On 11/06/2012 11:58 AM, Rob Crittenden wrote:
> Dmitri Pal wrote:
>> On 11/06/2012 08:07 AM, Rob Crittenden wrote:
>>> Tim Hughes wrote:
>>>> I am trying to migrate from a fedora-ds-1.1.2-1.fc6 server to
>>>> ipa-server-2.2.0-16.el6.x86_64 with the following command
>>>> ipa migrate-ds ldaps://fedora-ds-server.internal --continue
>>>> --with-compat --base-dn=dc=custsvc,dc=mycompany
>>>> --user-container=ou=People,ou=custsvc,dc=co,dc=mycompany
>>>> --group-container=ou=Groups,ou=custsvc,dc=co,dc=mycompany
>>>> I get the following response.
>>>> ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer
>>>> ipa: DEBUG: cert valid True for
>>>> "CN=ipa-server.internal,O=CO.MYCOMPANY"
>>>> ipa: DEBUG: handshake complete, peer =
>>>> <>
>>>> ipa: DEBUG: Caught fault 4203 from server
>>>> http://ipa-server.internal/ipa/xml: Can't contact LDAP server: TLS
>>>> error
>>>> -8172:Peer's certificate issuer has been marked as not trusted by the
>>>> user.
>>>> ipa: DEBUG: Destroyed connection context.xmlclient
>>>> ipa: ERROR: Can't contact LDAP server: TLS error -8172:Peer's
>>>> certificate issuer has been marked as not trusted by the user.
>>>> I am trying to work out which certificate is not trusted and how I
>>>> should make it trusted. Any help would be appreciated.
>>> I suspect you're going to need to add the CA that issued your LDAP
>>> server certificate to the IPA Apache NSS certificate database (where
>>> our admin framework runs).
>>> You'd add it something like this:
>>> # certutil -A -d /etc/httpd/alias -n 'LDAP CA' -t CT,C,C -a <
>>> /path/to/ca.crt
>>> The -n 'LDAP CA' adds a nickname to the CA. There is nothing special
>>> about this, it just needs to be unique. Use something meaningful to
>>> you.
>>> Then restart the httpd service and try the migration again.
>>> I don't know if we've tested using ldaps, so if my suggestion works
>>> can you let us know?
>> IMO the migrate-ds command should have additional argument to point to
>> the cert file to use for connection.
>> Then the framework should get the cert and import it into the store
>> itself.
>> Rob, do you agree that this would be a valid RFE?
> Yup, certainly something that would make things easier.
> rob

Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.

Looking to carve out IT costs?

Freeipa-users mailing list

Reply via email to