<div dir="ltr">Hi,<div><br></div><div>Can you provide the output of :<div>certutil -L -d /etc/dirsrv/slapd-<your domain>/ on replicas that can't start the PKI?<br></div><div><div>Your CA Cert attributes should be CT,C,C</div></div><div><br></div><div>I experience the same issue as you every two replica I install. The fix is :</div><div>certutil -d /etc/dirsrv/slapd-<your domain>/ -A -t "CT,C,C" -n "<YOUR DOMAIN> IPA CA" -i /etc/ipa/ca.crt<br></div><div>and restart ipa server.</div><div><br></div><div><a href="https://www.redhat.com/archives/freeipa-users/2013-August/msg00088.html">https://www.redhat.com/archives/freeipa-users/2013-August/msg00088.html</a><br></div><div><br></div><div>Can you also provide the following line of the file generated by following commands:</div><div><br></div><div>$ ipa certprofile-show --out /tmp/caIPAserviceCert.cfg caIPAserviceCert<br></div><div>$ grep <a href="http://policyset.serverCertSet.1.default.params.name">policyset.serverCertSet.1.default.params.name</a> /tmp/caIPAserviceCert.cfg </div><div><br></div><div>Regards,</div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><font face="arial, helvetica, sans-serif"><div><span style="font-family:arial"><font face="arial, helvetica, sans-serif"><div>--</div><div><font color="#666666">Youenn Piolet</font></div><div><font size="1" color="#999999"><a href="mailto:piolet.y@gmail.com" target="_blank">piolet.y@gmail.com</a></font></div><div style="font-size:large"><span style="font-size:small"><span style="font-family:arial"><div><font face="tahoma, sans-serif"><span style="font-family:arial,verdana,tahoma,sans-serif;font-size:11px"><span style="font-family:tahoma,sans-serif;font-size:small"><font color="#666666"><span style="color:rgb(142,142,142);font-family:arial,verdana,tahoma,sans-serif;font-size:11px"><em><br></em></span></font></span></span></font></div><font color="#8E8E8E" face="arial, verdana, tahoma, sans-serif"></font></span><font color="#8E8E8E" face="arial, verdana, tahoma, sans-serif"></font><font color="#8E8E8E" face="arial, verdana, tahoma, sans-serif"></font></span></div></font></span></div></font></div></div> <br><div class="gmail_quote">2016-06-22 16:26 GMT+02:00 Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">Tomasz Torcz wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Tue, Jun 21, 2016 at 01:38:19PM -0400, Rob Crittenden wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> [Sat Jun 18 18:59:11.337717 2016] [wsgi:error] [pid 748083] CertificateOperationError: Certificate operation cannot be completed: Unable to communicate with CMS (Internal Server Error)<br> [Sat Jun 18 18:59:11.337770 2016] [wsgi:error] [pid 748083]<br> [Sat Jun 18 18:59:11.338805 2016] [wsgi:error] [pid 748083] ipa: INFO: [jsonserver_session] <a href="mailto:admin@PIPEBREAKER.PL" target="_blank">admin@PIPEBREAKER.PL</a>: cert_find(version=u'2.164'): CertificateOperationError<br> <br> How to fix those?<br> </blockquote> <br> You'll need to look at the dogtag debug log for the reason it threw a 500,<br> it's in /var/log/pki-tomcat/ca or something close to that.<br> </blockquote> <br> <br> I've looked into the logs but I'm not wiser. Is there a setting to get<br> rid of java traceback from logs and get more useful messages? There seem<br> to be a problem with SSL connection to port 636, maybe because it seems to use<br> expired certificate?<br> </blockquote> <br> Not that I know of. The debug log is sure a firehose but you've identified<br> the problem.<br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> $ echo | openssl s_client -connect <a href="http://okda.pipebreaker.pl:636" rel="noreferrer" target="_blank">okda.pipebreaker.pl:636</a> | openssl x509 -noout<br> depth=1 O = <a href="http://PIPEBREAKER.PL" rel="noreferrer" target="_blank">PIPEBREAKER.PL</a>, CN = Certificate Authority<br> verify return:1<br> depth=0 O = <a href="http://PIPEBREAKER.PL" rel="noreferrer" target="_blank">PIPEBREAKER.PL</a>, CN = <a href="http://okda.pipebreaker.pl" rel="noreferrer" target="_blank">okda.pipebreaker.pl</a><br> verify error:num=10:certificate has expired<br> notAfter=Nov 17 12:19:28 2015 GMT<br> verify return:1<br> depth=0 O = <a href="http://PIPEBREAKER.PL" rel="noreferrer" target="_blank">PIPEBREAKER.PL</a>, CN = <a href="http://okda.pipebreaker.pl" rel="noreferrer" target="_blank">okda.pipebreaker.pl</a><br> notAfter=Nov 17 12:19:28 2015 GMT<br> verify return:1<br> DONE<br> </blockquote> <br> Run getcert list and look at the expiration dates. What you want to do is<br> kill ntpd, set the date back to say a week before the oldest date, restart<br> the dirsrv, restart the pki-tomcat/pki-cad service then restart certmonger.<br> This should force a renewal attempt.<br> </blockquote> <br> Expiration date look fine:<br> <br> root@okda ~$ getcert list<br> Number of certificates and requests being tracked: 1.<br> Request ID '20131116123125':<br> status: CA_UNREACHABLE<br> ca-error: Server at <a href="https://okda.pipebreaker.pl/ipa/xml" rel="noreferrer" target="_blank">https://okda.pipebreaker.pl/ipa/xml</a> failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be completed: Unable to communicate with CMS (503)).<br> stuck: no<br> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'<br> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'<br> CA: IPA<br> issuer: CN=Certificate Authority,O=<a href="http://PIPEBREAKER.PL" rel="noreferrer" target="_blank">PIPEBREAKER.PL</a><br> subject: CN=<a href="http://okda.pipebreaker.pl" rel="noreferrer" target="_blank">okda.pipebreaker.pl</a>,O=<a href="http://PIPEBREAKER.PL" rel="noreferrer" target="_blank">PIPEBREAKER.PL</a><br> expires: 2017-12-10 19:44:31 UTC<br> principal name: HTTP/<a href="mailto:okda.pipebreaker.pl@PIPEBREAKER.PL" target="_blank">okda.pipebreaker.pl@PIPEBREAKER.PL</a><br> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment<br> eku: id-kp-serverAuth,id-kp-clientAuth<br> pre-save command:<br> post-save command: /usr/lib64/ipa/certmonger/restart_httpd<br> track: yes<br> auto-renew: yes<br> <br> <br> It's in 2017. The output seem quite short, on the other replica "getcert list" returns 9 certificates.<br> </blockquote> <br></div></div> The 503 suggests that the CA didn't come up (service not available). This may be due to expired certs.<br> <br> What you need to do is setup certmonger to track all the certificates properly and get things renewed. I'm away from my desk so can't provide any instructions on how to do this and they depend on whether or not this machine is the renewal master.<span class=""><br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> P.S. Unfortunately <a href="https://fedorahosted.org/pki/ticket/1752" rel="noreferrer" target="_blank">https://fedorahosted.org/pki/ticket/1752</a> (Renewing already expired CA certificate) didn't<br> make into FreeIPA 4.4.0 alpha. :-(<br> </blockquote> <br></span> This is unrelated. I seriously doubt your CA is near expiration (my guess is it expires in 2033).<span class="HOEnZb"><font color="#888888"><br> <br> rob</font></span><div class="HOEnZb"><div class="h5"><br> <br> -- <br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> </div></div></blockquote></div><br></div>