Here are some fresh errors. With the correct domain.com
[root@ipa1 user]# systemctl start dirsrv@CS-OBERLIN-EDU httpd krb5kdc
pki-tomcatd@pki-tomcat
Job for krb5kdc.service failed because the control process exited with
error code. See "systemctl status krb5kdc.service" and "journalctl -xe"
for details.
[root@ipa1 user]# systemctl status krb5kdc.service
● krb5kdc.service - Kerberos 5 KDC
Loaded: loaded (/usr/lib/systemd/system/krb5kdc.service; disabled;
vendor preset: disabled)
Active: failed (Result: exit-code) since Thu 2018-12-20 11:29:39
EST; 20s ago
Process: 6328 ExecStart=/usr/sbin/krb5kdc -P /var/run/krb5kdc.pid
$KRB5KDC_ARGS (code=exited, status=1/FAILURE)
Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: Starting Kerberos 5 KDC...
Dec 20 11:29:39 ipa1.cs.oberlin.edu krb5kdc[6328]: krb5kdc: cannot
initialize realm CS.OBERLIN.EDU - see log file for details
Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: krb5kdc.service: control
process exited, code=exited status=1
Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: Failed to start Kerberos
5 KDC.
Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: Unit krb5kdc.service
entered failed state.
Dec 20 11:29:39 ipa1.cs.oberlin.edu systemd[1]: krb5kdc.service failed.
[root@ipa1 user]# journalctl -xe
Dec 20 11:29:44 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:44.896674586 -0500] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=cs,dc=oberlin,dc=edu does not exist
Dec 20 11:29:44 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:44.899381296 -0500] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=vaults,cn=kra,dc=cs,dc=oberlin,dc=edu does not exist
Dec 20 11:29:44 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:44.903264399 -0500] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=ad,cn=etc,dc=cs,dc=oberlin,dc=edu does not exist
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.040709963 -0500] - ERR - NSACLPlugin - acl_parse -
The ACL target cn=automember rebuild membership,cn=tasks,cn=config does
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.048762794 -0500] - ERR - cos-plugin -
cos_dn_defs_cb - Skipping CoS Definition cn=Password
Policy,cn=accounts,dc=cs,dc=ober
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.100326075 -0500] - ERR - set_krb5_creds - Could
not get initial credentials for principal [ldap/[email protected]
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.111839823 -0500] - INFO - slapd_daemon - slapd
started. Listening on All Interfaces port 389 for LDAP requests
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.117194087 -0500] - INFO - slapd_daemon - Listening
on All Interfaces port 636 for LDAPS requests
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (No
Kerberos credentials available (default cache: /tmp/krb5cc_38
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.119103939 -0500] - INFO - slapd_daemon - Listening
on /var/run/slapd-CS-OBERLIN-EDU.socket for LDAPI requests
Dec 20 11:29:45 ipa1.cs.oberlin.edu systemd[1]: Started 389 Directory
Server CS-OBERLIN-EDU..
-- Subject: Unit [email protected] has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit [email protected] has finished starting up.
--
-- The start-up result is done.
Dec 20 11:29:45 ipa1.cs.oberlin.edu polkitd[3318]: Unregistered
Authentication Agent for unix-process:6321:1000965 (system bus name
:1.37, object path /org/freedesktop/PolicyKit1/AuthenticationAgen
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.143848383 -0500] - ERR - slapi_ldap_bind - Error:
could not send startTLS request: error -1 (Can't contact LDAP server) err
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.146250152 -0500] - ERR - NSMMReplicationPlugin -
bind_and_check_pwp - agmt="cn=masterAgreement1-ipa.cs.oberlin.edu-pki-tomc
Dec 20 11:29:45 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:45.221754444 -0500] - ERR - schema-compat-plugin -
schema-compat-plugin tree scan will start in about 5 seconds!
Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:48.233735556 -0500] - ERR - set_krb5_creds - Could
not get initial credentials for principal [ldap/[email protected]
Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:48.240356284 -0500] - ERR - slapi_ldap_bind - Error:
could not send startTLS request: error -1 (Can't contact LDAP server) err
Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1
Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1
Dec 20 11:29:48 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (No
Kerberos credentials available (default cache: /tmp/krb5cc_38
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: WARNING: Exception
processing realm com.netscape.cms.tomcat.ProxyRealm@20492fd8 background
process
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]:
javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Dec 20 11:29:51 ipa1.cs.oberlin.edu server[6160]: at
java.lang.Thread.run(Thread.java:748)
Dec 20 11:29:51 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:51.176732756 -0500] - ERR - schema-compat-plugin -
warning: no entries set up under cn=computers, cn=compat,dc=cs,dc=oberlin,d
Dec 20 11:29:51 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:51.179418586 -0500] - ERR - schema-compat-plugin -
Finished plugin initialization.
Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:54.250696593 -0500] - ERR - set_krb5_creds - Could
not get initial credentials for principal [ldap/[email protected]
Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:29:54.257694833 -0500] - ERR - slapi_ldap_bind - Error:
could not send startTLS request: error -1 (Can't contact LDAP server) err
Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1
Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1
Dec 20 11:29:54 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (No
Kerberos credentials available (default cache: /tmp/krb5cc_38
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: WARNING: Exception
processing realm com.netscape.cms.tomcat.ProxyRealm@20492fd8 background
process
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]:
javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Dec 20 11:30:01 ipa1.cs.oberlin.edu server[6160]: at
java.lang.Thread.run(Thread.java:748)
Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:30:06.269784404 -0500] - ERR - set_krb5_creds - Could
not get initial credentials for principal [ldap/[email protected]
Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]:
[20/Dec/2018:11:30:06.278382823 -0500] - ERR - slapi_ldap_bind - Error:
could not send startTLS request: error -1 (Can't contact LDAP server) err
Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1
Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI client step 1
Dec 20 11:30:06 ipa1.cs.oberlin.edu ns-slapd[6334]: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (No
Kerberos credentials available (default cache: /tmp/krb5cc_38
[root@ipa1 user]#
KRb Log
Dec 20 11:31:18 ipa1 ns-slapd: [20/Dec/2018:11:31:18.366362542 -0500] -
ERR - set_krb5_creds - Could not get initial credentials for principal
[ldap/[email protected]] in keytab
[FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for
requested realm)
Dec 20 11:31:18 ipa1 ns-slapd: [20/Dec/2018:11:31:18.373255123 -0500] -
ERR - slapi_ldap_bind - Error: could not send startTLS request: error -1
(Can't contact LDAP server) errno 107 (Transport endpoint is not connected)
Dec 20 11:31:18 ipa1 ns-slapd: GSSAPI Error: Unspecified GSS failure.
Minor code may provide more information (No Kerberos credentials
available (default cache: /tmp/krb5cc_389))
Dec 20 11:31:21 ipa1 server: WARNING: Exception processing realm
com.netscape.cms.tomcat.ProxyRealm@20492fd8 background process
Dec 20 11:31:21 ipa1 server: javax.ws.rs.ServiceUnavailableException:
Subsystem unavailable
Dec 20 11:31:21 ipa1 server: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Dec 20 11:31:21 ipa1 server: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
Dec 20 11:31:21 ipa1 server: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
Dec 20 11:31:21 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
Dec 20 11:31:21 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:31:21 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:31:21 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Dec 20 11:31:21 ipa1 server: at java.lang.Thread.run(Thread.java:748)
Dec 20 11:31:31 ipa1 server: WARNING: Exception processing realm
com.netscape.cms.tomcat.ProxyRealm@20492fd8 background process
Dec 20 11:31:31 ipa1 server: javax.ws.rs.ServiceUnavailableException:
Subsystem unavailable
Dec 20 11:31:31 ipa1 server: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Dec 20 11:31:31 ipa1 server: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
Dec 20 11:31:31 ipa1 server: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
Dec 20 11:31:31 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
Dec 20 11:31:31 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:31:31 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:31:31 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Dec 20 11:31:31 ipa1 server: at java.lang.Thread.run(Thread.java:748)
dirserv log
Feb 13 09:11:57 ipa1.cs.oberlin.edu krb5kdc[4246](info): IPA certauth
plugin un-loaded.
krb5kdc: Server error - while fetching master key K/M for realm
CS.OBERLIN.EDU
krb5kdc: Server error - while fetching master key K/M for realm
CS.OBERLIN.EDU
krb5kdc: Server error - while fetching master key K/M for realm
CS.OBERLIN.EDU
(END)
systemctl restart certmonger
Dec 20 11:28:11 ipa1 systemd: Stopping Certificate monitoring and PKI
enrollment...
