Hi Rob, Some good news. I did the same with the secondary server. Now on secondary server I can navigate through GUI with out any errors (authentication->certificates->certificates). But on the first server Subjects are missing and all certificates are grayed-out except one.
Another good thing - on both servers I can go to identity->users, then I click on a user who has a personal certificate. And I can see the certificate data via GUI. Also if I run ipa-server-upgrade it fails on a first server with he following message: 2019-11-25T13:34:26Z DEBUG The ipa-server-upgrade command failed, exception: NetworkError: cannot connect to ' https://freeipa.corp.mydomain.de:8443/ca/rest/account/login': [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:618) 2019-11-25T13:34:26Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: NetworkError: cannot connect to ' https://freeipa.corp.mydomain.de:8443/ca/rest/account/login': [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:618) 2019-11-25T13:34:26Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information If I run ipa-cert-show 1 on a first server I see this: [root@freeipa ipa]# ipa cert-show 1 ipa: DEBUG: importing all plugin modules in ipaclient.remote_plugins.schema$5131ac65... ipa: DEBUG: importing plugin module ipaclient.remote_plugins.schema$5131ac65.plugins ipa: DEBUG: importing all plugin modules in ipaclient.plugins... ipa: DEBUG: importing plugin module ipaclient.plugins.automember ipa: DEBUG: importing plugin module ipaclient.plugins.automount ipa: DEBUG: importing plugin module ipaclient.plugins.ca ipa: DEBUG: importing plugin module ipaclient.plugins.cert ipa: DEBUG: importing plugin module ipaclient.plugins.certmap ipa: DEBUG: importing plugin module ipaclient.plugins.certprofile ipa: DEBUG: importing plugin module ipaclient.plugins.csrgen ipa: DEBUG: importing plugin module ipaclient.plugins.dns ipa: DEBUG: importing plugin module ipaclient.plugins.hbacrule ipa: DEBUG: importing plugin module ipaclient.plugins.hbactest ipa: DEBUG: importing plugin module ipaclient.plugins.host ipa: DEBUG: importing plugin module ipaclient.plugins.idrange ipa: DEBUG: importing plugin module ipaclient.plugins.internal ipa: DEBUG: importing plugin module ipaclient.plugins.location ipa: DEBUG: importing plugin module ipaclient.plugins.migration ipa: DEBUG: importing plugin module ipaclient.plugins.misc ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey ipa: DEBUG: importing plugin module ipaclient.plugins.passwd ipa: DEBUG: importing plugin module ipaclient.plugins.permission ipa: DEBUG: importing plugin module ipaclient.plugins.rpcclient ipa: DEBUG: importing plugin module ipaclient.plugins.server ipa: DEBUG: importing plugin module ipaclient.plugins.service ipa: DEBUG: importing plugin module ipaclient.plugins.sudorule ipa: DEBUG: importing plugin module ipaclient.plugins.topology ipa: DEBUG: importing plugin module ipaclient.plugins.trust ipa: DEBUG: importing plugin module ipaclient.plugins.user ipa: DEBUG: importing plugin module ipaclient.plugins.vault ipa: DEBUG: found session_cookie in persistent storage for principal ' [email protected]', cookie: 'ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d' ipa: DEBUG: setting session_cookie into context 'ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;' ipa: INFO: trying https://freeipa.corp.mydomain.de/ipa/session/json ipa: DEBUG: New HTTP connection (freeipa.corp.mydomain.de) ipa: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;' for principal [email protected] ipa: DEBUG: Created connection context.rpcclient_140099072449040 ipa: DEBUG: raw: cert_show(u'1', version=u'2.230') ipa: DEBUG: cert_show(u'1', version=u'2.230') ipa: INFO: [try 1]: Forwarding 'cert_show/1' to json server ' https://freeipa.corp.mydomain.de/ipa/session/json' ipa: DEBUG: HTTP connection keep-alive (freeipa.corp.mydomain.de) ipa: DEBUG: received Set-Cookie (<type 'list'>)'['ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=F24vDMW36nOAh8xZI3Dw9%2b27hmZa1IGrw6xadQQnWsVjp5WFxpJfUcw3ewbovoQGpk5c9QS7xnOTJ9TqOErpti9Z4yT3e2XU1md8%2brrN3nDjuYT2rKazHUDRUq0%2f%2fWk81hXvVfdnWbQ7SoNs0wyrNa3eJu%2fDJABm3qbUW66vcSJA2kVMCI%2bBFYu6GVGZsDAeocu1MlfFL9vvZ49zvsclAA%3d%3d;' for principal [email protected] ipa: DEBUG: Destroyed connection context.rpcclient_140099072449040 ipa: ERROR: cannot connect to ' https://freeipa.corp.mydomain.de:443/ca/agent/ca/displayBySerial': [Errno 13] Permission denied on a second server it prints a certificate: [root@freeipa-02 ~]# ipa cert-show 1 Issuing CA: ipa Certificate: MIIDozCC.....uU= Subject: CN=Certificate Authority,O=CORP.MYDOMAIN.DE Issuer: CN=Certificate Authority,O=CORP.MYDOMAIN.DE Not Before: Tue Dec 05 15:31:39 2017 UTC Not After: Sat Dec 05 15:31:39 2037 UTC Serial number: 1 Serial number (hex): 0x1 Revoked: False пн, 25 нояб. 2019 г. в 14:07, Robert Crittenden <[email protected]>: > I am out of the office until December 2, 2019. > > -- With best regards/Mit freundlichen Grüßen Moudraninets Dmitry, RHCSA http://www.linkedin.com/in/moudraninets http://www.xing.com/profile/Dmitry_Mudraninets
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
