/8jNzKOzXa
bwYYkc/58yIqPTntArGBb9+InRBDSzMAB6ggjtd4dmiKII5Cb4gnjYZzVzVM3NwE
8WjZcWu/pY3Ea3oiMYLvgQupIjOePVcEBkm5ASwSS3eC/OP2ofO139h7PjsGl/zQ
a0981ESnqlc+IxvqtB0ELnid2ryNg0VmugTZWf+TpCH44N3cl4gdfSickOcoX3Hv
3FfFe98BNo/oVmqTFOmllduUMjn8HJfLbpvLiIpbatoYvAvoBA==
-----END CERTIFICATE-----
This all looks sane. Any luck with freeipa-healthcheck?
You can find more information about this tool here:
https://github.com/freeipa/freeipa-healthcheck
Cheers,
Thorsten
2:48 a.m.
ipa-healthcheck
DOMAIN.COM IPA CA not found, assuming 3rd party
DSTRootCAX3 not found, assuming 3rd party
letsencryptx3 not found, assuming 3rd party
USERTrustRSA.crt not found, assuming 3rd party
ra.get_certificate(): EXCEPTION (You did not provide a valid certificate for this
operation)
ra.get_certificate(): EXCEPTION (You did not provide a valid certificate for this
operation)
ra.get_certificate(): EXCEPTION (You did not provide a valid certificate for this
operation)
ra.get_certificate(): EXCEPTION (You did not provide a valid certificate for this
operation)
ra.get_certificate(): EXCEPTION (You did not provide a valid certificate for this
operation)
ra.get_certificate(): EXCEPTION (You did not provide a valid certificate for this
operation)
ra.get_certificate(): EXCEPTION (You did not provide a valid certificate for this
operation)
ra.get_certificate(): EXCEPTION (You did not provide a valid certificate for this
operation)
[
{
"source": "pki.server.healthcheck.meta.csconfig",
"check": "CADogtagCertsConfigCheck",
"result": "ERROR",
"uuid": "3c3b5b4d-7540-4c1d-949a-1f914fa71940",
"when": "20201224084642Z",
"duration": "0.185150",
"kw": {
"key": "ca_signing",
"nickname": "caSigningCert cert-pki-ca",
"directive": "ca.signing.cert",
"configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg",
"msg": "Certificate 'caSigningCert cert-pki-ca' does not
match the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg"
}
},
{
"source": "ipahealthcheck.dogtag.ca",
"check": "DogtagCertsConnectivityCheck",
"result": "ERROR",
"uuid": "822010eb-7ed2-4e32-b052-63604f97771f",
"when": "20201224084645Z",
"duration": "0.828900",
"kw": {
"msg": "Request for certificate failed, Certificate operation cannot
be completed: EXCEPTION (You did not provide a valid certificate for this
operation)"
}
},
{
"source": "ipahealthcheck.ds.backends",
"check": "BackendsCheck",
"result": "CRITICAL",
"uuid": "3f0a11ee-5587-4701-b079-0da731f4e8ea",
"when": "20201224084645Z",
"duration": "0.286427",
"kw": {
"exception": "No object exists given the filter criteria
cn=changelog"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertRevocation",
"result": "ERROR",
"uuid": "44caf9f7-e98d-48a0-b43d-56e515df425e",
"when": "20201224084648Z",
"duration": "0.480865",
"kw": {
"key": "20201215135603",
"serial": 7,
"error": "Certificate operation cannot be completed: EXCEPTION (You
did not provide a valid certificate for this operation)",
"msg": "Request for certificate serial number {serial} in request
{key} failed: {error}"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertRevocation",
"result": "ERROR",
"uuid": "c2807ed3-761f-47f6-b877-92ffe06cc250",
"when": "20201224084649Z",
"duration": "0.738635",
"kw": {
"key": "20201215135556",
"serial": 5,
"error": "Certificate operation cannot be completed: EXCEPTION (You
did not provide a valid certificate for this operation)",
"msg": "Request for certificate serial number {serial} in request
{key} failed: {error}"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertRevocation",
"result": "ERROR",
"uuid": "86b5d020-2cfe-46c9-8507-128edb48ea72",
"when": "20201224084649Z",
"duration": "0.999111",
"kw": {
"key": "20201215135559",
"serial": 2,
"error": "Certificate operation cannot be completed: EXCEPTION (You
did not provide a valid certificate for this operation)",
"msg": "Request for certificate serial number {serial} in request
