<div dir="ltr">Seems like it is but it does not show a server cert for dirsrv<div><br></div><div><div>[root@ns02 ~]# ls -lZ /etc/dirsrv/slapd-SOMETHING-BE/</div><div>total 468</div><div>-rw-------. 1 dirsrv root unconfined_u:object_r:dirsrv_config_t:s0 65536 Nov 29 11:29 cert8.db</div><div>-rw-rw----. 1 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 65536 Nov 29 11:29 cert8.db.orig</div><div>-r--r-----. 1 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 1623 Nov 29 11:29 certmap.conf</div><div>-rw-------. 1 dirsrv dirsrv system_u:object_r:dirsrv_config_t:s0 89977 Nov 29 11:29 dse.ldif</div><div>-rw-------. 2 dirsrv dirsrv system_u:object_r:dirsrv_config_t:s0 89977 Nov 29 11:29 dse.ldif.bak</div><div>-rw-------. 2 dirsrv dirsrv system_u:object_r:dirsrv_config_t:s0 89977 Nov 29 11:29 dse.ldif.startOK</div><div>-r--r-----. 1 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 36228 Nov 29 11:28 dse_original.ldif</div><div>-rw-------. 1 dirsrv root unconfined_u:object_r:dirsrv_config_t:s0 16384 Nov 29 11:29 key3.db</div><div>-rw-rw----. 1 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 16384 Nov 29 11:29 key3.db.orig</div><div>-r--------. 1 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 66 Nov 29 11:29 pin.txt</div><div>-rw-------. 1 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 40 Nov 29 11:29 pwdfile.txt</div><div>drwxrwx---. 2 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 4096 Nov 29 11:29 schema</div><div>-rw-------. 1 dirsrv root unconfined_u:object_r:dirsrv_config_t:s0 16384 Nov 29 11:29 secmod.db</div><div>-rw-rw----. 1 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 16384 Nov 29 11:29 secmod.db.orig</div><div>-r--r-----. 1 dirsrv dirsrv unconfined_u:object_r:dirsrv_config_t:s0 15142 Nov 29 11:28 slapd-collations.conf</div><div><br></div><div>[root@ns02 ~]# certutil -d /etc/dirsrv/slapd-SOMETHING-BE -L</div><div><br></div><div>Certificate Nickname Trust Attributes</div><div> SSL,S/MIME,JAR/XPI</div><div><br></div><div>CN=something-PAPRIKA-CA,DC=something,DC=local CT,C,C</div><div><a href="http://SOMETHING.BE">SOMETHING.BE</a> IPA CA CT,C,C</div><div>[root@ns02 ~]# certutil -d /etc/dirsrv/slapd-SOMETHING-BE -L</div><div><br></div><div>Certificate Nickname Trust Attributes</div><div> SSL,S/MIME,JAR/XPI</div><div><br></div><div>CN=something-PAPRIKA-CA,DC=something,DC=local CT,C,C</div><div><a href="http://SOMETHING.BE">SOMETHING.BE</a> IPA CA CT,C,C</div><div><br></div><div>[root@ns02 ~]# ausearch -m avc -i</div><div><no matches></div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-11-29 12:09 GMT+01:00 David Kupka <span dir="ltr"><<a href="mailto:dkupka@redhat.com" target="_blank">dkupka@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 29/11/16 11:51, David Dejaeghere wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
I have a setup where i want to add a replica. The first master setup has<br>
an externally signed cert for dirsrv and httpd. The replica is prepapred<br>
succesfully with ipa-client-install but the replica install then keeps<br>
failing. It seems that during install dirserv is not configured correctly<br>
with a valid server certificate. Output from the dirsrv error added to this<br>
email as well.<br>
<br>
[root@ns02 ~]# ipa-replica-install --setup-ca<br>
WARNING: conflicting time&date synchronization service 'chronyd' will<br>
be disabled in favor of ntpd<br>
<br>
Run connection check to master<br>
Connection check OK<br>
Configuring NTP daemon (ntpd)<br>
[1/4]: stopping ntpd<br>
[2/4]: writing configuration<br>
[3/4]: configuring ntpd to start on boot<br>
[4/4]: starting ntpd<br>
Done configuring NTP daemon (ntpd).<br>
Configuring directory server (dirsrv). Estimated time: 1 minute<br>
[1/43]: creating directory server user<br>
[2/43]: creating directory server instance<br>
[3/43]: restarting directory server<br>
[4/43]: adding default schema<br>
[5/43]: enabling memberof plugin<br>
[6/43]: enabling winsync plugin<br>
[7/43]: configuring replication version plugin<br>
[8/43]: enabling IPA enrollment plugin<br>
[9/43]: enabling ldapi<br>
[10/43]: configuring uniqueness plugin<br>
[11/43]: configuring uuid plugin<br>
[12/43]: configuring modrdn plugin<br>
[13/43]: configuring DNS plugin<br>
[14/43]: enabling entryUSN plugin<br>
[15/43]: configuring lockout plugin<br>
[16/43]: configuring topology plugin<br>
[17/43]: creating indices<br>
[18/43]: enabling referential integrity plugin<br>
[19/43]: configuring certmap.conf<br>
[20/43]: configure autobind for root<br>
[21/43]: configure new location for managed entries<br>
[22/43]: configure dirsrv ccache<br>
[23/43]: enabling SASL mapping fallback<br>
[24/43]: restarting directory server<br>
[25/43]: creating DS keytab<br>
[26/43]: retrieving DS Certificate<br>
[27/43]: restarting directory server<br>
ipa : CRITICAL Failed to restart the directory server (Command<br>
'/bin/systemctl restart dirsrv@SOMETHING-BE.service' returned non-zero exit<br>
status 1). See the installation log for details.<br>
[28/43]: setting up initial replication<br>
[error] error: [Errno 111] Connection refused<br>
Your system may be partly configured.<br>
Run /usr/sbin/ipa-server-install --uninstall to clean up.<br>
<br>
<br>
[29/Nov/2016:11:29:44.03428557<wbr>9 +0100] SSL alert: Security Initialization:<br>
Can't find certificate (Server-Cert) for family<br>
cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 -<br>
security library: bad database.)<br>
[29/Nov/2016:11:29:44.04503972<wbr>8 +0100] SSL alert: Security Initialization:<br>
Unable to retrieve private key for cert Server-Cert of family<br>
cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 -<br>
security library: bad database.)<br>
<br>
<br>
<br>
</blockquote>
<br></div></div>
Hello David,<br>
<br>
The error from the log indicates that either the NSSDB for dirsrv is not initialized or not accessible.<br>
<br>
Could you please send output of the following commands?<br>
<br>
# ls -lZ /etc/dirsrv/slapd-$REALM/<br>
# certutil -d /etc/dirsrv/slapd-$REALM/ -L<br>
# ausearch -m avc -i<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
-- <br>
David Kupka<br>
</font></span></blockquote></div><br></div>