On 2/4/19 12:16 PM, Pierre Labanowski via FreeIPA-users wrote:
Hello,
I have some issues with certificate management.
2 important points of the recent information:
- after a longstanding loss of the certification authority. The
certification authority was deleted and a new one was created.
https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-lost-ca.htm
<https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-lost-ca.html>
( very big thx )
- For http and ldap, i use 3rd part certificates (
/ipa-server-certinstall /)
So far, I've noticed 2 problems :
1°) ipa-server-upgrade : failed
Impossible to upgrade the server.
i have a 401 error return when the upgrade script wants to access the url:
GET request https://freeipa4.exemple.fr:8443/ca/rest/account/login
...
response status 401
for this problem, I followed this information :
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomcatd-fails-to-start/
certificate on //etc/pki/pki-tomcat/alias///is the same pkiuser on the
LDAP server
internaldb.ldapauth.authtype=SslClientAuth
so I don't know why I have a 401 error.
//
2°) ipa cert-request --principal : failed
ipa: ERROR: impossible de se connecter à « *MailScanner soupçonne le
lien suivant d'être une tentative de fraude de la part de
"freeipa4.exmple.fr:443" *
https://freeipa4.exmple.fr:443/ca/eeca/ca/profileSubmitSSLClient » :
(SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate
this is strange because on this port 443 i use a 3rd part certificates
do you have any idea what the problem is? I'm lost I don't know what to
look for anymore.
The 401 error points to ipaCert not allowing to authenticate to PKI
(this certificate is used by FreeIPA framework when it performs
operations on PKI that require authentication).
On IPA 4.4, this certificate is stored in the NSS database
/etc/httpd/alias with the nickname ipaCert. You can check its content with
$ certutil -L -d /etc/httpd/alias -n ipaCert
The same cert must be present in uid=ipara,ou=people,o=ipaca.
$ ldapsearch -D "cn=directory manager" -W -b o=ipaca -LLL -o
ldif-wrap=no "(uid=ipara)" usercertificate description
Enter LDAP Password:
dn: uid=ipara,ou=people,o=ipaca
usercertificate:: MIIDvDC...jyi5w
description: 2;7;CN=Certificate Authority,O=DOMAIN.COM;CN=IPA
RA,O=DOMAIN.COM
The usercertificate field must contain the ipaCert certificate and the
description field must contain 2;<serial>;<issuer>;<subject>.
Can you check if the cert is consistent in the NSS database and in LDAP?
HTH,
flo
thank you in advance
Pierre
here are some excerpts from the log
-----
IPA server version 4.4.0. API version 2.213
-----
ipaupgrade.log :
'''
2019-01-29T16:48:21Z DEBUG request GET
https://freeipa4.exemple.fr:8443/ca/rest/account/login
2019-01-29T16:48:21Z DEBUG request body ''
2019-01-29T16:48:21Z DEBUG NSSConnection init freeipa4.exemple.fr
2019-01-29T16:48:21Z DEBUG Connecting: XX.XX.XX.XX:0
2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage =
SSL Server
2019-01-29T16:48:21Z DEBUG cert valid True for
"CN=freeipa4.exemple.fr,O=exemple.FR"
2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443
2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage =
SSL Server
2019-01-29T16:48:21Z DEBUG cert valid True for
"CN=freeipa4.exemple.fr,O=exemple.FR"
2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443
2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2
2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA
2019-01-29T16:48:21Z DEBUG response status 401
2019-01-29T16:48:21Z DEBUG response headers {'content-length': '964',
'content-language': 'fr', 'expires': 'Thu, 01 Jan 1970 01:00:00 CET',
'server': 'Apache-Coyote/1.1', 'cache-control': 'private', 'date': 'Tue,
29 Jan 2019 16:48:21 GMT', 'content-type': 'text/html;charset=utf-8',
'www-authenticate': 'Basic realm="C}
2019-01-29T16:48:21Z DEBUG response body '<html><head><title>Apache
Tomcat/7.0.69 - Rapport d\'\'erreur</title><style><!--H1
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
H2
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;}
H3 {font'
2019-01-29T16:48:21Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2019-01-29T16:48:21Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in
execute
return_value = self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 46, in run
server.upgrade()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1863, in upgrade
upgrade_configuration()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 1785, in upgrade_configuration
ca_enable_ldap_profile_subsystem(ca)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py",
line 336, in ca_enable_ldap_profile_subsystem
cainstance.migrate_profiles_to_ldap()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1984, in migrate_profiles_to_ldap
_create_dogtag_profile(profile_id, profile_data, overwrite=False)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1990, in _create_dogtag_profile
with api.Backend.ra_certprofile as profile_api:
File "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py",
line 2060, in __enter__
raise errors.RemoteRetrieveError(reason=_('Failed to authenticate
to CA REST API'))
2019-01-29T16:48:21Z DEBUG The ipa-server-upgrade command failed,
exception: RemoteRetrieveError: Échec de l'authentification auprès de
l'API REST de l'AC
-------
# getcert list
Number of certificates and requests being tracked: 5.
-------
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