{key} failed: {error}"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertRevocation",
"result": "ERROR",
"uuid": "acd31740-d6a9-4634-8f66-c4f164cc32e3",
"when": "20201224084649Z",
"duration": "1.153550",
"kw": {
"key": "20201215135600",
"serial": 4,
"error": "Certificate operation cannot be completed: EXCEPTION (You
did not provide a valid certificate for this operation)",
"msg": "Request for certificate serial number {serial} in request
{key} failed: {error}"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertRevocation",
"result": "ERROR",
"uuid": "0f7b4134-d07f-483d-8795-5d6eea25ab34",
"when": "20201224084649Z",
"duration": "1.339269",
"kw": {
"key": "20201215135601",
"serial": 11,
"error": "Certificate operation cannot be completed: EXCEPTION (You
did not provide a valid certificate for this operation)",
"msg": "Request for certificate serial number {serial} in request
{key} failed: {error}"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertRevocation",
"result": "ERROR",
"uuid": "94a587d7-a8b6-4535-95d3-f4c32342c892",
"when": "20201224084650Z",
"duration": "1.537558",
"kw": {
"key": "20201215135602",
"serial": 3,
"error": "Certificate operation cannot be completed: EXCEPTION (You
did not provide a valid certificate for this operation)",
"msg": "Request for certificate serial number {serial} in request
{key} failed: {error}"
}
},
{
"source": "ipahealthcheck.ipa.certs",
"check": "IPACertRevocation",
"result": "ERROR",
"uuid": "f58ee3f7-c95f-465d-b2ae-d9f247e45ed6",
"when": "20201224084650Z",
"duration": "1.622168",
"kw": {
"key": "20200630193334",
"serial": 10,
"error": "Certificate operation cannot be completed: EXCEPTION (You
did not provide a valid certificate for this operation)",
"msg": "Request for certificate serial number {serial} in request
{key} failed: {error}"
}
}
]
8:56 a.m.
Evg Hertz via FreeIPA-users wrote:
how recreate CA and
directory server
http server
KDC
?
IMHO the way forward is to figure out what is wrong with your
installation. There is no replacing individual components.
The RA cert appears to be ok but it apparently is being rejected during
authentication. Can you run this to see whether the certificate has been
revoked? 7 is the serial number of the RA cert.
# pki cert-show 7
WARNING: pki cert has been deprecated. Use pki ca-cert instead.
WARNING: UNTRUSTED ISSUER encountered on
'CN=ipa.example.test,O=EXAMPLE.TEST' indicates a non-trusted CA cert
'CN=Certificate Authority,O=EXAMPLE.TEST'
Trust this certificate (y/N)? y
Serial Number: 0x7
Subject DN: CN=IPA RA,O=EXAMPLE.TEST
Issuer DN: CN=Certificate Authority,O=EXAMPLE.TEST
Status: VALID
Not Valid Before: Mon Jan 04 13:59:14 UTC 2021
Not Valid After: Sun Dec 25 13:59:14 UTC 2022
The status should be VALID.
If it is valid then I think we need to see some logs from 389 and pki to
try to find out why the auth is rejected.
rob
9:47 a.m.
pki cert-show 7
WARNING: pki cert has been deprecated. Use pki ca-cert instead.
WARNING: UNTRUSTED ISSUER encountered on 'CN=ns01.domain.com,O=DOMAIN.COM'
indicates a non-trusted CA cert 'CN=Certificate Authority,O=DOMAIN.COM'
Trust this certificate (y/N)? y
Serial Number: 0x7
Subject DN: CN=IPA RA,O=DOMAIN.COM
Issuer DN: CN=Certificate Authority,O=DOMAIN.COM
Status: VALID
Not Valid Before: Tue Jun 30 19:31:51 UTC 2020
Not Valid After: Mon Jun 20 19:31:51 UTC 2022
9:54 a.m.
Evg Hertz via FreeIPA-users wrote:
getcert list -f /var/lib/ipa/ra-agent.pem | grep expires
expires: 2022-06-20 19:31:51 UTC
I dont find /var/lib/ipa/ra-agent.pem in output
ldapsearch -D "cn=directory manager" -W -b o=ipaca
I'd suggest installing freeipa-healthcheck (or ipa-healthcheck on
RHEL/CentOS) and see if that provides any information on the issue.
rob
1207
days inactive
1224
days old
freeipa-users@lists.fedorahosted.org
12 comments
4 participants
participants (4)
-
Evg Hertz -
Florence Blanc-Renaud -
Rob Crittenden -
Thorsten Scherf