On 5/14/26 4:40 AM, Giulio Casella via FreeIPA-users wrote:
Hello everyone,
on two out of three ipa server of my setup pki-tomcatd refuse to
start, giving:
SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server:
Authentication failed
After some quick research I tried to verify tomcat internal password:
grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2
> /tmp/pwdfile.txt
This might not be clean enough. Try this instead:
# awk -F= '$1=="internal"{print $2}'
/var/lib/pki/pki-tomcat/conf/password.conf > /tmp/pwdfile.txt
And then:
# certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt
Also, can you give:
#
grep-nE'internaldb\.ldapauth\.(authtype|bindDN|bindPWPrompt|clientCertNickname)|internaldb\.ldapconn\.(host|port|secureConn)'
/var/lib/pki/pki-tomcat/ca/conf/CS.cfg
The password seems to be ok, but when I try to list keys I get:
certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n
'subsystemCert cert-pki-ca'
certutil: Checking token "NSS Certificate DB" in slot "NSS User
Private Key and Certificate Services"
certutil: problem listing keys: SEC_ERROR_INVALID_ALGORITHM: security
library: invalid algorithm.
(no SEC_ERROR_BAD_PASSWORD message, but SEC_ERROR_INVALID_ALGORITHM)
Any ideas?
Flo wrote a good blog to help debug this:
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomcatd-fails-to-start/
Can you provide the generated logs in /var/log/pki/pki-tomcat/ca/debug
when PKI fails to start?--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
