<div dir="ltr">Florence, at first i thought the problem was fixed, but it wasn't complety.<div> </div><div>So now, i'm at the CA Master, and when i try to see some certificates it prompts me this "[root@ipa2 ~]# ipa cert-show 1</div><div>ipa: ERROR: Certificate operation cannot be completed: EXCEPTION (Invalid Credential.)</div><div>"</div><div>The same thing show over the Web Interface, i searched a little bit and found that probably it didn't updated the ipara user, but can't confirm that, any sugestions?</div><div> </div><div>Thanks, <div class="gmail_quote"><div dir="ltr">Em qui, 22 de dez de 2016 às 11:13, Florence Blanc-Renaud <<a href="mailto:flo@redhat.com">flo@redhat.com</a>> escreveu: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 12/22/2016 01:15 PM, Lucas Diedrich wrote: > Florence, for some creepy reason the cert from pkidbuser is different > from subsystem certs, and this pkidbuser is outdated now, but i can't > manage one way to re-issue it. I had to change the CA server because of > that, and the Selinux in the old CA Server was disabled, on the new one > is in Permissive mode but doesn't a warning in /var/log/audit/audit.log. > > This is the pkidbuser cert: <a href="https://paste.fedoraproject.org/511023/24084431/" rel="noreferrer" class="gmail_msg" target="_blank">https://paste.fedoraproject.org/511023/24084431/</a> > This is the subsystem cert: <a href="https://paste.fedoraproject.org/511025/14824085/" rel="noreferrer" class="gmail_msg" target="_blank">https://paste.fedoraproject.org/511025/14824085/</a> > The ca.subsystem.cert matches the pkidbuser cert. > > lucasdiedrich. > Hi, you can try to manually call the post-save command that certmonger should have issued after putting the certificate in /etc/pki/pki-tomcat/alias: on the renewal master: $ sudo /usr/libexec/ipa/certmonger/stop_pkicad $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" Then check the journal log that should display the following if everything goes well: $ sudo journalctl --since today | grep renew_ca_cert [...] renew_ca_cert[6478]: Updating entry uid=CA-ipaserver.domain.com-8443,ou=people,o=ipaca [...] renew_ca_cert[6478]: Updating entry uid=pkidbuser,ou=people,o=ipaca [...] renew_ca_cert[6478]: Starting pki_tomcatd [...] renew_ca_cert[6478]: Started pki_tomcatd If the operation does not succeed, you will have to check the LDAP server logs in /etc/dirsrv/slapd-DOMAIN/access. HTH, Flo. > Em qui, 22 de dez de 2016 às 06:54, Florence Blanc-Renaud > <<a href="mailto:flo@redhat.com" class="gmail_msg" target="_blank">flo@redhat.com</a> <mailto:<a href="mailto:flo@redhat.com" class="gmail_msg" target="_blank">flo@redhat.com</a>>> escreveu: > > On 12/21/2016 07:52 PM, Lucas Diedrich wrote: > > Hello guys, > > > > I'm having some trouble with, whats is happening with my server is > that > > i'm hiting an old BUG > > (<a href="https://bugzilla.redhat.com/show_bug.cgi?id=1033273" rel="noreferrer" class="gmail_msg" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1033273</a>). Talking to > mbasti > > over irc he oriented me to send this to the email list. > > > > The problem is, i got on CA Master, so because of this problem the CA > > Master certificates couldn't be renewd, so now i promoted another > master > > to be the CA. And the problem still persist. > > > > This is the certs from my new CA > > (<a href="https://paste.fedoraproject.org/510617/14823448/" rel="noreferrer" class="gmail_msg" target="_blank">https://paste.fedoraproject.org/510617/14823448/</a>), > > this is the certs from my old CA > > (<a href="https://paste.fedoraproject.org/510618/44871148/" rel="noreferrer" class="gmail_msg" target="_blank">https://paste.fedoraproject.org/510618/44871148/</a>) > > This is the log then i restart pki-tomcat( "CA port 636 Error > > netscape.ldap.LDAPException: Authentication failed (49)") > > This is the log from dirsrv when i restart pki-tomcat > > (<a href="https://paste.fedoraproject.org/510614/23446801/" rel="noreferrer" class="gmail_msg" target="_blank">https://paste.fedoraproject.org/510614/23446801/</a>) > > > > Basically my CA is not working anymore... > > > > Anyway, i tried lots of thing but couldn't fix this, anyone has > some idea? > > > > > > > Hi, > > Pki-tomcat is using the LDAP server as a data store, meaning that it > needs to authenticate to LDAP. In order to do that, pki-tomcat is using > the certificate 'subsystemCert cert-pki-ca' stored in > /etc/pki/pki-tomcat/alias. For the authentication to succeed, the > certificate must be stored in a user entry > (uid=pkidbuser,ou=people,o=ipaca). > > Can you check the content of this entry, especially the usercertificate > attribute? It should match the certificate used by pki-tomcat: > > $ certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert > cert-pki-ca' -a > -----BEGIN CERTIFICATE----- > [...] > -----END CERTIFICATE----- > > $ kinit admin > $ ldapsearch -Y GSSAPI -h `hostname` -p 389 -b > uid=pkidbuser,ou=people,o=ipaca "(objectclass=*)" usercertificate > dn: uid=pkidbuser,ou=people,o=ipaca > usercertificate:: <content should match the output above> > > The file /etc/pki/pki-tomcat/ca/CS.cfg should also contain this > certificate in the directive ca.subsystem.cert. > > > A possible cause for the entries not being updated is the bug 1366915 > [1] linked to SE linux on RHEL7, or bug 1365188 [2] linked to SE linux > on Fedora 24. > > Flo > > [1] <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1366915" rel="noreferrer" class="gmail_msg" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1366915</a> > [2] <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1365188" rel="noreferrer" class="gmail_msg" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1365188</a> > > > </blockquote></div></div></div>