Your CS.cfg file looks odd to me, but it could be the lower version you're running or some manual changes made at sometime.
--->8--- grep internaldb.ldap /etc/pki/pki-tomcat/ca/CS.cfg ------------------------------ internaldb.ldapauth.authtype=SslClientAuth internaldb.ldapauth.bindDN=cn=Directory Manager #AFAIK this should be pkidbuser's DN internaldb.ldapauth.bindPWPrompt=internaldb internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca --->8--- FreeIPA uses ldap as the backend for pki-tomcat, it it uses the ldapauth cert you have listed to look for a UID that has a matching userCert value (more to it, but this sums it up) I believe you might want to try and use the pkidbuser DN instead of the Directory Manager DN as that would produce the proper match for you. I would also verify that the CA that signed your subsystemCert exists in your dirserv ldap nssdb in /etc/dirsrv/slapd-DOMAIN.NAME. If it doesn't exist install it using pk12util and set trust on it with certutil. Hopefully this helps. _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/3AJWZIULUL6NVXSY5GOFSSUBF2JJ6FZ5/
