Re: [Freeipa-users] IPA certificates expired, please help!

, Jul 21, 2016 at 12:23 PM, Rob Crittenden <rcrit...@redhat.com> wrote: > Linov Suresh wrote: > >> The httpd_error log doesn't contain the part where `ipa cert-show 1` was >> run. If it is from the same time. >> >> *I am not sure about that, please see httpd_err

Re: [Freeipa-users] IPA certificates expired, please help!

, Linov Suresh <linov.sur...@gmail.com> wrote: > I'm facing another issue now, my kerberos tickets are not renewing, > > *[root@caer ~]# ipa cert-show 1* > ipa: ERROR: Ticket expired > > *[root@caer ~]# klist* > Ticket cache: FILE:/tmp/krb5cc_0 > Default princip

Re: [Freeipa-users] IPA certificates expired, please help!

I agree with you Jakub, I will start separate thread for separate issues. On Fri, Jul 22, 2016 at 10:31 AM, Jakub Hrozek <jhro...@redhat.com> wrote: > On Fri, Jul 22, 2016 at 09:36:27AM -0400, Linov Suresh wrote: > > I'm facing another issue now, my kerberos tickets a

[Freeipa-users] Could not find cert: Signing-Cert : File not found

We are using CentOS 6.4/FreeIPA 3.0.0 LDAP/Apache certificates were expired and when we tried to renew, we found Signing-Cert is missing. # certutil -L -d /etc/httpd/alias -n Signing-Cert certutil: Could not find cert: Signing-Cert : File not found How do we recreate Signing-Cert certificate?

Re: [Freeipa-users] Could not find cert: Signing-Cert : File not found

We were not sure that Signing-Cert required for LDAP/Apache certificates renewal. Thank you very much for your update Rob. We are going to renew the certificates without Signing-Cert. On Mon, Jul 25, 2016 at 6:08 PM, Rob Crittenden <rcrit...@redhat.com> wrote: > Linov Suresh wrote

Re: [Freeipa-users] IPA certificates expired, please help!

9180/ca/ee/ca/profileSubmit?profileId=caServerCert_num=63=true=true>"*." goes away? On Fri, Jul 22, 2016 at 2:45 PM, Rob Crittenden <rcrit...@redhat.com> wrote: > Linov Suresh wrote: > >> Could you please verify, if we have set correct trust attributes on the >> cert

Re: [Freeipa-users] IPA certificates expired, please help!

9180/ca/ee/ca/profileSubmit?profileId=caServerCert_num=63=true=true>"*." gone this time. Thanks for your help. We have a master replica also, *how do we renew the replica server*? On Fri, Jul 22, 2016 at 3:36 PM, Linov Suresh <linov.sur...@gmail.com> wrote: > Thank you very much

[Freeipa-users] Replica install fails when using --setup-ca

I tried to create master replica using the option --setup-ca, it failed, because of "Your system may be partly configured." Please note we use different ipa package for master and replica. master: [root@caer ~]# rpm -q ipa-server ipa-server-3.0.0-26.el6_4.2.x86_64 replica: [root@neit-lab01 ~]#

Re: [Freeipa-users] Could not find cert: Signing-Cert : File not found

ons/962373 ? On Mon, Jul 25, 2016 at 6:17 PM, Linov Suresh <linov.sur...@gmail.com> wrote: > We were not sure that Signing-Cert required for LDAP/Apache certificates > renewal. Thank you very much for your update Rob. We are going to renew the > certificates without Signing-Cert. > >

Re: [Freeipa-users] IPA certificates expired, please help!

=63=true=true>".* On Wed, Jul 20, 2016 at 2:22 PM, Rob Crittenden <rcrit...@redhat.com> wrote: > Linov Suresh wrote: > >> Thanks for your help Rob, I will create a separate thread for IPA >> replication issue. But we are still getting >> * >> * >&

Re: [Freeipa-users] IPA certificates expired, please help!

2016:12:03:28][Timer-0]: CMSEngine: getPasswordStore(): password store initialized before. [21/Jul/2016:12:03:28][Timer-0]: CMSEngine: getPasswordStore(): password store initialized. On Thu, Jul 21, 2016 at 11:46 AM, Petr Vobornik <pvobo...@redhat.com> wrote: > On 07/21/2016 05:14 PM, Linov

Re: [Freeipa-users] IPA certificates expired, please help!

! Linov Suresh 70 Forest Manor Rd. Toronto ON M2J 0A9 Mobile: +1 647 406 9438 Linkedin: ca.linkedin.com/in/linov/ Website: http://mylinuxthoughts.blogspot.com On Mon, Jul 18, 2016 at 10:50 AM, Petr Vobornik <pvobo...@redhat.com> wrote: > On 07/18/2016 05:45 AM, Lin

Re: [Freeipa-users] IPA certificates expired, please help!

rtmonger/restart_dirsrv " TELOIP.NET" track: yes auto-renew: yes On Mon, Jul 18, 2016 at 12:00 PM, Linov Suresh <linov.sur...@gmail.com> wrote: > Yes, PKI is running and I don't see any errors in selftests, I have > followed https://access.redhat.com/solutions/64

Re: [Freeipa-users] IPA certificates expired, please help!

