<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 09/28/2011 05:03 PM, Sigbjorn Lie wrote: <blockquote cite="mid:4E838B8B.4020601@nixtra.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> On 09/28/2011 03:33 AM, Adam Young wrote: <blockquote cite="mid:4E827957.4080606@redhat.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> After talking with the PKI developer that is fixing this, I found out that one other file needs to be modified: /var/lib/pki-ca/conf/CS.cfg http.port=8080 https.port=8443 On 09/27/2011 07:55 PM, Adam Young wrote: <blockquote cite="mid:4E826272.7050100@redhat.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> <div class="comment"> Siggi, This is my comment in the ticket: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/1889">https://fedorahosted.org/freeipa/ticket/1889</a> We are working on a tool in the PKI project that will perform these steps in an automated fashion. There are three files that need to be addressed. On the tomcat side, the files are in the Tomcat instance managed by IPA in /var/lib/pki-ca. The first is /var/lib/pki-ca/conf/server.xml It needs the addition: + <Connector port="9447" protocol="AJP/1.3" redirectPort="9444" /> You can place it around line 281, above the comment for the line <Engine name="Catalina" defaultHost="localhost"> Second is: /var/lib/pki-ca/webapps/ca/WEB-INF/web.xml For each of the filter entries it needs the code addition below: <blockquote> <init-param> <blockquote> <param-name>proxy_port</param-name> <param-value>443</param-value> </blockquote> </init-param> </blockquote> + <init-param> + <param-name>proxy_port</param-name> + <param-value>443</param-value> + </init-param> <blockquote> <init-param> <blockquote> <param-name>active</param-name> <param-value>true</param-value> </blockquote> </init-param> </blockquote> <blockquote> </filter> </blockquote> The third change is creating a symlink to /etc/pki-ca/proxy.conf in the directory /etc/httpd/conf.d </div> </blockquote> </blockquote> Sorry for the late reply. I have performed the modifications you've suggested to /var/lib/pki-ca/conf/server.xml, and /var/lib/pki-ca/webapps/ca/WEB-INF/web.xml. In the file /var/lib/pki-ca/conf/CS.cfg, the settings we're already http.port=8080 and https.port=8443. I could not find the file /etc/pki-ca/proxy.conf. I did find /usr/share/pki/ca/conf/proxy.conf, I copied this into /etc/httpd/conf.d and replaced [PKI_MACHINE_NAME]:[PKI_AJP_PORT] with localhost:9447. Then I restarted ipa: $ ipactl restart I get a different error now, same error msg both in webui and cli: ipa: ERROR: Certificate format error: [Errno -8192] (SEC_ERROR_IO) An I/O error occurred during security authorization. What do you suggest doing next? :) </blockquote> /etc/httpd/conf.d/nss.conf: oot@vm-077 conf.d]# diff nss.conf.orig nss.conf 74c74 < NSSRenegotiation off --- > NSSRenegotiation on 78c78 < NSSRequireSafeNegotiation off --- > NSSRequireSafeNegotiation on As I said, we are scripting this. I should have had you hold out for the script. <blockquote cite="mid:4E838B8B.4020601@nixtra.com" type="cite"> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> </body> </html>