[Freeipa-users] Re: External & Letsencrypt Certificate | Failed on IPA update.

Florence Blanc-Renaud via FreeIPA-users Thu, 19 Mar 2020 04:47:25 -0700

On 3/19/20 11:29 AM, Faraz Younus via FreeIPA-users wrote:

Thanks now we decided to go with self signed certificate.
currently i'm migrating my old ipa-client to new ipa server but gettingbelow error while I allowed all ports on ipaserver.
My IPA client version is 3.0 and my latest version is 4.6 & IPANUM_VERSION for client is 300 while on new freeipa 40605.
**ipa-client-install --password 'abc123' --domain fixedandmobile.com<http://fixedandmobile.com> --server ipa1.fixedandmobile.com<http://ipa1.fixedandmobile.com> --unattended --force-join
LDAP Error: Connect error: TLS error -8054:You are attempting to importa cert with the same issuer/serial as an existing cert, but that is notthe same cert.

Hi,

you need to check the content of /etc/pki/nssdb and /etc/http/alias andremove the previous CA certificate. The client installer is adding theCA cert in this database but if you already have a cert with the samesubject/issuer/serial it will complain.

For instance:
$ certutil -L -d /etc/pki/nssdb

If needed, remove the existing cert with:
$ certutil -D -n <nickname> -d /etc/pki/nssdb

HTH,
flo

LDAP Error: Connect error: TLS error -8054:You are attempting to importa cert with the same issuer/serial as an existing cert, but that is notthe same cert.

Failed to verify that ipa1.fixedandmobile.com<http://ipa1.fixedandmobile.com> is an IPA Server.

This may mean that the remote server is not up or is not reachable dueto network or firewall settings.


Please make sure the following ports are opened in the firewall settings:

TCP: 80, 88, 389

UDP: 88 (at least one of TCP/UDP ports 88 has to be open)

Also note that following ports are necessary for ipa-client workingproperly after enrollment:


TCP: 464

UDP: 464, 123 (if NTP enabled)

Installation failed. Rolling back changes.

IPA client is not configured on this system.

On Mon, Mar 16, 2020 at 8:16 PM Rob Crittenden <[email protected]<mailto:[email protected]>> wrote:


    Faraz Younus via FreeIPA-users wrote:
     > The fix you suggested is started the LDAP service but it got down two
     > services Krb5kdc & kadmin

    You'll need to look at /var/log/krb5kdc.log to determine why it failed
    to start.

    OR maybe systemctl status krb5kdc will be enlightening.

