<div dir="ltr">Running FreeIPA 2.1.4 and ran into an issue where a Server-Cert did not auto-renew.<div><br></div><div><div>ipa-getcert list</div><div>Number of certificates and requests being tracked: 4.</div><div>Request ID '20110706215109':</div> <div><span class="" style="white-space:pre"> </span>status: MONITORING</div><div><span class="" style="white-space:pre"> </span>stuck: no</div><div><span class="" style="white-space:pre"> </span>key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-CTIDATA-NET',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-CTIDATA-NET/pwdfile.txt'</div> <div><span class="" style="white-space:pre"> </span>certificate: type=NSSDB,location='/etc/dirsrv/slapd-CTIDATA-NET',nickname='Server-Cert',token='NSS Certificate DB'</div><div><span class="" style="white-space:pre"> </span>CA: IPA</div> <div><span class="" style="white-space:pre"> </span>issuer: CN=Certificate Authority,O=<a href="http://CTIDATA.NET">CTIDATA.NET</a></div><div><span class="" style="white-space:pre"> </span>subject: CN=<a href="http://ipa01.ctidata.net">ipa01.ctidata.net</a>,O=<a href="http://CTIDATA.NET">CTIDATA.NET</a></div> <div><span class="" style="white-space:pre"> </span>expires: 2013-08-23 20:20:10 UTC</div><div><span class="" style="white-space:pre"> </span>eku: id-kp-serverAuth</div><div><span class="" style="white-space:pre"> </span>track: yes</div> <div><span class="" style="white-space:pre"> </span>auto-renew: yes</div><div>Request ID '20110706215129':</div><div><span class="" style="white-space:pre"> </span>status: MONITORING</div><div><span class="" style="white-space:pre"> </span>stuck: no</div> <div><span class="" style="white-space:pre"> </span>key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA/pwdfile.txt'</div> <div><span class="" style="white-space:pre"> </span>certificate: type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS Certificate DB'</div><div><span class="" style="white-space:pre"> </span>CA: IPA</div> <div><span class="" style="white-space:pre"> </span>issuer: CN=Certificate Authority,O=<a href="http://CTIDATA.NET">CTIDATA.NET</a></div><div><span class="" style="white-space:pre"> </span>subject: CN=<a href="http://ipa01.ctidata.net">ipa01.ctidata.net</a>,O=<a href="http://CTIDATA.NET">CTIDATA.NET</a></div> <div><span class="" style="white-space:pre"> </span>expires: 2013-08-23 20:30:21 UTC</div><div><span class="" style="white-space:pre"> </span>eku: id-kp-serverAuth</div><div><span class="" style="white-space:pre"> </span>track: yes</div> <div><span class="" style="white-space:pre"> </span>auto-renew: yes</div><div>Request ID '20120615190133':</div><div><span class="" style="white-space:pre"> </span>status: CA_UNCONFIGURED</div><div><span class="" style="white-space:pre"> </span>ca-error: Error setting up ccache for local "host" service using default keytab.</div> <div><span class="" style="white-space:pre"> </span>stuck: yes</div><div><span class="" style="white-space:pre"> </span>key pair storage: type=NSSDB,location='/etc/pki/nssdb',nickname='Server-Cert',token='NSS Certificate DB'</div> <div><span class="" style="white-space:pre"> </span>certificate: type=NSSDB,location='/etc/pki/nssdb',nickname='Server-Cert'</div><div><span class="" style="white-space:pre"> </span>CA: IPA</div><div><span class="" style="white-space:pre"> </span>issuer: </div> <div><span class="" style="white-space:pre"> </span>subject: </div><div><span class="" style="white-space:pre"> </span>expires: unknown</div><div><span class="" style="white-space:pre"> </span>track: yes</div><div><span class="" style="white-space:pre"> </span>auto-renew: yes</div> <div>Request ID '20120925200227':</div><div><span class="" style="white-space:pre"> </span>status: GENERATING_CSR</div><div><span class="" style="white-space:pre"> </span>ca-error: Unable to determine principal name for signing request.</div> <div><span class="" style="white-space:pre"> </span>stuck: no</div><div><span class="" style="white-space:pre"> </span>key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'</div> <div><span class="" style="white-space:pre"> </span>certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'</div><div><span class="" style="white-space:pre"> </span>CA: IPA</div> <div><span class="" style="white-space:pre"> </span>issuer: CN=Certificate Authority,O=<a href="http://CTIDATA.NET">CTIDATA.NET</a></div><div><span class="" style="white-space:pre"> </span>subject: CN=<a href="http://ipa01.ctidata.net">ipa01.ctidata.net</a>,O=<a href="http://CTIDATA.NET">CTIDATA.NET</a></div> <div><span class="" style="white-space:pre"> </span>expires: 2013-03-24 19:56:36 UTC</div><div><span class="" style="white-space:pre"> </span>eku: id-kp-serverAuth</div><div><span class="" style="white-space:pre"> </span>track: yes</div> <div><span class="" style="white-space:pre"> </span>auto-renew: yes</div></div><div><br></div><div style>I verified that the IPA keytab is populated:</div><div style><br></div><div style><div>klist -kt /etc/krb5.keytab</div> <div>Keytab name: WRFILE:/etc/krb5.keytab</div><div>KVNO Timestamp Principal</div><div>---- ----------------- --------------------------------------------------------</div><div> 2 07/06/11 21:51:43 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 2 07/06/11 21:51:43 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div> 2 07/06/11 21:51:43 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 2 07/06/11 21:51:43 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div> 2 07/06/11 21:51:43 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 2 07/06/11 21:51:43 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div> 4 07/18/12 21:20:41 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 4 07/18/12 21:20:41 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div> 4 07/18/12 21:20:41 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 4 07/18/12 21:20:41 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div> 5 07/18/12 21:21:00 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 5 07/18/12 21:21:00 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div> 5 07/18/12 21:21:00 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 5 07/18/12 21:21:00 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div> 6 05/02/13 15:02:10 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 6 05/02/13 15:02:10 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div> 6 05/02/13 15:02:10 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div> <div> 6 05/02/13 15:02:10 host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a></div><div style> </div><div style>and ran kvno host/<a href="http://ipa01.ctidata.net">ipa01.ctidata.net</a> to see what the KDC shows for this principle:</div> <div>host/<a href="mailto:ipa01.ctidata.net@CTIDATA.NET">ipa01.ctidata.net@CTIDATA.NET</a>: kvno = 6</div><div><br></div><div style>Not sure what caused the ca_errors but I need to at least manually renew the certs and then figure out what went wrong.</div> <div style><br></div><div style>Any advice on what the ca_errors mean and how I can fix the issue?</div><div style><br></div><div style>Thanks,</div><div style>David</div><div><br></div></div><div style><br></div></div>