<html><head></head><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:24px"><div id="yui_3_16_0_ym19_1_1469042370452_62183">hi</div><div dir="ltr" id="yui_3_16_0_ym19_1_1469042370452_62182">I find below in debug file under /var/log/pki-ca</div><div id="yui_3_16_0_ym19_1_1469042370452_62222" dir="ltr">what is your comment? </div><div id="yui_3_16_0_ym19_1_1469042370452_62181"> </div><div id="yui_3_16_0_ym19_1_1469042370452_62179" dir="ltr">21/Jul/2016:23:13:42][TP-Processor3]: according to ccMode, authorization for servlet: caDisplayBySerial is LD AP based, not XML {1}, use default authz mgr: {2}. [21/Jul/2016:23:15:44][Timer-0]: CMSEngine: getPasswordStore(): password store initialized before. [21/Jul/2016:23:15:44][Timer-0]: CMSEngine: getPasswordStore(): password store initialized. [21/Jul/2016:23:15:44][Timer-0]: CMSEngine: getPasswordStore(): password store initialized before. [21/Jul/2016:23:15:44][Timer-0]: CMSEngine: getPasswordStore(): password store initialized. [21/Jul/2016:23:20:44][Timer-0]: CMSEngine: getPasswordStore(): password store initialized before. [21/Jul/2016:23:20:44][Timer-0]: CMSEngine: getPasswordStore(): password store initialized. [21/Jul/2016:23:20:44][Timer-0]: CMSEngine: getPasswordStore(): password store initialized before. [21/Jul/2016:23:20:44][Timer-0]: CMSEngine: getPasswordStore(): password store initialized. [21/Jul/2016:23:20:45][CertStatusUpdateThread]: About to start updateCertStatus [21/Jul/2016:23:20:45][CertStatusUpdateThread]: Starting updateCertStatus (entered lock) </div><div></div><div class="qtdSeparateBR"> </div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: verdana, helvetica, sans-serif; font-size: 24px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <hr size="1"> From: Rob Crittenden <rcritten@redhat.com> To: mohammad sereshki <mohammadsereshki@yahoo.com>; Florence Blanc-Renaud <flo@redhat.com>; Freeipa-users <freeipa-users@redhat.com> Sent: Thursday, July 21, 2016 11:21 PM Subject: Re: [Freeipa-users] regenerate certificate </div> <div class="y_msg_container"> mohammad sereshki wrote: > hi > would you please explain more > ? Your CA (dogtag) is not running. The CA is written in java and deployed as a WAR in tomcat. If something goes wrong during initialization the CA will exit but tomcat will not. Requests to the CA are returning 404 Not Found because the application is not running in dogtag. You need to look at the logs in /var/log/pki-ca to see what is going on. I'd start with selftests.log then move onto catalina.out and debug. rob > > > ------------------------------------------------------------------------ > *From:* Rob Crittenden <<a shape="rect" ymailto="mailto:rcritten@redhat.com" href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>> > *To:* mohammad sereshki <<a shape="rect" ymailto="mailto:mohammadsereshki@yahoo.com" href="mailto:mohammadsereshki@yahoo.com">mohammadsereshki@yahoo.com</a>>; Florence > Blanc-Renaud <<a shape="rect" ymailto="mailto:flo@redhat.com" href="mailto:flo@redhat.com">flo@redhat.com</a>>; Freeipa-users <<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>> > *Sent:* Thursday, July 21, 2016 11:09 PM > *Subject:* Re: [Freeipa-users] regenerate certificate > > mohammad sereshki wrote: > > hi > > it is result of command, seems issue is another thing > > > > > > ipa cert-show 1 > > ipa: ERROR: Certificate operation cannot be completed: Unable to > > communicate with CMS (Not Found) > > Which means that the CA still isn't up. You're going to need to look at > the dogtag logs in /var/log/pki*. debug is probably the place to start. > > rob > > > > > > > > > ------------------------------------------------------------------------ > > *From:* Rob Crittenden <<a shape="rect" ymailto="mailto:rcritten@redhat.com" href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> <mailto:<a