    rob

     >
     > [root@sg ansible]# ipactl restart --ignore-service-failure
     >
     > Starting Directory Service
     >
     > Starting krb5kdc Service
     >
     > Failed to start krb5kdc Service
     >
     > Forced start, ignoring krb5kdc Service, continuing normal operation
     >
     > Starting kadmin Service
     >
     > Failed to start kadmin Service
     >
     > Forced start, ignoring kadmin Service, continuing normal operation
     >
     > Starting httpd Service
     >
     > Starting ipa-custodia Service
     >
     > Starting ntpd Service
     >
     > Starting pki-tomcatd Service
     >
     > Starting ipa-otpd Service
     >
     > ipa: INFO: The ipactl command was successful
     >
     >
     > On Mon, Mar 16, 2020 at 2:27 AM Faraz Younus <[email protected]
    <mailto:[email protected]>
     > <mailto:[email protected] <mailto:[email protected]>>> wrote:
     >
     >     I'll try to add this suggested config and restart ipactl
     >
     >     But as per you it should not have been the case to install
    client on
     >     master why is that ?
     >
     >     The procedure which I'm following I'm setting master server with
     >     setup ca self signed then after that I'm replacing self
    signed with
     >     external certificate, is this the right way?
     >
     >
     >
     >     On Mon, Mar 16, 2020, 2:18 AM Rob Crittenden
    <[email protected] <mailto:[email protected]>
     >     <mailto:[email protected] <mailto:[email protected]>>> wrote:
     >
     >         Faraz Younus via FreeIPA-users wrote:
     >         > no I did not modify the file , this is from ipa master
    server,
     >         i also
     >         > installed ipa client on master bcoz i was getting sssd
    no cache
     >         > credentials error, when i install client on master it fixed
     >         that error,
     >         > now I'm getting ldap error after that sssd error
     >
     >         It should not have been possible to run
    ipa-client-install on a
     >         master.
     >         I don't know what you did to force it, or what the full
     >         consequences may
     >         be, but I'd try adding the things that Flo suggested to
     >         /etc/ipa/default.conf and restarting httpd to see if it
    helps.
     >
     >         ldap_uri =
    ldapi://%2fvar%2frun%2fslapd-FIXEDANDMOBILE-COM.socket
     >         ra_plugin = dogtag
     >         dogtag_version = 10
     >         mode = production
     >
     >         rob
     >
     >         >
     >         > On Fri, Mar 13, 2020, 7:17 PM Florence Blanc-Renaud
     >         <[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>
     >         > <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>>> wrote:
     >         >
     >         >     On 3/13/20 8:43 AM, Faraz Younus via FreeIPA-users
    wrote:
     >         >     > cat /etc/ipa/default.conf
     >         >     >
     >         >     > #File modified by ipa-client-install
     >         >     >
     >         >     >
     >         >     > [global]
     >         >     >
     >         >     > basedn = dc=fixedandmobile,dc=com
     >         >     >
     >         >     > realm = FIXEDANDMOBILE.COM
    <http://FIXEDANDMOBILE.COM> <http://FIXEDANDMOBILE.COM>
     >         <http://FIXEDANDMOBILE.COM>
     >         >     <http://FIXEDANDMOBILE.COM>
     >         >     >
     >         >     > domain = fixedandmobile.com
    <http://fixedandmobile.com> <http://fixedandmobile.com>
     >         <http://fixedandmobile.com>
     >         >     <http://fixedandmobile.com>
     >         >     >
     >         >     > server = sg.fixedandmobile.com
    <http://sg.fixedandmobile.com>
     >         <http://sg.fixedandmobile.com> <http://sg.fixedandmobile.com>
     >         >     <http://sg.fixedandmobile.com>
     >         >     >
     >         >     > host = sg.fixedandmobile.com
    <http://sg.fixedandmobile.com>
     >         <http://sg.fixedandmobile.com> <http://sg.fixedandmobile.com>
     >         >     <http://sg.fixedandmobile.com>
     >         >     >
     >         >     > xmlrpc_uri = https://sg.fixedandmobile.com/ipa/xml
     >         >     >
     >         >     > enable_ra = True
     >         >
     >         >     Hi,
     >         >
     >         >     looks like you are trying to run "ipactl status" on a
     >         FreeIPA client,
     >         >     because on a server I would expect the file to also
    contain:
     >         >
     >         >     ldap_uri =
     >         ldapi://%2Fvar%2Frun%2Fslapd-FIXEDANDMOBILE-COM.socket
     >         >     mode = production
     >         >     ra_plugin = dogtag
     >         >     dogtag_version = 10
     >         >
     >         >     But on a client, the host and server values would be
     >         different.
     >         >     Did you manually modify the file?
     >         >
     >         >     flo
     >         >     >
     >         >     >
     >         >     > On Fri, Mar 13, 2020 at 12:02 PM Florence
    Blanc-Renaud
     >         >     <[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>
     >         <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>>
     >         >     > <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>
     >         <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>>>> wrote:
     >         >     >
     >         >     >     On 3/13/20 6:42 AM, Faraz Younus via
    FreeIPA-users
     >         wrote:
     >         >     >      > I can have the update on below LDAP error ?
     >         >     >
     >         >     >     What is the content of the
    /etc/ipa/default.conf file?
     >         >     Especially, is
     >         >     >     there a value for "ldap_uri" and does it
    start with
     >         "ldap_uri =
     >         >     >     ldapi://..." ?
     >         >     >
     >         >     >     flo
     >         >     >      >
     >         >     >      > On Wed, Mar 11, 2020 at 6:34 PM Faraz Younus
     >         >     <[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>
     >         <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>>
     >         >     >     <mailto:[email protected]
    <mailto:[email protected]> <mailto:[email protected]
    <mailto:[email protected]>>
     >         <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>>>
     >         >     >      > <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected] <mailto:[email protected]>>
    <mailto:[email protected] <mailto:[email protected]>
     >         <mailto:[email protected] <mailto:[email protected]>>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]> <mailto:[email protected]
    <mailto:[email protected]>>
     >         <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>>>>> wrote:
     >         >     >      >
     >         >     >      >     I have added freeipa users list as well to
     >         this thread
     >         >     >      >
     >         >     >      >     On Wed, Mar 11, 2020 at 6:31 PM Rob
    Crittenden
     >         >     >     <[email protected]
    <mailto:[email protected]> <mailto:[email protected]
    <mailto:[email protected]>>
     >         <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]> <mailto:[email protected]
    <mailto:[email protected]>>
     >         <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>>>
     >         >     >      >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected] <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]> <mailto:[email protected]
    <mailto:[email protected]>>>
     >         <mailto:[email protected] <mailto:[email protected]>
    <mailto:[email protected] <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>>>> wrote:
     >         >     >      >
     >         >     >      >         Faraz Younus wrote:
     >         >     >      >          > Thanks pasted the text instead of
     >         screenshots.
     >         >     >      >
     >         >     >      >         This will work. Can you post this
    to the
     >         >     freeipa-users list?
     >         >     >      >
     >         >     >      >         rob
     >         >     >      >
     >         >     >      >          >
     >         >     >      >          > First failed then successful
    but after
     >         that LDAP
     >         >     broken.
     >         >     >      >          >
     >         >     >      >          > palib.install.certmonger: DEBUG:
     >         certmonger
     >         >     request is
     >         >     >     in state
     >         >     >      >          > dbus.String(u'CA_UNREACHABLE',
     >         variant_level=1)
     >         >     >      >          >
     >         >     >      >          > ipapython.admintool: DEBUG:   File
     >         >     >      >          >

