Thanks Rob, find my comment inline,

On 06/15/2016 07:18 PM, Rob Crittenden wrote:
Abhijeet Kasurde wrote:
Hi All,

I am creating master replica setup using following commands and getting
error on replica server

2016-06-15T03:53:31Z DEBUG The ipa-replica-install command failed,
exception: NetworkError: cannot connect to
'ldaps://dhcp201-141.testrelm.test:636': TLS error -8157:Certificate
extension not found.

Can anyone explain me what does this error is trying to say ?

I think the server certs you created are lacking one or more extensions, I'm just not entirely sure which ones.

I am performing following steps

$ mkdir /tmp/nssdb
$ vim /tmp/nssdb/password.txt
$ vim /tmp/nssdb/noise.txt
$ certutil -d /tmp/nssdb/ -N -f /tmp/nssdb/password.txt
$ certutil -d /tmp/nssdb -S -n ca -s cn=Test_CA -x -t CTu,Cu,Cu -g 2048
-v 60 -z /tmp/nssdb/noise.txt -2 -f /tmp/nssdb/passwd.txt

You are answering Y, <blank>, Y here right, for: CA certificate, no length, critical?

Yes I am passing 'Y', 0, 'Y' for CA Certificate, no length, Critical.
I'd also add: --keyUsage digitalSignature,nonRepudiation,certSigning,critical

OK I will try this.
$ certutil -d /tmp/nssdb -S -n server -s cn=dhcp201-172.testrelm.test -t
,, -z /tmp/nssdb/noise.txt -c ca -f /tmp/nssdb/passwd.txt

I'd add in: --extKeyUsage serverAuth,clientAuth --keyUsage digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment

OK I will add this too.
You pass in a serial # elsewhere, you may want -m 2 for consistency.

$ /usr/bin/pk12util -o /tmp/nssdb/server.p12 -n server -d /tmp/nssdb -k
/tmp/nssdb/passwd.txt -W Secret123
$ ipa-server-install --http-cert-file /tmp/nssdb/server.p12
--dirsrv-cert-file /tmp/nssdb/server.p12 --ip-address -r
TESTRELM.TEST -p Secret123 -a Secret123 --setup-dns --forwarder --http-pin Secret123 --dirsrv-pin Secret123 -U
$ certutil -d /tmp/nssdb -S -n ca -s cn=Test_CA -x -t CTu,Cu,Cu -g 2048
-v 60 -z /tmp/nssdb/noise.txt -2 -f /tmp/nssdb/passwd.txt -m 3

No need to re-create the CA certificate.

I am trying to update serial number of CA certificate.
$ certutil -d /tmp/nssdb -S -n replica -s cn=dhcp201-141.testrelm.test
-t ,, -z /tmp/nssdb/noise.txt -c ca -f /tmp/nssdb/passwd.txt -m 4
$ /usr/bin/pk12util -o /tmp/nssdb/replica.p12 -n replica -d /tmp/nssdb
-k /tmp/nssdb/passwd.txt -W Secret123ยท
$ ipa-replica-prepare dhcp201-141.testrelm.test --http_pkcs12
/tmp/nssdb/replica.p12 --http_pin Secret123 --dirsrv_pkcs12
/tmp/nssdb/replica.p12 --dirsrv_pin Secret123 --ip-address
$ scp /var/lib/ipa/replica-info-dhcp201-141.testrelm.test.gpg

Attaching console.log and replicainstall.log

I will try above modification and let you know, Rob. Thanks.

Abhijeet Kasurde

IRC: akasurde

Manage your subscription for the Freeipa-users mailing list:
Go to for more info on the project

Reply via email to