shape="rect" ymailto="mailto:rcritten@redhat.com" href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>> > > *To:* mohammad sereshki <<a shape="rect" ymailto="mailto:mohammadsereshki@yahoo.com" href="mailto:mohammadsereshki@yahoo.com">mohammadsereshki@yahoo.com</a> > <mailto:<a shape="rect" ymailto="mailto:mohammadsereshki@yahoo.com" href="mailto:mohammadsereshki@yahoo.com">mohammadsereshki@yahoo.com</a>>>; Florence > > Blanc-Renaud <<a shape="rect" ymailto="mailto:flo@redhat.com" href="mailto:flo@redhat.com">flo@redhat.com</a> <mailto:<a shape="rect" ymailto="mailto:flo@redhat.com" href="mailto:flo@redhat.com">flo@redhat.com</a>>>; Freeipa-users > <<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> <mailto:<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>>> > > *Sent:* Thursday, July 21, 2016 8:08 PM > > *Subject:* Re: [Freeipa-users] regenerate certificate > > > > mohammad sereshki wrote: > > > dear > > > thanks, but would you please check below and let me know what is your > > > idea?I checked your command but it did not work. > > > > The Not Found suggests that the CA is not up. I'd try restarting the > > pki-cad process to see if that helps. > > > > A simple test that communication is working is: ipa cert-show 1 > > > > The output isn't important as long as it isn't an error. > > > > rob > > > > > > > > > > > > > > > > Number of certificates and requests being tracked: 8. > > > Request ID '20140817123525': > > > status: MONITORING > > > ca-error: Unable to determine principal name for signing > > request. > > > stuck: no > > > key paCOM storage: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > > > certificate: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > > Certificate DB' > > > CA: IPA > > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > > subject: CN=IPA RA,O=EXAMPLE.COM > > > expCOMes: 2018-06-30 07:56:06 UTC > > > eku: id-kp-serverAuth,id-kp-clientAuth > > > pre-save command: > > > post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert > > > track: yes > > > auto-renew: yes > > > Request ID '20140817123534': > > > status: CA_UNREACHABLE > > > ca-error: Server failed request, will retry: 4301 (RPC failed > > > at server. Certificate operation cannot be completed: Unable to > > > communicate with CMS (Not Found)). > > > stuck: yes > > > key paCOM storage: > > > > > > type=NSSDB,location='/etc/dCOMsrv/slapd-EXAMPLE.-COM',nickname='Server-Cert',token='NSS > > > Certificate DB',pinfile='/etc/dCOMsrv/slapd-EXAMPLE.-COM/pwdfile.txt' > > > certificate: > > > > > > type=NSSDB,location='/etc/dCOMsrv/slapd-EXAMPLE.-COM',nickname='Server-Cert',token='NSS > > > Certificate DB' > > > CA: IPA > > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > > subject: CN=ipatestsrv.EXAMPLE.COM,O=EXAMPLE.COM > > > expCOMes: 2016-08-17 12:35:34 UTC > > > eku: id-kp-serverAuth,id-kp-clientAuth > > > pre-save command: > > > post-save command: /usr/lib64/ipa/certmonger/restart_dCOMsrv > > > EXAMPLE.-COM > > > track: yes > > > auto-renew: yes > > > Request ID '20140817123602': > > > status: CA_UNREACHABLE > > > ca-error: Server failed request, will retry: 4301 (RPC failed > > > at server. Certificate operation cannot be completed: Unable to > > > communicate with CMS (Not Found)). > > > stuck: yes > > > key paCOM storage: > > > > > > type=NSSDB,location='/etc/dCOMsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS > > > Certificate DB',pinfile='/etc/dCOMsrv/slapd-PKI-IPA/pwdfile.txt' > > > certificate: > > > > > > type=NSSDB,location='/etc/dCOMsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS > > > Certificate DB' > > > CA: IPA > > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > > subject: CN=ipatestsrv.EXAMPLE.COM,O=EXAMPLE.COM > > > expCOMes: 2016-08-17 12:36:02 UTC > > > eku: id-kp-serverAuth,id-kp-clientAuth > > > pre-save command: > > > post-save command: /usr/lib64/ipa/certmonger/restart_dCOMsrv > > > PKI-IPA > > > track: yes > > > auto-renew: yes > > > Request ID '20140817123752': > > > status: CA_UNREACHABLE > > > ca-error: Server failed request, will retry: 4301 (RPC failed > > > at server. Certificate operation cannot be completed: Unable to > > > communicate with CMS (Not Found)). > > > stuck: yes > > > key paCOM storage: > > > > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > > > certificate: > > > > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > > > Certificate DB' > > > CA: IPA > > > issuer: CN=Certificate Authority,O=EXAMPLE.COM > > > subject: CN=ipatestsrv.EXAMPLE.COM,O=EXAMPLE.COM > > > expCOMes: 2016-08-17 12:37:51 UTC > > > eku: id-kp-serverAuth,id-kp-clientAuth > > > pre-save command: > > > post-save command: /usr/lib64/ipa/certmonger/restart_httpd > > > track: yes > > > auto-renew: yes > > > You have new mail in /var/spool/mail/root > > > > > > > > > > ------------------------------------------------------------------------ > > > *From:* Florence Blanc-Renaud <<a shape="rect" ymailto="mailto:flo@redhat.com" href="mailto:flo@redhat.com">flo@redhat.com</a> > <mailto:<a shape="rect" ymailto="mailto:flo@redhat.com" href="mailto:flo@redhat.com">flo@redhat.com</a>> <mailto:<a shape="rect" ymailto="mailto:flo@redhat.com" href="mailto:flo@redhat.com">flo@redhat.com</a> <mailto:<a shape="rect" ymailto="mailto:flo@redhat.com" href="mailto:flo@redhat.com">flo@redhat.com</a>>>> > > > *To:* mohammad sereshki <<a shape="rect" ymailto="mailto:mohammadsereshki@yahoo.com" href="mailto:mohammadsereshki@yahoo.com">mohammadsereshki@yahoo.com</a> > <mailto:<a shape="rect" ymailto="mailto:mohammadsereshki@yahoo.com" href="mailto:mohammadsereshki@yahoo.com">mohammadsereshki@yahoo.com</a>> > > <mailto:<a shape="rect" ymailto="mailto:mohammadsereshki@yahoo.com" href="mailto:mohammadsereshki@yahoo.com">mohammadsereshki@yahoo.com</a> > <mailto:<a shape="rect" ymailto="mailto:mohammadsereshki@yahoo.com" href="mailto:mohammadsereshki@yahoo.com">mohammadsereshki@yahoo.com</a>>>>; Freeipa-users > > > <<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> <mailto:<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><div class="yqt5676748100" id="yqtfd25211"> > <mailto:<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> <mailto:<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>>>> > > > > *Sent:* Thursday, July 21, 2016 11:30 AM > > > *Subject:* Re: [Freeipa-users] regenerate certificate > > > > > > On 07/20/2016 10:04 PM, mohammad sereshki wrote: > > > > hi > > > > I check my IPA server which is version ipa-server-3.0.0-25 , > command > > > > "ipa-get-cert list" show, my certificate will be expired in next > > 20 days, > > > > I do not know how to regenerate them > > > > but command "getcert list" shows epirtion certificates are related > > just > > > > to "CA:IPA" and certificate " CA: dogtag-ipa-renew-agent" , has > > enough > > > > time . > > > > would you please help me to know how to regenerate CA:IPA > > certificates? > > > > > > > > Best Regards > > > > > > > > > > > > > > > > > > Hi Mohammad, > > > > > > the certificates issued by IPA CA are normally tracked by > certmonger and > > > automatically renewed when they are near their expiration date. To > make > > > sure that your certificates are tracked, you can issue > > > > > > $ ipa-getcert list > > > > > > and check the "status:" field for each certificate. It should display > > > "MONITORING". > > > > > > If you want to manually renew them, you must note their request ID and > > > use the command > > > $ ipa-getcert resubmit -i $REQUEST_ID > > > > > > Hope this helps, > > > Flo. > > > > > > > > > > > > > > > > > > > > > > > > </div> </div> </div> </div> </div></div></body></html>