<div dir="ltr">/etc/ipa/ca.crt was issued by O=<a href="http://CTIDATA.NET">CTIDATA.NET</a>, CN=Certificate Authority<div><br></div><div style>All the certs monitored by Certmonger show the same issuer.</div><div style><br>
</div><div style>Wasn't getting anything back when running the ipahost script you provided, ran <span style="font-family:arial,sans-serif;font-size:13px"> </span><span style="font-family:arial,sans-serif;font-size:13px">ipahost=`grep ^host= /etc/ipa/default.conf | cut -f2- -d=` and echo $ipahost shows nothing so I just ran the openssl section manually:</span></div>
<div style><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div style>openssl s_client -CAfile /etc/ipa/ca.crt -connect ipa01.ctidata.net:https -showcerts < /dev/null<br></div><div style><br>
</div><div style>Results:</div><div style><div>CONNECTED(00000003)</div><div>depth=1 O = <a href="http://CTIDATA.NET">CTIDATA.NET</a>, CN = Certificate Authority</div><div>verify return:1</div><div>depth=0 O = <a href="http://CTIDATA.NET">CTIDATA.NET</a>, CN = <a href="http://ipa01.ctidata.net">ipa01.ctidata.net</a></div>
<div>verify error:num=10:certificate has expired</div><div>notAfter=Mar 24 19:56:36 2013 GMT</div><div>verify return:1</div><div>depth=0 O = <a href="http://CTIDATA.NET">CTIDATA.NET</a>, CN = <a href="http://ipa01.ctidata.net">ipa01.ctidata.net</a></div>
<div>notAfter=Mar 24 19:56:36 2013 GMT</div><div>verify return:1</div><div>---</div><div>Certificate chain</div><div> 0 s:/O=<a href="http://CTIDATA.NET/CN=ipa01.ctidata.net">CTIDATA.NET/CN=ipa01.ctidata.net</a></div><div>
i:/O=<a href="http://CTIDATA.NET/CN=Certificate">CTIDATA.NET/CN=Certificate</a> Authority</div><div>-----BEGIN CERTIFICATE-----</div><div>#####</div><div><div>-----END CERTIFICATE-----</div><div> 1 s:/O=<a href="http://CTIDATA.NET/CN=Certificate">CTIDATA.NET/CN=Certificate</a> Authority</div>
<div> i:/O=<a href="http://CTIDATA.NET/CN=Certificate">CTIDATA.NET/CN=Certificate</a> Authority</div><div>-----BEGIN CERTIFICATE-----</div></div><div>####</div><div><div>-----END CERTIFICATE-----</div><div>---</div><div>
Server certificate</div><div>subject=/O=<a href="http://CTIDATA.NET/CN=ipa01.ctidata.net">CTIDATA.NET/CN=ipa01.ctidata.net</a></div><div>issuer=/O=<a href="http://CTIDATA.NET/CN=Certificate">CTIDATA.NET/CN=Certificate</a> Authority</div>
<div>---</div><div>No client certificate CA names sent</div><div>---</div><div>SSL handshake has read 1959 bytes and written 463 bytes</div><div>---</div><div>New, TLSv1/SSLv3, Cipher is AES256-SHA</div><div>Server public key is 2048 bit</div>
<div>Secure Renegotiation IS supported</div><div>Compression: NONE</div><div>Expansion: NONE</div><div>SSL-Session:</div><div> Protocol : TLSv1</div><div> Cipher : AES256-SHA</div><div> Session-ID: #####</div>
<div> Session-ID-ctx: </div><div> Master-Key: ####</div><div> Key-Arg : None</div><div> Krb5 Principal: None</div><div> PSK identity: None</div><div> PSK identity hint: None</div><div> Start Time: 1367518514</div>
<div> Timeout : 300 (sec)</div><div> Verify return code: 10 (certificate has expired)</div><div>---</div><div>DONE</div></div><div><br></div><div><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Thu, May 2, 2013 at 12:53 PM, Nalin Dahyabhai <span dir="ltr"><<a href="mailto:nalin@redhat.com" target="_blank">nalin@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Thu, May 02, 2013 at 12:45:34PM -0500, Toasted Penguin wrote:<br>
> Here is the output from the submit:<br>
><br>
> /usr/libexec/certmonger/ipa-submit -P bogus/`hostname` ~/req.csr<br>
> Submitting request to "<a href="https://ipa01.ctidata.net/ipa/xml" target="_blank">https://ipa01.ctidata.net/ipa/xml</a>".<br>
> Fault -504: (libcurl failed to execute the HTTP POST transaction,<br>
> explaining: Peer certificate cannot be authenticated with known CA<br>
> certificates).<br>
> Server failed request, will retry: -504 (libcurl failed to execute the HTTP<br>
> POST transaction, explaining: Peer certificate cannot be authenticated<br>
> with known CA certificates).<br>
><br>
> Regarding /etc/ipa/ca.crt, it isn't expired it shows its valid until July<br>
> 6, 2019.<br>
<br>
</div>Hmm, so for both cases, you're seeing errors verifying the IPA server's<br>
certificate. Can you double-check the certificates and that the<br>
server's looks like it was issued by the CA?<br>
<br>
This should more or less repeat the part of the process that's giving<br>
libcurl trouble, and show us the certificates, too:<br>
<br>
ipahost=`grep ^host= /etc/ipa/default.conf | cut -f2- -d=`<br>
openssl s_client -CAfile /etc/ipa/ca.crt \<br>
-connect $ipahost:https -showcerts < /dev/null<br>
<span class="HOEnZb"><font color="#888888"><br>
Nalin<br>
</font></span></blockquote></div><br></div>