<div dir="ltr"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div style="background-color:rgb(255,255,255)"><ul style="margin:0px;padding:0px 0px 8px;border:0px;outline:0px;font-size:12px;font-family:Helvetica,FreeSans,"Liberation Sans",Helmet,Arial,sans-serif;vertical-align:baseline;list-style:none;line-height:17px;display:table-cell;width:504px;color:rgb(51,51,51)"><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;line-height:normal">I logged into my IPA master, and found that the cert had expired again, we renewed these certificates about 18 months ago. Our environment is CentOS 6.4 and IPA 3.0.0-26. <h1 style="margin:0cm 0cm 4.5pt;line-height:15.45pt;background-image:initial;background-repeat:initial">I followed the Redhat documentation, How do I manually renew Identity Management (IPA) certificates after they have expired? (Master IPA Server), <a href="https://access.redhat.com/solutions/643753">https://access.redhat.com/solutions/643753</a> but no luck.</h1> <h1 style="margin:0cm 0cm 4.5pt;line-height:15.45pt;background-image:initial;background-repeat:initial"> </h1> <h1 style="line-height:15.45pt;background-image:initial;background-repeat:initial"><pre>I have also changed "NSSEnforceValidCerts off" in /etc/httpd/conf.d/nss.conf and the value of nsslapd-validate-cert is warn.</pre><pre> </pre><pre>ldapsearch -x -h localhost -p 7389 -D 'cn=directory manager' -w ******* -b cn=config | grep nsslapd-validate-cert</pre><pre>nsslapd-validate-cert: warn</pre><pre> </pre><pre>Here is my getcert list,</pre><pre> </pre><pre>[root@caer ~]# getcert list</pre><pre>Number of certificates and requests being tracked: 8.</pre><pre>Request ID '20111214223243':</pre><pre> status: CA_UNREACHABLE</pre><pre> ca-error: Server failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction. Peer certificate cannot be authenticated with known CA certificates).</pre><pre> stuck: yes</pre><pre> key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-TELOIP-NET',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-TELOIP-NET//pwdfile.txt'</pre><pre> certificate: type=NSSDB,location='/etc/dirsrv/slapd-TELOIP-NET',nickname='Server-Cert',token='NSS Certificate DB'</pre><pre> CA: IPA</pre><pre> issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> subject: CN=<a href="http://caer.teloip.net">caer.teloip.net</a>,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> expires: 2016-01-29 14:09:46 UTC</pre><pre> eku: id-kp-serverAuth</pre><pre> pre-save command: </pre><pre> post-save command: </pre><pre> track: yes</pre><pre> auto-renew: yes</pre><pre>Request ID '20111214223300':</pre><pre> status: CA_UNREACHABLE</pre><pre> ca-error: Server failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction. Peer certificate cannot be authenticated with known CA certificates).</pre><pre> stuck: yes</pre><pre> key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA//pwdfile.txt'</pre><pre> certificate: type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS Certificate DB'</pre><pre> CA: IPA</pre><pre> issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> subject: CN=<a href="http://caer.teloip.net">caer.teloip.net</a>,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> expires: 2016-01-29 14:09:45 UTC</pre><pre> eku: id-kp-serverAuth</pre><pre> pre-save command: </pre><pre> post-save command: </pre><pre> track: yes</pre><pre> auto-renew: yes</pre><pre>Request ID '20111214223316':</pre><pre> status: CA_UNREACHABLE</pre><pre> ca-error: Server failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction. Peer certificate cannot be authenticated with known CA certificates).</pre><pre> stuck: yes</pre><pre> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'</pre><pre> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'</pre><pre> CA: IPA</pre><pre> issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> subject: CN=<a href="http://caer.teloip.net">caer.teloip.net</a>,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> expires: 2016-01-29 14:09:45 UTC</pre><pre> eku: id-kp-serverAuth</pre><pre> pre-save command: </pre><pre> post-save command: </pre><pre> track: yes</pre><pre> auto-renew: yes</pre><pre>Request ID '20130519130741':</pre><pre> status: MONITORING</pre><pre> stuck: no</pre><pre> key pair storage: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin='297100916664'</pre><pre> certificate: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'</pre><pre> CA: dogtag-ipa-renew-agent</pre><pre> issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> subject: CN=CA Audit,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> expires: 2017-10-13 14:10:49 UTC</pre><pre> pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad</pre><pre> post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"</pre><pre> track: yes</pre><pre> auto-renew: yes</pre><pre>Request ID '20130519130742':</pre><pre> status: MONITORING</pre><pre> stuck: no</pre><pre> key pair storage: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin='297100916664'</pre><pre> certificate: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'</pre><pre> CA: dogtag-ipa-renew-agent</pre><pre> issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> subject: CN=OCSP Subsystem,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> expires: 2017-10-13 14:09:49 UTC</pre><pre> eku: id-kp-OCSPSigning</pre><pre> pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad</pre><pre> post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"</pre><pre> track: yes</pre><pre> auto-renew: yes</pre><pre>Request ID '20130519130743':</pre><pre> status: MONITORING</pre><pre> stuck: no</pre><pre> key pair storage: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin='297100916664'</pre><pre> certificate: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'</pre><pre> CA: dogtag-ipa-renew-agent</pre><pre> issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> subject: CN=CA Subsystem,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> expires: 2017-10-13 14:09:49 UTC</pre><pre> eku: id-kp-serverAuth,id-kp-clientAuth</pre><pre> pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad</pre><pre> post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"</pre><pre> track: yes</pre><pre> auto-renew: yes</pre><pre>Request ID '20130519130744':</pre><pre> status: MONITORING</pre><pre> stuck: no</pre><pre> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'</pre><pre> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB'</pre><pre> CA: dogtag-ipa-renew-agent</pre><pre> issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> subject: CN=RA Subsystem,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> expires: 2017-10-13 14:09:49 UTC</pre><pre> eku: id-kp-serverAuth,id-kp-clientAuth</pre><pre> pre-save command: </pre><pre> post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert</pre><pre> track: yes</pre><pre> auto-renew: yes</pre><pre>Request ID '20130519130745':</pre><pre> status: MONITORING</pre><pre> stuck: no</pre><pre> key pair storage: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin='297100916664'</pre><pre> certificate: type=NSSDB,location='/var/lib/pki-ca/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'</pre><pre> CA: dogtag-ipa-renew-agent</pre><pre> issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> subject: CN=<a href="http://caer.teloip.net">caer.teloip.net</a>,O=<a href="http://TELOIP.NET">TELOIP.NET</a></pre><pre> expires: 2017-10-13 14:09:49 UTC</pre><pre> eku: id-kp-serverAuth,id-kp-clientAuth</pre><pre> pre-save command: </pre><pre> post-save command: </pre><pre> track: yes</pre><pre> auto-renew: yes</pre></h1></div></ul></div></div></div></div></div> </div>