<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Ballontekst Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
p.emailquote, li.emailquote, div.emailquote
{mso-style-name:emailquote;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:1.0pt;
border:none;
padding:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.E-mailStijl18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BallontekstChar
{mso-style-name:"Ballontekst Char";
mso-style-priority:99;
mso-style-link:Ballontekst;
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="NL" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Attached are yesterdays debug log from pki-tomcat<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I tried these actions several times, both scripted and manually<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Curiously, I did a resubmit just now and I got issued a correct certificate.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Van:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com]
<b>Namens </b>wouter.hummelink@kpn.com<br>
<b>Verzonden:</b> donderdag 10 december 2015 08:05<br>
<b>Aan:</b> ftweedal@redhat.com<br>
<b>CC:</b> freeipa-users@redhat.com<br>
<b>Onderwerp:</b> Re: [Freeipa-users] Certificate Profile - Policy Set Not Found<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">I'll send the log as soon as I get a chance. After the mail I also tried fetching a cert on another server cent7.1 that never had a cert issued. This resulted in a cert conformant<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">With caIpaServiceCert<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="x_composer_signature">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#575757">Verzonden vanaf mijn Samsung-apparaat<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
-------- Oorspronkelijk bericht --------<br>
Van: Fraser Tweedale <<a href="mailto:ftweedal@redhat.com">ftweedal@redhat.com</a>>
<br>
Datum: 2015-12-10 03:58 (GMT+01:00) <br>
Aan: "Hummelink, Wouter" <<a href="mailto:wouter.hummelink@kpn.com">wouter.hummelink@kpn.com</a>>
<br>
Cc: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> <br>
Onderwerp: Re: [Freeipa-users] Certificate Profile - Policy Set Not Found <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">On Thu, Dec 10, 2015 at 09:48:35AM +1000, Fraser Tweedale wrote:<br>
> On Wed, Dec 09, 2015 at 10:46:06AM +0000, <a href="mailto:wouter.hummelink@kpn.com">
wouter.hummelink@kpn.com</a> wrote:<br>
> > Hello,<br>
> > <br>
> > Im trying to import and use a certificate profile in IPAv4.2 on RHEL.<br>
> > <br>
> > I've exported the default caIPAServiceCert profile and did the following modification:<br>
> > < profileId=caIPAserviceCert<br>
> > ---<br>
> > > profileId=KPNWebhostingAEM<br>
> > 87c87<br>
> > < policyset.serverCertSet.1.default.params.name=CN=$request.req_subject_name.cn$, O=IPADOMAIN<br>
> > ---<br>
> > > policyset.serverCertSet.1.default.params.name=CN=$request.req_subject_name.cn$, OU=TESTAEM, O=IPADOMAIN<br>
> > <br>
> > Profile<br>
> > Profile ID: KPNWebhostingAEM<br>
> > Profile description: KPN Webhosting AEM<br>
> > Store issued certificates: TRUE<br>
> > <br>
> > CAACL<br>
> > ACL name: ING Intermediairs AEM Application Servers<br>
> > Enabled: TRUE<br>
> > Profiles: KPNWebhostingServiceCertAEM, KPNWebhostingAEM<br>
> > Host Groups: xxx_accp_applications, xxx_prod_applications<br>
> > <br>
> > Trying to request a certificate for a server<br>
> > ipa-getcert request -r -I mongo2 -f /etc/pki/tls/certs/host.crt -k /etc/pki/tls/certs/host.key -TKPNWebhostingAEM<br>
> > <br>
> > Results in:<br>
> > ipa-getcert list<br>
> > Number of certificates and requests being tracked: 1.<br>
> > Request ID 'mongo2':<br>
> > status: CA_UNREACHABLE<br>
> > ca-error: Server at <a href="https://pvlipa1001c.ipadomain/ipa/xml">https://pvlipa1001c.ipadomain/ipa/xml</a> failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be completed: FAILURE (Policy Set Not Found)).<br>
> > stuck: no<br>
> > key pair storage: type=FILE,location='/etc/pki/tls/certs/host.key'<br>
> > certificate: type=FILE,location='/etc/pki/tls/certs/host.crt'<br>
> > CA: IPA<br>
> > issuer:<br>
> > subject:<br>
> > expires: unknown<br>
> > pre-save command:<br>
> > post-save command:<br>
> > track: yes<br>
> > auto-renew: yes<br>
> > <br>
> > Since the same setup was working to request certificates on my lab environment I'm at a loss what is causing the error.<br>
> > <br>
> > Met vriendelijke groet,<br>
> > <br>
> Hi Wouter,<br>
> <br>
> I'm looking into this; stay tuned.<br>
> <br>
OK, I could not reproduce. Is the issue reproducible for you? Did<br>
you execute the commands by hand or as part of a script? Can you<br>
provide your PKI debug log (/var/log/pki/pki-tomcat/ca/debug/)?<br>
<br>
Cheers,<br>
Fraser<o:p></o:p></span></p>
</div>
</div>
</body>
</html>