> > "/usr/lib/python2.7/site-packages/ipapython/admintool.py",

     >         >     >      >         line 178, in
     >         >     >      >          > execute
     >         >     >      >          >
     >         >     >      >          >     return_value = self.run()
     >         >     >      >          >
     >         >     >      >          >   File
     >         >     >      >          >
     >         >     >      >
     >         >     >
     >         >

> "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py",

     >         >     >      >          > line 62, in run
     >         >     >      >          >
     >         >     >      >          >     run_with_args(api)
     >         >     >      >          >
     >         >     >      >          >   File
     >         >     >      >          >
     >         >     >      >
     >         >     >
     >         >

> "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py",

     >         >     >      >          > line 112, in run_with_args
     >         >     >      >          >
     >         >     >      >          >     update_server(certs)
     >         >     >      >          >
     >         >     >      >          >   File
     >         >     >      >          >
     >         >     >      >
     >         >     >
     >         >

> "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py",

     >         >     >      >          > line 192, in update_server
     >         >     >      >          >
     >         >     >      >          >     "please check the request
    manually" %
     >         >     request_id)
     >         >     >      >          >
     >         >     >      >          >
     >         >     >      >          > ipapython.admintool: DEBUG: The
     >         ipa-certupdate
     >         >     command
     >         >     >     failed,
     >         >     >      >          > exception: ScriptError: Error
    resubmitting
     >         >     certmonger
     >         >     >     request
     >         >     >      >          > '20200311065837', please check the
     >         request manually
     >         >     >      >          >
     >         >     >      >          > ipapython.admintool: ERROR: Error
     >         resubmitting
     >         >     >     certmonger request
     >         >     >      >          > '20200311065837', please check the
     >         request manually
     >         >     >      >          >
     >         >     >      >          > ipapython.admintool: ERROR: The
     >         ipa-certupdate
     >         >     command
     >         >     >     failed.
     >         >     >      >          >
     >         >     >      >          > [root@sg ansible]# kinit admin
     >         >     >      >          >
     >         >     >      >          > Password for
    [email protected] <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>
     >         >     >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>>
     >         >     >      >         <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>
     >         >     >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>>>
     >         >     >      >         <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>
     >         >     >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>>
     >         >     >      >         <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>
     >         >     >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>>>>:
     >         >     >      >          >
     >         >     >      >          >
     >         >     >      >          > [root@sg ansible]# klist -kt
     >         /etc/krb5.keytab
     >         >     >      >          >
     >         >     >      >          > Keytab name: FILE:/etc/krb5.keytab
     >         >     >      >          >
     >         >     >      >          > KVNO Timestamp         Principal
     >         >     >      >          >
     >         >     >      >          > ---- -----------------
     >         >     >      >          >

> > --------------------------------------------------------

     >         >     >      >          >
     >         >     >      >          >    3 03/11/20 07:15:51
     >         >     >      >
     >          host/[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>
     >         >     <mailto:[email protected]
    <mailto:[email protected]>
     >         <mailto:[email protected]
    <mailto:[email protected]>>>