<div dir="ltr"><div><div>I think my problem is deeper than that. I was following this guide:<a href="http://www.freeipa.org/page/Howto/CA_Certificate_Renewal#Renew_CA_Certificate_on_CA_Servers">http://www.freeipa.org/page/Howto/CA_Certificate_Renewal#Renew_CA_Certificate_on_CA_Servers</a> and executed the commands related to having an external CA - which we do not have. I now get this message for the CA: Request ID '20170101055025': status: NEED_KEY_GEN_PIN stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca' CA: dogtag-ipa-ca-renew-agent issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes </div>Is there any way I can recover? </div>Jeff <div class="gmail_extra"> <div class="gmail_quote">On Fri, Jan 6, 2017 at 3:43 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Jeff Goddard wrote: > I've done this. > [root@id-management-1 ipa]# date > Sun Jan 1 01:12:27 EST 2017 > > getcert list give me this as the first entry: > > Request ID '20150116162120': > status: CA_UNREACHABLE > ca-error: Server at > <a href="https://id-management-1.internal.emerlyn.com/ipa/xml" rel="noreferrer" target="_blank">https://id-management-1.internal.emerlyn.com/ipa/xml</a> failed request, > will retry: 4001 (RPC failed at server. ipa: Certificate Authority not > found). > stuck: no > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=<a href="http://INTERNAL.EMERLYN.COM" rel="noreferrer" target="_blank">INTERNAL.EMERLYN.COM</a> > <<a href="http://INTERNAL.EMERLYN.COM" rel="noreferrer" target="_blank">http://INTERNAL.EMERLYN.COM</a>> > subject: CN=<a href="http://id-management-1.internal.emerlyn.com" rel="noreferrer" target="_blank">id-management-1.internal.emerlyn.com</a> > <<a href="http://id-management-1.internal.emerlyn.com" rel="noreferrer" target="_blank">http://id-management-1.internal.emerlyn.com</a>>,O=<a href="http://INTERNAL.EMERLYN.COM" rel="noreferrer" target="_blank">INTERNAL.EMERLYN.COM</a> > <<a href="http://INTERNAL.EMERLYN.COM" rel="noreferrer" target="_blank">http://INTERNAL.EMERLYN.COM</a>> > expires: 2017-01-16 16:21:20 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/restart_httpd > track: yes > auto-renew: yes > > Restarting cermonger multiple times doesn't help. Sorry, I missed a step. When you go back in time you first need to restart IPA. The CA isn't up. rob > > Jeff > > > > > On Fri, Jan 6, 2017 at 3:23 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> > <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>> wrote: > > Jeff Goddard wrote: > > Flo, > > > > I'm not able to access the link you posted. I did find this thread > > though > > > <a href="https://www.redhat.com/archives/freeipa-users/2015-June/msg00144.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2015-June/msg00144.html</a> <<a href="https://www.redhat.com/archives/freeipa-users/2015-June/msg00144.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2015-June/msg00144.html</a>> > > > <<a href="https://www.redhat.com/archives/freeipa-users/2015-June/msg00144.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2015-June/msg00144.html</a> > <<a href="https://www.redhat.com/archives/freeipa-users/2015-June/msg00144.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2015-June/msg00144.html</a>>> > > and have set the time back and resubmitted a request. Still no > success. > > Any further hints? > > You need to stop ntpd, go back in time to when the certs are valid and > restart the certmonger service. > > Then use getcert list to monitor things. You really only care about the > CA subsystem certs are this point. > > You may need to restart certmonger more than once to get all the certs > updated (you can manually call getcert resubmit -i <id> if you'd > prefer). > > Once that is done return to present day, restart ntpd then ipactl > restart. > > rob > > > > > -- > </blockquote></div> -- <div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div> </div> </div></div> </div></div>