Hmmm so question here .. our domain was originally installed as a 2.x
and upgraded to 3.x .. I installed the replicas using the
ipa-replica-prepare etc but the CA dirsrv instance was never copied over
or started on the replicas (ie no slapd-PKI-* around) .. yet
/etc/ipa/defaults.conf points to the replica itself for certmonger - so
not sure how that will work given there is no CA copy running on the
In the end the process followed was to change the xmlrpc_uri to the
original master and delete and resubit the cert request for Server-Cert
for slapd & httpd/alias we get an up to date cert ... not sure if
anything else broken by doing that though ...
I assume maybe the replcia install/mgmt under 2.x was slightly or
perhaps majorly different ...
On 31/07/2014 6:21 pm, Martin Kosek wrote:
(Adding back the users list as this may be interesting for everyone)
Ok, the steps suggested below should help. If the DS does not want to start at
all because of the expired certificate, you can also edit
/etc/dirsrv/slapd-YOUR-REALM/dse.ldif and edit it manually (only when dirsrv
service is stopped).
On 07/31/2014 09:53 AM, Matt Bryant wrote:
Correct in that the replica does not have a CA and the version being run is
$ rpm -qa ipa-server
restarted the services and get
SERVER-IPA...[31/Jul/2014:18:00:15 +1000] - SSL alert:
CERT_VerifyCertificateNow: verify certificate failed for cert Server-Cert of
family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8181 -
Peer's Certificate has expired.)
so I think it is just dealing with an expired cert ... so will try the other
steps suggested ..
On 31/07/14 17:33, Martin Kosek wrote:
On 07/31/2014 07:49 AM, Matt Bryant wrote:
Got an issue with an IPA replica in that the certs in /etc/httpd/alias &
/etc/dirsrv/slapd-IPA-REALM have expired.
I assume that this replica does not have a CA and we are only dealing with
service HTTPD and DIRSRV service certificates.
Have tried setting date back before expiry on the replica and doing an
'ipa-getcert resubmit -i <id>' but that hasn't worked it looks like the CA
master is actually rejecting it since the havent set the date back on that
Error am getting on replica is ...
Request ID '20120719044839':
ca-error: Server failed request, will retry: -504 (libcurl failed to
execute the HTTP POST transaction. Peer certificate cannot be authenticated
with known CA certificates).
Isn't this rather a problem that the replica does not trust the master server
HTTPD certificate because it's certificates are not valid from replica POV?
is there any way of forcing a re-newel or manual process for updating these
certs .. ???
If this is just a replica without PKI, I would suggest synchronizing the time
back with the master CA server and restarting all the services.
If the HTTPD service does not want to start, follow chapter "25.2.2. Starting
IdM with Expired Certificates" in
and then try to resubmit the certificates so that they can be renewed on the
master. Do not forget to revert the above configuration changes when you are
Also, what version of FreeIPA are you running?
Manager - SMB Services | Melbourne IT | Brisbane | Tel +617 3230 7422 | Mob
Manage your subscription for the Freeipa-users mailing list:
Go To http://freeipa.org for more info on the project