<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"></style> </head> <body dir="ltr"> <div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;"> <p>Thanks, Florence</p> <p><br> </p> <p>It works now.. my /etc/sssd/sssd.conf was missing with sudo service.. adding below line fixed the issue </p> <p class="p1"><span class="s1">services = nss, sudo, pam, ssh"</span></p> <p class="p1"><span class="s1"><br> </span></p> <p class="p1"><span class="s1">Many Thanks Again!</span></p> <p class="p1"><span class="s1"><br> </span></p> <p class="p1"><span class="s1">Best Regards,</span></p> <p class="p1"><span class="s1">Deepak</span></p> <p></p> <br> <br> <div style="color: rgb(0, 0, 0);"> <div> <hr tabindex="-1" style="display:inline-block; width:98%"> <div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> freeipa-users-bounces@redhat.com <freeipa-users-bounces@redhat.com> on behalf of Florence Blanc-Renaud <flo@redhat.com><br> <b>Sent:</b> Thursday, September 29, 2016 6:03 AM<br> <b>To:</b> beeth beeth<br> <b>Cc:</b> Freeipa-users<br> <b>Subject:</b> Re: [Freeipa-users] Install IPA Servers with third-party certificate(external CA)</font> <div> </div> </div> </div> <font size="2"><span style="font-size:10pt;"> <div class="PlainText">On 09/29/2016 11:43 AM, beeth beeth wrote:<br> > Thanks for the quick response Florence!<br> ><br> > My goal is the use a 3rd party certificate(such as Verisign cert) for<br> > Web UI(company security requirement), in fact we are not required to use<br> > 3rd party certificate for the LDAP server, but as I mentioned earlier, I<br> > couldn't make the new Verisign cert to work with the Web UI, without<br> > messing up the IPA function(after I updated the nss.conf to use the new<br> > cert in the /etc/httpd/alias db, the ipa_client_install failed). So I<br> > tried to follow the Redhat instruction, to see if I can get the Verisign<br> > cert installed at the most beginning, without using FreeIPA's<br> > own/default certificate), but I got the CSR question.<br> ><br> > I did install IPA without a CA, by following the instruction at<br> > <a href="https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" id="LPlnk4969" previewremoved="true"> https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP</a>, <div id="LPBorder_GT_14751437569580.3911295403294506" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;"> <table id="LPContainer_14751437569550.3371293988777795" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200); background-color: rgb(255, 255, 255);"> <tbody> <tr valign="top" style="border-spacing: 0px;"> <td id="TextCell_14751437569560.47456739304198536" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;"> <div id="LPRemovePreviewContainer_14751437569560.8561684140860235"></div> <div id="LPTitle_14751437569570.45734476323010287" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;"> <a id="LPUrlAnchor_14751437569570.1966098759300663" href="https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" target="_blank" style="text-decoration: none;">Using 3rd part certificates for HTTP/LDAP - FreeIPA</a></div> <div id="LPMetadata_14751437569570.4493883502968288" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;"> www.freeipa.org</div> <div id="LPDescription_14751437569570.7514498826629619" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;"> The following command will allow you to use a 3rd party certificate after initially deploying the FreeIPA system. You will need the following files:</div> </td> </tr> </tbody> </table> </div> <br> <br> > but failed to restart HTTPD. When and how can I provide the 3rd-party<br> > certificate? Could you please point me a document about the detail?<br> Hi,<br> <br> you need first to clarify if you want FreeIPA to act as a CA or not. The <br> setup will depend on this choice.<br> <br> - option a) FreeIPA with an embedded CA:<br> you can install FreeIPA with a self-signed CA, then follow the <br> instructions at <br> <a href="https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" id="LPlnk704491" previewremoved="true">https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP</a> <div id="LPBorder_GT_14751437570270.641963473779821" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;"> <table id="LPContainer_14751437570260.3474157376731071" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200); background-color: rgb(255, 255, 255);"> <tbody> <tr valign="top" style="border-spacing: 0px;"> <td id="TextCell_14751437570260.3252234310640987" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;"> <div id="LPRemovePreviewContainer_14751437570260.6922493926776112"></div> <div id="LPTitle_14751437570260.46469291321431605" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;"> <a id="LPUrlAnchor_14751437570270.17146484738411294" href="https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" target="_blank" style="text-decoration: none;">Using 3rd part certificates for HTTP/LDAP - FreeIPA</a></div> <div id="LPMetadata_14751437570270.4722950796903036" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;"> www.freeipa.org</div> <div