On 09/28/2011 11:35 PM, Adam Young wrote:
On 09/28/2011 05:03 PM, Sigbjorn Lie wrote:
On 09/28/2011 03:33 AM, Adam Young wrote:
After talking with the PKI developer that is fixing this, I found out that one other file needs to be modified:



/var/lib/pki-ca/conf/CS.cfg

http.port=8080
https.port=8443





On 09/27/2011 07:55 PM, Adam Young wrote:

Siggi,

This is my comment in the ticket: https://fedorahosted.org/freeipa/ticket/1889

We are working on a tool in the PKI project that will perform these steps in an automated fashion.


There are three files that need to be addressed.

On the tomcat side, the files are in the Tomcat instance managed by IPA in /var/lib/pki-ca. The first is

/var/lib/pki-ca/conf/server.xml

It needs the addition:

+ <Connector port="9447" protocol="AJP/1.3" redirectPort="9444" />

You can place it around line 281, above the comment for the line <Engine name="Catalina" defaultHost="localhost">

Second is: /var/lib/pki-ca/webapps/ca/WEB-INF/web.xml

For each of the filter entries it needs the code addition below:

    <init-param>

        <param-name>proxy_port</param-name>
        <param-value>443</param-value>

    </init-param>

+ <init-param> + <param-name>proxy_port</param-name> + <param-value>443</param-value> + </init-param>

    <init-param>

        <param-name>active</param-name>
        <param-value>true</param-value>

    </init-param>

    </filter>

The third change is creating a symlink to /etc/pki-ca/proxy.conf in the directory /etc/httpd/conf.d




Sorry for the late reply.

I have performed the modifications you've suggested to /var/lib/pki-ca/conf/server.xml, and /var/lib/pki-ca/webapps/ca/WEB-INF/web.xml.

In the file /var/lib/pki-ca/conf/CS.cfg, the settings we're already http.port=8080 and https.port=8443.

I could not find the file /etc/pki-ca/proxy.conf. I did find /usr/share/pki/ca/conf/proxy.conf, I copied this into /etc/httpd/conf.d and replaced [PKI_MACHINE_NAME]:[PKI_AJP_PORT] with localhost:9447.

Then I restarted ipa: $ ipactl restart

I get a different error now, same error msg both in webui and cli:
ipa: ERROR: Certificate format error: [Errno -8192] (SEC_ERROR_IO) An I/O error occurred during security authorization.

What do you suggest doing next? :)

/etc/httpd/conf.d/nss.conf:

oot@vm-077 conf.d]# diff nss.conf.orig nss.conf
74c74
< NSSRenegotiation off
---
> NSSRenegotiation on
78c78
< NSSRequireSafeNegotiation off
---
> NSSRequireSafeNegotiation on


As I said, we are scripting this. I should have had you hold out for the script.

:)

I see Ade Lee has posted the script now. I'll have a go at the script tomorrow.

Rgds,
Siggi


_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to