<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Feb 10, 2016, at 3:01 AM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" class="">rcritten@redhat.com</a>> wrote:</div>
<div class="">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br class="">
[09/Feb/2016:12:55:41 -0600] conn=109598 fd=287 slot=287 SSL connection from master_ip to master_ip<br class="">
[09/Feb/2016:12:55:41 -0600] conn=109597 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS"<br class="">
[09/Feb/2016:12:55:41 -0600] conn=109597 op=0 RESULT err=0 tag=120 nentries=0 etime=0<br class="">
[09/Feb/2016:12:55:41 -0600] conn=109598 Netscape Portable Runtime error -8181 (Peer's Certificate has expired.); unauthenticated client CN=CA Subsystem,O=<a href="http://XXXXXXX.NET" class="">XXXXXXX.NET</a>; issuer CN=Certificate Authority,O=<a href="http://XXXXXXX.NET" class="">XXXXXXX.NET</a><br class="">
[09/Feb/2016:12:55:41 -0600] conn=109598 op=-1 fd=287 closed - Peer's Certificate has expired.<br class="">
<br class="">
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Ok,
right. The subsystem cert expired on Feb 1 so you'd have to back at least that far in time to do the renewals.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>
<blockquote type="cite" class="">There are a few entries in ou=People,o=ipaca that need to reflect the current state of certificates as well.<br class="">
</blockquote>
<br class="">
</div>
<div>Ah, right, just realized that that’s a base that can looked up separately in LDAP..is there anything in particular to look for in there?</div>
<div>
<div><br class="">
</div>
</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<snip><br class="">
<br class="">
</blockquote>
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
All of the host keytabs on all of the IPA servers are correct..are there any other keytabs to check?<br class="">
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">No,
just /etc/krb5.keytab. I think you should focus on getting the CA subsystem certs renewed and then we can look at the other things. So I'd go back in time to Jan 30 or so and just restart certmonger.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>After doing so, certmonger appears to run smoothly and goes from SUBMITTING to MONITORING but the expiration date on all of the certs stays the same. (It’s the same result if ipa-getcert resubmit is run against all of the request IDs..quite perplexing) </div>
<div><br class="">
</div>
<div>If we do a total shutdown/rewind/restart, getcert list produces the following for these 3 certs during the time shift after the restart:</div>
<div><br class="">
</div>
<div>
<div>Request ID '20160209194022':</div>
<div> status: CA_UNREACHABLE</div>
<div> ca-error: Internal error</div>
<div> stuck: no</div>
<div> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set</div>
<div> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'</div>
<div> CA: dogtag-ipa-ca-renew-agent</div>
<div> issuer: CN=Certificate Authority,O=<a href="http://XXXXXXX.NET" class="">XXXXXXX.NET</a></div>
<div> subject: CN=CA Audit,O=<a href="http://XXXXXXX.NET" class="">XXXXXXX.NET</a></div>
<div> expires: 2016-02-01 19:46:48 UTC</div>
<div> key usage: digitalSignature,nonRepudiation</div>
<div> pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad</div>
<div> post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"</div>
<div> track: yes</div>
<div> auto-renew: yes</div>
<div>Request ID '20160209194023':</div>
<div> status: CA_UNREACHABLE</div>
<div> ca-error: Internal error</div>
<div> stuck: no</div>
<div> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set</div>
<div> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'</div>
<div> CA: dogtag-ipa-ca-renew-agent</div>
<div> issuer: CN=Certificate Authority,O=<a href="http://XXXXXXX.NET" class="">XXXXXXX.NET</a></div>
<div> subject: CN=OCSP Subsystem,O=<a href="http://XXXXXXX.NET" class="">XXXXXXX.NET</a></div>
<div> expires: 2016-02-01 19:46:47 UTC</div>
<div> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign</div>
<div> eku: id-kp-OCSPSigning</div>
<div> pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad</div>
<div> post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"</div>
<div> track: yes</div>
<div> auto-renew: yes</div>
<div>Request ID '20160209194024':</div>
<div> status: CA_UNREACHABLE</div>
<div> ca-error: Internal error</div>
<div> stuck: no</div>
<div> key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set</div>
<div> certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'</div>
<div> CA: dogtag-ipa-ca-renew-agent</div>
<div> issuer: CN=Certificate Authority,O=<a href="http://XXXXXXX.NET" class="">XXXXXXX.NET</a></div>
<div> subject: CN=CA Subsystem,O=<a href="http://XXXXXXX.NET" class="">XXXXXXX.NET</a></div>
<div> expires: 2016-02-01 19:46:47 UTC</div>
<div> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment</div>
<div> eku: id-kp-serverAuth,id-kp-clientAuth</div>
<div> pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad</div>
<div> post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"</div>
<div> track: yes</div>
<div> auto-renew: yes</div>
<div><br class="">
</div>
<div>The most puzzling thing (in my opinion) about this issue is that timeshifting doesn’t seem to make any difference at all; pki-tomcatd still doesn’t start cleanly (the log entries are very similar) even though in theory those certs are no longer expired
at that point..it seems as if something else is also the issue.</div>
<div><br class="">
</div>
<div>Your ongoing assistance with this matter is much appreciated.</div>
</div>
<div><br class="">
</div>
<br class="">
<blockquote type="cite" class="">
<div class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">rob</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
</div>
</blockquote>
</div>
<br class="">
<br class="">
</body>
</html>
<pre>
"This message and any attachments may contain confidential information. If you
have received this message in error, any use or distribution is prohibited.
Please notify us by reply e-mail if you have mistakenly received this message,
and immediately and permanently delete it and any attachments. Thank you."</pre>