Joseph, Matthew (EXP) wrote:

Here is the output;

Server-Cert     u,u,u

I am using nss-3-13.3-6
I am using the IPA CA.

The thing is, the IPA CA isn't there for some reason, on either side.

You should also have something like


You might check the working master with somethign like:

certutil -V -u V -n Server-Cert -d /etc/dirsrv/slapd-REALM

That will validate the cert trust. I'd suspect it will fail.

So you'd need to add the IPA CA.

certutil -A -n 'EXAMPLE.COM IPA CA' -d /etc/dirsrv/slapd-REALM -t CT,C,C -a -i /etc/ipa/ca.crt

This may address the symptom but how you ended up with the CA missing is baffling.



-----Original Message-----
[] On Behalf Of Jatin Nansi
Sent: Wednesday, April 10, 2013 9:36 PM
Subject: Re: [Freeipa-users] EXTERNAL: Re: ipa-replica-install errors

On 04/10/2013 09:55 PM, Joseph, Matthew (EXP) wrote:


I'm still trying to figure out this error but I am getting nothing.

Anyone have any suggestions or ideas on why this is failing?


[] *On Behalf Of *Joseph,
Matthew (EXP)
*Sent:* Monday, April 08, 2013 12:30 PM
*To:* Nathan Kinder
*Subject:* Re: [Freeipa-users] EXTERNAL: Re: ipa-replica-install


Yup, the client side says the following;

Op=-1 fd=64 closed - Peer does not recognize and trust the CA that
issued your certificate.


Check the version of the nss package on your IPA server. There was a change 
that went into nss-3.14 that disables support for certificate signatures using 
the MD5 hash algorithm. To check if you are using MD5 certificate signatures, 
use this command to examine the certificates -

cerutil -L -d/etc/dirsrv/slapd-DOMAIN-CA/ Server-Cert

If this is the case, the workaround is to downgrade the nss package to version 
3.13. The fix is to re-issue your certificates using the SHA256 hashes.

Are you using the IPA CA, or are you managing the CA independently of IPA?

Jatin Nansi

Freeipa-users mailing list

Freeipa-users mailing list

Freeipa-users mailing list

Reply via email to