<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div><div>On Dec 5, 2013, at 3:20 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Michael Mercier wrote:<br><blockquote type="cite">Hello,<br><br>A few details to begin:<br><br>The IPA system consists of 3 servers running on fully patched CentOS 6.5 (updated Monday night). DNS is integrated with the IPA system.<br><br>ipa-*-3.0.0-37.<br>mod_nss-1.0.8-19<br>openssl-1.0.1e-16<br><br><br>The system was upgraded from 2.2<br><br><br><br>Yesterday, I revoked a certificate for an old system and signed a certificate for the replacement system (same hostname) with no apparent issues.<br><br>Today, I am attempting to sign a certificate for a new system and I am seeing the following error from the command line (with debug=True in /etc/ipa/default.conf):<br><br>ipa cert-request <csrfile><br>principal: <hostname><br><br>ipa: ERROR: Certificate operation cannot be completed: Failure decoding Certificate Signing Request<br><br>The GUI responds with:<br>IPA ERROR 4310<br>Certificate operation cannot be completed: Failure decoding Certificate Signing Request<br><br>I have no issues running 'openssl req -text -noout -verify -in <csrfile>’ on the request file.<br><br>I did do a 'yum update’ on the system today (after experiencing the errors), with openssl and mod_nss being upgraded on all servers. All systems were rebooted after the upgrade and the problem still exists.<br><br>I did see an older thread with a similar issue, but that seemed to involve updating expired certs and Rob did not seem to be able to reproduce the error. Maybe I am experiencing the same problem?<br><br>Anyone have an idea where a good place to start looking is?<br></blockquote><br>The Failure decoding is a duplicate error message in a couple of different places. I'd recommend modifying it per the other thread so we can know exactly where it failed and why.<br></div></blockquote><div><br></div><div>Here is the exact message after applying the patch…</div><div><br></div><div>ipa: ERROR: Certificate operation cannot be completed: Failure decoding Certificate Signing Request: [Errno -8183] (SEC_ERROR_BAD_DER) security library: improperly formatted DER-encoded message.</div><div><br></div><div>Note: I used java keytool to create the CSR, could that be the problem?</div><div><br></div><div>Thanks,</div><div>Mike</div><br><blockquote type="cite"><div style="font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br>rob</div></blockquote></div><br></div></body></html>