Dec 20 11:28:11 ipa1 systemd: Stopped Certificate monitoring and PKI
enrollment.
Dec 20 11:28:11 ipa1 systemd: Starting Certificate monitoring and PKI
enrollment...
Dec 20 11:28:12 ipa1 systemd: Started Certificate monitoring and PKI
enrollment.
Dec 20 11:28:21 ipa1 server: WARNING: Exception processing realm
com.netscape.cms.tomcat.ProxyRealm@43df7c0 background process
Dec 20 11:28:21 ipa1 server: javax.ws.rs.ServiceUnavailableException:
Subsystem unavailable
Dec 20 11:28:21 ipa1 server: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Dec 20 11:28:21 ipa1 server: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1356)
Dec 20 11:28:21 ipa1 server: at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:5958)
Dec 20 11:28:21 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1542)
Dec 20 11:28:21 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:28:21 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1552)
Dec 20 11:28:21 ipa1 server: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1520)
Dec 20 11:28:21 ipa1 server: at java.lang.Thread.run(Thread.java:748)
getcert list:
[root@ipa1 user]# getcert list
Number of certificates and requests being tracked: 9.
Request ID '20180131032610':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU
subject: CN=CA Audit,O=CS.OBERLIN.EDU
expires: 2018-12-31 13:28:03 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180131032614':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU
subject: CN=OCSP Subsystem,O=CS.OBERLIN.EDU
expires: 2018-12-31 13:26:43 UTC
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180131032615':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU
subject: CN=CA Subsystem,O=CS.OBERLIN.EDU
expires: 2018-12-31 13:26:53 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180131032616':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU
subject: CN=Certificate Authority,O=CS.OBERLIN.EDU
expires: 2038-12-31 03:18:40 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180131032623':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key'
certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU
subject: CN=IPA RA,O=CS.OBERLIN.EDU
expires: 2018-12-31 13:27:15 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20180131032624':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU
subject: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU
expires: 2019-06-25 15:44:03 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20180131032626':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-CS-OBERLIN-EDU',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-CS-OBERLIN-EDU/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-CS-OBERLIN-EDU',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU
subject: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU
expires: 2019-07-06 15:22:41 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
CS-OBERLIN-EDU
track: yes
auto-renew: yes
Request ID '20180131032637':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=CS.OBERLIN.EDU
subject: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU
expires: 2019-07-06 15:22:43 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Request ID '20180131032703':
status: MONITORING
stuck: no
key pair storage:
type=FILE,location='/var/kerberos/krb5kdc/kdc.key'
certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt'
CA: SelfSign
issuer: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU
subject: CN=ipa1.cs.oberlin.edu,O=CS.OBERLIN.EDU
expires: 2020-02-05 02:11:51 UTC
principal name: krbtgt/[email protected]
certificate template/profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
On 2/13/2019 11:20 AM, Rob Crittenden wrote:
Chris Mohler via FreeIPA-users wrote:
Sorry for the delay, It's been busy and I was not able to take the
server down for even a few minutes to check.
Here is the output from the commands you asked about:
[root@ipa1 user]# date
Thu Dec 20 11:27:02 EST 2018
[root@ipa1 user]# ipactl stop
Stopping ipa-otpd Service
Stopping pki-tomcatd Service
Stopping ntpd Service
Stopping ipa-custodia Service
Stopping httpd Service
Stopping kadmin Service
Stopping krb5kdc Service
Stopping Directory Service
ipa: INFO: The ipactl command was successful
[root@ipa1 user]# systemctl start [email protected] httpd krb5kdc
pki-tomcatd@pki-tomcat
Job for [email protected] failed because a configured resource
limit was exceeded. See "systemctl status [email protected]" and
"journalctl -xe" for details.
Job for krb5kdc.service failed because the control process exited with
error code. See "systemctl status krb5kdc.service" and "journalctl -xe"
for details.
[root@ipa1 user]# systemctl status [email protected]
● [email protected] - 389 Directory Server domain.com.
Loaded: loaded (/usr/lib/systemd/system/[email protected]; enabled;
vendor preset: disabled)
Active: failed (Result: resources)
Sorry, that's the wrong service.
systemctl -a |grep dirsrv
Start the one appropriate for your realm.
Without dirsrv nothing else will work so the rest of the errors are
expected.
rob
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
