Thx flo, Indeed you are right, I didn't have an ipaCert certificate store in my NSS databases.
certutil: Could not find cert: ipaCert so I used your ldapsearch command to retrieve the certificate and was able to import it into the various NSS databases with certutil. I don't know why the ipaCert certificate is no longer there. I think ( i'm not sur), i lost it when I installed 3rd part certificates with the ipa-server-certinstall command. My problem is now solved, thank you very much. Pierre Le 04/02/2019 à 16:42, Florence Blanc-Renaud a écrit : > On 2/4/19 12:16 PM, Pierre Labanowski via FreeIPA-users wrote: >> Hello, >> >> I have some issues with certificate management. >> >> 2 important points of the recent information: >> >> - after a longstanding loss of the certification authority. The >> certification authority was deleted and a new one was created. >> https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-lost-ca.htm >> <https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-lost-ca.html> >> ( very big thx ) >> >> - For http and ldap, i use 3rd part certificates ( >> /ipa-server-certinstall /) >> >> >> So far, I've noticed 2 problems : >> >> 1°) ipa-server-upgrade : failed >> >> Impossible to upgrade the server. >> i have a 401 error return when the upgrade script wants to access the >> url: >> >>> GET request https://freeipa4.exemple.fr:8443/ca/rest/account/login >>> ... >>> response status 401 >> >> for this problem, I followed this information : >> https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomcatd-fails-to-start/ >> >> certificate on //etc/pki/pki-tomcat/alias///is the same pkiuser on >> the LDAP server >> >> internaldb.ldapauth.authtype=SslClientAuth >> >> so I don't know why I have a 401 error. >> >> // >> 2°) ipa cert-request --principal : failed >> >> ipa: ERROR: impossible de se connecter à « *MailScanner soupçonne le >> lien suivant d'être une tentative de fraude de la part de >> "freeipa4.exmple.fr:443" * >> https://freeipa4.exmple.fr:443/ca/eeca/ca/profileSubmitSSLClient » : >> (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate >> >> this is strange because on this port 443 i use a 3rd part certificates >> >> do you have any idea what the problem is? I'm lost I don't know what >> to look for anymore. >> > > The 401 error points to ipaCert not allowing to authenticate to PKI > (this certificate is used by FreeIPA framework when it performs > operations on PKI that require authentication). > > On IPA 4.4, this certificate is stored in the NSS database > /etc/httpd/alias with the nickname ipaCert. You can check its content > with > $ certutil -L -d /etc/httpd/alias -n ipaCert > > The same cert must be present in uid=ipara,ou=people,o=ipaca. > $ ldapsearch -D "cn=directory manager" -W -b o=ipaca -LLL -o > ldif-wrap=no "(uid=ipara)" usercertificate description > Enter LDAP Password: > dn: uid=ipara,ou=people,o=ipaca > usercertificate:: MIIDvDC...jyi5w > description: 2;7;CN=Certificate Authority,O=DOMAIN.COM;CN=IPA > RA,O=DOMAIN.COM > > The usercertificate field must contain the ipaCert certificate and the > description field must contain 2;<serial>;<issuer>;<subject>. > > Can you check if the cert is consistent in the NSS database and in LDAP? > HTH, > flo >> thank you in advance >> Pierre >> >> >> here are some excerpts from the log >> >> >> ----- >> >> IPA server version 4.4.0. API version 2.213 >> ----- >> ipaupgrade.log : >> ''' >> 2019-01-29T16:48:21Z DEBUG request GET >> https://freeipa4.exemple.fr:8443/ca/rest/account/login >> 2019-01-29T16:48:21Z DEBUG request body '' >> 2019-01-29T16:48:21Z DEBUG NSSConnection init freeipa4.exemple.fr >> 2019-01-29T16:48:21Z DEBUG Connecting: XX.XX.XX.XX:0 >> 2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage >> = SSL Server >> 2019-01-29T16:48:21Z DEBUG cert valid True for >> "CN=freeipa4.exemple.fr,O=exemple.FR" >> 2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443 >> 2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2 >> 2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA >> 2019-01-29T16:48:21Z DEBUG approved_usage = SSL Server intended_usage >> = SSL Server >> 2019-01-29T16:48:21Z DEBUG cert valid True for >> "CN=freeipa4.exemple.fr,O=exemple.FR" >> 2019-01-29T16:48:21Z DEBUG handshake complete, peer = XX.XX.XX.XX:8443 >> 2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2 >> 2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA >> 2019-01-29T16:48:21Z DEBUG response status 401 >> 2019-01-29T16:48:21Z DEBUG response headers {'content-length': '964', >> 'content-language': 'fr', 'expires': 'Thu, 01 Jan 1970 01:00:00 CET', >> 'server': 'Apache-Coyote/1.1', 'cache-control': 'private', 'date': >> 'Tue, 29 Jan 2019 16:48:21 GMT', 'content-type': >> 'text/html;charset=utf-8', 'www-authenticate': 'Basic realm="C} >> 2019-01-29T16:48:21Z DEBUG response body '<html><head><title>Apache >> Tomcat/7.0.69 - Rapport d\'\'erreur</title><style><!--H1 >> {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} >> H2 >> {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} >> H3 {font' >> 2019-01-29T16:48:21Z ERROR IPA server upgrade failed: Inspect >> /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. >> 2019-01-29T16:48:21Z DEBUG File >> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, >> in execute >> return_value = self.run() >> File >> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", >> line 46, in run >> server.upgrade() >> File >> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >> line 1863, in upgrade >> upgrade_configuration() >> File >> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >> line 1785, in upgrade_configuration >> ca_enable_ldap_profile_subsystem(ca) >> File >> "/usr/lib/python2.7/site-packages/ipaserver/install/server/upgrade.py", >> line 336, in ca_enable_ldap_profile_subsystem >> cainstance.migrate_profiles_to_ldap() >> File >> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", >> line 1984, in migrate_profiles_to_ldap >> _create_dogtag_profile(profile_id, profile_data, overwrite=False) >> File >> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", >> line 1990, in _create_dogtag_profile >> with api.Backend.ra_certprofile as profile_api: >> File >> "/usr/lib/python2.7/site-packages/ipaserver/plugins/dogtag.py", line >> 2060, in __enter__ >> raise errors.RemoteRetrieveError(reason=_('Failed to >> authenticate to CA REST API')) >> >> 2019-01-29T16:48:21Z DEBUG The ipa-server-upgrade command failed, >> exception: RemoteRetrieveError: Échec de l'authentification auprès de >> l'API REST de l'AC >> >> ------- >> # getcert list >> Number of certificates and requests being tracked: 5. >> ------- >> >> _______________________________________________ >> FreeIPA-users mailing list -- [email protected] >> To unsubscribe send an email to >> [email protected] >> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedorahosted.org/archives/list/[email protected] >> > _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
