John Dennis via FreeIPA-users wrote:
On 10/12/2017 05:06 PM, Bhavin Vaidya wrote:
Hello Jon,

thank you for your help. responded to main thread, and just sending
you the actual output for certutil.

[root@ds01 log]#  certutil -d /etc/pki/nssdb -L

Certificate Nickname                                         Trust


ARTERIS.COM IPA CA                                           CT,C,C
ARTERIS.COM IPA CA                                           CT,C,C
ARTERIS.COM IPA CA                                           CT,C,C
ARTERIS.COM IPA CA                                           CT,C,C

These nicknames do not look unique to me, I'm assuming you're still
editing them for inclusion in this email.

But irregardless here is where I'm going with this. Your goal is to
identify the correct cert to use and which to discard. The only way you
can do that is to examine each individual cert. To examine an individual
cert you must have it's *unique* nickname to pass to "certutil -L -a -n
xxx" where xxx is the unique nickname.

Only you can identify the correct cert once you list them. At the
absolute minimum they should each have a unique (issuer,serial_number)
pair. The one you want to use will probably select based on the issuer
and validity dates.

This is how NSS handles multiple copies of the same certificate subject in a given database.

My assumption is that the CA was renewed multiple times.

This should get you the PEM-encoded copies of the certs:

# certutil -D -d /etc/pki/nssdb -n "ARTERIS.COM IPA CA" -a


*From:* John Dennis <>
*Sent:* Thursday, October 12, 2017 6:10 AM
*To:* FreeIPA users list
*Cc:* Bhavin Vaidya; Rob Crittenden
*Subject:* Re: [Freeipa-users] Re: several IPA CA certificate entries
On 10/12/2017 03:29 AM, Rob Crittenden via FreeIPA-users wrote:
Bhavin Vaidya via FreeIPA-users wrote:

I'm having various problem on our FreeIPA setup, like can not establish
new replica server or add a client anymore. Initially we had
issue, then we upgraded the Master FreeIPA server (CentOS 7.0.146) to
FreeIPA v4.4.0) few months back.

On master server it shows up 4 entries for IPA CA certificate. Is this

[root@ds01 ~]# certutil -d /etc/pki/nssdb -L

Certificate Nickname                                         Trust


EXAMPLE.COM IPA CA                                           CT,C,C
EXAMPLE.COM IPA CA                                           CT,C,C
EXAMPLE.COM IPA CA                                           CT,C,C
EXAMPLE.COM IPA CA                                           CT,C,C

The question is: are these all different certificates (and why)? I
assume someone ran ipa-cacert-manage renew a bunch of times.

Multiple entries in itself shouldn't be a problem.

I assume this is related to your client install issues. You may be
able to get away with having just the latest CA cert stored in LDAP
to avoid this.

I saw this last night and my first thought was this shouldn't happen
because certutil enforces nickname uniqueness.

We would like to verify what each cert is, specifically it's issuer and
serial number. But we can't ask certutil to show us the details of a
cert because you must pass the -n nickname flag to certutil so it can
find the cert to display. But since the nicknames are not unique you
can't do that. This is why certutil (and any low level NSS API that adds
a cert to the db) demands name uniqueness.

Are the names listed with -L truly unique? It looks like you edited them.


FreeIPA-users mailing list --
To unsubscribe send an email to

Reply via email to