<html><body><div style="color:#000; background-color:#fff; font-family:bookman old style, new york, times, serif;font-size:13px"><div id="yui_3_16_0_1_1426113257624_13972"><span></span></div><div id="yui_3_16_0_1_1426113257624_14206">I do have other CAs (just not the master but it is available offline if needed)</div><div id="yui_3_16_0_1_1426113257624_14225"><br></div><div dir="ltr" id="yui_3_16_0_1_1426113257624_14226"> Directory server is running</div><div id="yui_3_16_0_1_1426113257624_14427" dir="ltr">The apache web server is running and I can get to the gui</div><div id="yui_3_16_0_1_1426113257624_14354" dir="ltr">ipa cert-show 1 works</div><div id="yui_3_16_0_1_1426113257624_14373" dir="ltr"><br></div><div id="yui_3_16_0_1_1426113257624_14383" dir="ltr">Are the TLS errors due to the mismatch in certs between slapd-PKI-CA and slapd-NETWORKFLEET-COM?<br></div><div id="yui_3_16_0_1_1426113257624_14379" dir="ltr"><br></div><div id="yui_3_16_0_1_1426113257624_13975" style="font-family: bookman old style, new york, times, serif; font-size: 13px;"> <div id="yui_3_16_0_1_1426113257624_13974" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"><br clear="none"><div id="yui_3_16_0_1_1426113257624_13977" class="y_msg_container">-----Original Message-----<br clear="none"><div class="qtdSeparateBR"><br><br></div><div class="yqt8956665145" id="yqtfd86155">From: <a id="yui_3_16_0_1_1426113257624_13978" shape="rect" ymailto="mailto:freeipa-users-bounces@redhat.com" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [mailto:<a id="yui_3_16_0_1_1426113257624_13980" shape="rect" ymailto="mailto:freeipa-users-bounces@redhat.com" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>] On Behalf Of Rob Crittenden<br clear="none">Sent: Wednesday, March 11, 2015 7:20 PM<br clear="none">To: sipazzo; <a id="yui_3_16_0_1_1426113257624_13979" shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br clear="none">Subject: Re: [Freeipa-users] Need to replace cert for ipa servers<br clear="none"><br clear="none">sipazzo wrote:<br clear="none">> Thanks Rob, I apologize that error was probably not helpful. This is <br clear="none">> what I see when running install in debug mode:<br clear="none">> <br clear="none">> Verifying that ipa2-corp.networkfleet.com (realm EXAMPLE.COM) is an <br clear="none">> IPA server Init LDAP connection with: <br clear="none">> ldap://ipa2-corp.networkfleet.com:389<br clear="none">> LDAP Error: Connect error: TLS error -8179:Peer's Certificate issuer <br clear="none">> is not recognized.<br clear="none">> Verifying that ipa1-xo.networkfleet.com (realm EXAMPLE.COM) is an IPA <br clear="none">> server Init LDAP connection with: ldap://ipa1-xo.networkfleet.com:389<br clear="none">> LDAP Error: Connect error: TLS error -8179:Peer's Certificate issuer <br clear="none">> is not recognized.<br clear="none">> Verifying that ipa1-io.networkfleet.com (realm EXAMPLE.COM) is an IPA <br clear="none">> server Init LDAP connection with: ldap://ipa1-io.networkfleet.com:389<br clear="none">> LDAP Error: Connect error: TLS error -8179:Peer's Certificate issuer <br clear="none">> is not recognized.<br clear="none">> Verifying that ipa2-io.networkfleet.com (realm EXAMPLE.COM) is an IPA <br clear="none">> server Init LDAP connection with: ldap://ipa2-io.networkfleet.com:389<br clear="none">> LDAP Error: Connect error: TLS error -8179:Peer's Certificate issuer <br clear="none">> is not recognized.<br clear="none">> Verifying that ipa2-xo.networkfleet.com (realm EXAMPLE.COM) is an IPA <br clear="none">> server Init LDAP connection with: ldap://ipa2-xo.networkfleet.com:389<br clear="none">> LDAP Error: Connect error: TLS error -8179:Peer's Certificate issuer <br clear="none">> is not recognized.<br clear="none">> <br clear="none">> The certificates are very confusing to me. I don't understand how <br clear="none">> things are working when we have a set of GoDaddy certs in <br clear="none">> slapd-NETWORKFLEET-COM and a set of the Dogtag certs in slapd-PKI-CA.<br clear="none">> The cert in /usr/share/ipa/html/ca.crt looks like the original one <br clear="none">> issued by the Dogtag cert system and matches the ones on the clients.<br clear="none">> Not to further confuse things but the original master server that <br clear="none">> signed all these certs was taken offline months ago due to some issues <br clear="none">> it was having. I do still have access to it if necessary.<br clear="none">> <br clear="none">> As far as why the godaddy certs were swapped out for the Dogtag certs <br clear="none">> it was originally for something as simple as the untrusted certificate <br clear="none">> dialogue when accessing the ipa gui. I did not swap out the certs so <br clear="none">> am unsure of exactly what happened. There is no real need to use the <br clear="none">> GoDaddy certs as far as I am concerned. I just want the best solution <br clear="none">> to the issues I am seeing as I am in kind of a bind with the GoDaddy <br clear="none">> cert being revoked and needing to be replaced and the master Dogtag <br clear="none">> certificate server offline. We have a mixed environment with Rhel 5, 6 <br clear="none">> and Solaris clients so are not using sssd in all cases.<br clear="none">> <br clear="none">> I know this is asking a lot but appreciate any help you can give.<br clear="none"><br clear="none">What is the current state of things? Does your IPA Apache server work?<br clear="none">Is 389-ds up and running? Do you have a working IPA CA?<br clear="none"><br clear="none">Does ipa cert-show 1 work?<br clear="none"><br clear="none">If the answer is yes to all then we should be able to generate new certs for all the services.<br clear="none"><br clear="none">rob</div><br clear="none"><br clear="none">--<br clear="none">Manage your subscription for the Freeipa-users mailing list:<br clear="none"><a id="yui_3_16_0_1_1426113257624_14305" shape="rect" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br clear="none">Go to <a shape="rect" href="http://freeipa.org/" target="_blank">http://freeipa.org </a>for more info on the project<br><br></div> </div> </div> </div></body></html>