id="LPDescription_14751437570270.18028392014747108" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;"> The following command will allow you to use a 3rd party certificate after initially deploying the FreeIPA system. You will need the following files:</div> </td> </tr> </tbody> </table> </div> <br> <br> in order to replace the WebUI certificate. Please note that there were <br> some bugs in ipa-server-certinstall, preventing httpd from starting <br> (Ticket #4786 [1]). The workaround is to manually update nss.conf (as <br> you did) and manually import the CA certificate into <br> /etc/pki/pki-tomcat/alias, for instance with<br> $ certutil -A -d /etc/pki/pki-tomcat/alias -i cacert.pem -n nickname -t C,,<br> <br> <br> - option b) Free IPA without CA<br> the installation instructions are in Installing without a CA [2]. You <br> will provide the certificate that will be used by both the LDAP server <br> and the WebUI in the command options.<br> <br> HTH,<br> Flo.<br> <br> [1] <a href="https://fedorahosted.org/freeipa/ticket/4786" id="LPlnk536746" previewremoved="true"> https://fedorahosted.org/freeipa/ticket/4786</a><br> [2] <br> <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-without-ca" id="LPlnk744416" previewremoved="true">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-without-ca</a><br> <br> > Thanks again!<br> ><br> ><br> > On Thu, Sep 29, 2016 at 5:25 AM, Florence Blanc-Renaud <flo@redhat.com<br> > <<a href="mailto:flo@redhat.com">mailto:flo@redhat.com</a>>> wrote:<br> ><br> > Hi,<br> ><br> > The instructions that you followed are used when you want to install<br> > FreeIPA with an embedded Certificate Authority (ie FreeIPA is able<br> > to issue certificates), and FreeIPA CA is signed by a 3rd party CA.<br> ><br> > Maybe your goal is just to use a 3rd party certificate for IPA's<br> > LDAP server and Web UI. In this case, you do not need to install<br> > FreeIPA with an embedded CA. You can follow the instructions for<br> > Installing without a CA [1], where you will need to provide a<br> > 3rd-part certificate.<br> ><br> > Hope this clarifies,<br> > Flo.<br> ><br> > [1]<br> > <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-without-ca"> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-without-ca</a><br> > <<a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-without-ca">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-without-ca</a>><br> ><br> ><br> ><br> > On 09/29/2016 11:03 AM, beeth beeth wrote:<br> ><br> > I am trying to set up IPA servers with Verisign certificate, so<br> > that the<br> > Admin Web console can use public signed certificate to meet<br> > company's<br> > security requirement. But when I try to follow Red Hat's<br> > instructions at<br> > <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-external-ca"> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-external-ca</a><br> > <<a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-external-ca">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/install-server.html#install-server-external-ca</a>>,<br> ><br> > 2.3.5. Installing a Server with an External CA as the Root CA,<br> > at the first step it says to generate CSR by adding the<br> > --external-ca<br> > option to the ipa-server-install utility, which does generate a<br> > CRS at<br> > /root/ipa.csr. However, the ipa-server-install command in fact<br> > doesn't<br> > ask for Distinguished Name (DN) or the organization info(like<br> > country,<br> > state, etc.), which are required in the CSR. Without a valid CSR<br> > file, I<br> > can't request for new Verisign certs. Did I miss something?<br> ><br> > Originally I once tried to change the default certificate for<br> > Apache(the<br> > Web Admin console) ONLY to the Verisign one, by adding the<br> > certificates<br> > to the /etc/httpd/alias database with the command:<br> > # ipa-server-certinstall -w --http_pin=test verisign.pk12<br> > And updated the nss.conf for httpd, so that the new Nickname is<br> > used to<br> > point to the Verisign certs. That worked well for the website.<br> > However,<br> > the IPA client installation failed after that for the<br> > "ipa-client-install":<br> ><br> > ERROR Joining realm failed: libcurl failed to execute the HTTP POST<br> > transaction, explaining: Peer's certificate issuer has been<br> > marked as<br> > not trusted by the user.<br> ><br> > Even I tried to also update the certificate for the Directory<br> > service(ipa-server-certinstall -d ... ), the client installation<br> > still<br> > failed. I believe the new Verisign cert messed up the<br> > communication of<br> > the IPA components. Then I am thinking to install the IPA server<br> > from<br> > scratch with the Verisign cert, but then I hit the CSR problem<br> > described<br> > above.<br> ><br> > Please advise. Thanks!<br> ><br> ><br> ><br> ><br> <br> -- <br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project<br> </div> </span></font></div> </div> </body> </html>