ELOIP.NET" track: yes auto-renew: yes [root@caer ~]# Your help is highly appreciated! On Fri, Jul 15, 2016 at 5:08 PM, Rob Crittenden <rcrit...@redhat.com> wrote: > Linov Suresh wrote: > >> I logged into my IPA master, and found that the cert h

Re: [Freeipa-users] IPA certificates expired, please help!

now, and is affected our production environment. Pleas help us. On Tue, Jul 19, 2016 at 9:27 AM, Linov Suresh <linov.sur...@gmail.com> wrote: > We have cloned and created another virtual server from the template. > Surprisingly this server certificates were also expired at t

Re: [Freeipa-users] IPA certificates expired, please help!

, Jul 18, 2016 at 12:37 PM, Linov Suresh <linov.sur...@gmail.com> wrote: > *Update: my webserver and LDAP certificates were expired at 2016-07-18 > 15:54:36 UTC and the certificates are in CA_UNREACHABLE state.* > > > *Could you please help us? * > > [root@caer

Re: [Freeipa-users] IPA certificates expired, please help!

--uninstall to clean up. Configuration of CA failed [root@neit-lab ~]# I did a clean up using /usr/sbin/ipa-server-install --uninstall but it wasn't helpful. Wondering if you can help us on this, On Tue, Jul 19, 2016 at 10:50 AM, Rob Crittenden <rcrit...@redhat.com> wrote: > Linov Sur

Re: [Freeipa-users] IPA certificates expired, please help!

this new problem so we can keep the > issues separated? > > IPA gets little information back when dogtag fails to install. You need to > look in /var/log//debug for more information. The exact location > depends on the version of IPA. > > rob > > Linov Suresh wrote: > >>

[Freeipa-users] IPA Replication failed: Your system may be partly configured. Run ipa-server-install --uninstall to clean up. Configuration of CA failed

I was trying to replicate our IPA server which is running on CentOS6.4, FreeIPA 3.0 and I got an error, *Your system may be partly configured.* *Run /usr/sbin/ipa-server-install --uninstall to clean up.* *Configuration of CA failed* I ran /usr/sbin/ipa-server-install --uninstall couple of times

[Freeipa-users] IPA certificates expired, please help!

I logged into my IPA master, and found that the cert had expired again, we renewed these certificates about 18 months ago. Our environment is CentOS 6.4 and IPA 3.0.0-26. I followed the Redhat documentation, How do I manually renew Identity Management (IPA) certificates after

[Freeipa-users] IPA certificates expired, please help!

gbi/9WbKSZgNl58L16zgwnZ0pnndDcNf/FXwwRKP wm1YBfh+UyydiHHl/swLyV84vOXr -END CERTIFICATE- Your help is highly appreciated. Regards, Linov Suresh. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project

[Freeipa-users] KDC returned error string: NOT_ALLOWED_TO_DELEGATE

modifying entry "fqdn=cpe-5061747522f9.example.net ,cn=computers,cn=accounts,dc=example,dc=net" Could you please help us to fix this? Appreciate your help in advance, Linov Suresh. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listin

[Freeipa-users] KDC returned error string: NOT_ALLOWED_TO_DELEGATE

We have FreeIPA 3.0.0 running on CentOS 6.4 and master-ipa01 (configured with --setup-ca option) and replica- ipa02 (configured without --setup-ca) option. We use a script ipa clients to the server, when we tried to add new ipa clients, we are getting error, *ipa: ERROR: Insufficient access:

Re: [Freeipa-users] KDC returned error string: NOT_ALLOWED_TO_DELEGATE

I ran ldapsearch -Y GSSAPI, what we are seeing is IPA server 2, ipa02 is missing on both master and replica servers. Do we need to add IPA server 2, ipa02 on both master and replica? *[root@ipa01 ~]# ldapsearch -Y GSSAPI -H ldap://ipa01.teloip.net -b

Re: [Freeipa-users] KDC returned error string: NOT_ALLOWED_TO_DELEGATE

Great! That worked. Thank you so much Rob. Your help is highly appreciated. On Thu, Aug 25, 2016 at 3:49 PM, Rob Crittenden <rcrit...@redhat.com> wrote: > Linov Suresh wrote: > >> I ran ldapsearch -Y GSSAPI, what we are seeing is IPA server 2, ipa02 >> is missing on

Re: [Freeipa-users] KDC returned error string: NOT_ALLOWED_TO_DELEGATE

wrote: > On 08/16/2016 09:25 AM, Petr Spacek wrote: > > On 15.8.2016 20:18, Linov Suresh wrote: > >> We have IPA replica set up in RHEL 6.4 and is FreeIPA 3.0.0 > >> > >> > >> We can only add the clients from IPA Server 01, not from IPA Server 02. > >