<div dir="ltr">I have done more searching in my logs and I see the following errors.<div> </div><div>This is in the localhost log file /var/lib/pki/pki-tomcat/logs</div><div> </div><div><div>May 15, 2017 3:08:08 PM org.apache.catalina.core.ApplicationContext log</div><div>SEVERE: StandardWrapper.Throwable</div><div>java.lang.NullPointerException</div><div> </div><div>May 15, 2017 3:08:08 PM org.apache.catalina.core.StandardContext loadOnStartup</div><div>SEVERE: Servlet [castart] in web application [/ca] threw load() exception</div><div>java.lang.NullPointerException</div><div> </div><div>May 15, 2017 3:08:09 PM org.apache.catalina.core.StandardHostValve invoke</div><div>SEVERE: Exception Processing /ca/admin/ca/getStatus</div><div><a href="http://javax.ws.rs">javax.ws.rs</a>.ServiceUnavailableException: Subsystem unavailable</div></div><div> </div><div> </div><div>Looking at the debug log it says Authentication failed for port 636.</div><div> </div><div><div>[15/May/2017:17:39:25][localhost-startStop-1]: LdapAuthInfo: init()</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: LdapAuthInfo: init begins</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: LdapAuthInfo: init ends</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: init: before makeConnection errorIfDown is true</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: makeConnection: errorIfDown true</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: SSLClientCertificateSelectionCB: Setting desired cert nickname to: subsystemCert cert-pki-ca</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: LdapJssSSLSocket: set client auth cert nickname subsystemCert cert-pki-ca</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: SSLClientCertificatSelectionCB: Entering!</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: SSLClientCertificateSelectionCB: returning: null</div><div>[15/May/2017:17:39:25][localhost-startStop-1]: SSL handshake happened</div><div>Could not connect to LDAP server host <a href="http://ipa12.mgmt.crosschx.com">ipa12.mgmt.crosschx.com</a> port 636 Error netscape.ldap.LDAPException: Authentication failed (48)</div><div> at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:205)</div></div><div> </div><div> </div><div>I looked at the validity of the cert it mentions and it is fine.</div><div> </div><div><div>(root)>getcert status -v -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca'</div><div>State MONITORING, stuck: no.</div></div><div> </div><div> </div><div>I then looked at the ldap errors around the time of this failure and I am seeing this log entry.</div><div> </div><div> </div><div><div>[15/May/2017:17:38:42.063080758 +0000] set_krb5_creds - Could not get initial credentials for principal [ldap/<a href="mailto:ipa12.mgmt.crosschx.com@MGMT.CROSSCHX.COM">ipa12.mgmt.crosschx.com@MGMT.CROSSCHX.COM</a>] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm)</div></div><div> </div><div>When I perform a klist against that keytab nothing appears out of the ordinary compared to working IPA servers.</div><div> </div><div>I am not sure what to look at next.</div><div> </div></div><div class="gmail_extra"> <div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"> </div><div dir="ltr"><div dir="ltr" style="font-size:12.8px"> </div><div dir="ltr">Mike Plemmons | Senior DevOps Engineer | CROSSCHX <div>614.427.2411</div><div><a href="mailto:mike.plemmons@crosschx.com" style="font-size:12.8px" target="_blank">mike.plemmons@crosschx.com</a> </div><div style="font-size:12.8px"><a href="http://www.crosschx.com/" target="_blank">www.crosschx.com</a></div></div></div></div></div></div></div></div></div></div></div></div></div> <div class="gmail_quote">On Wed, May 10, 2017 at 3:35 PM, Michael Plemmons <<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">The PKI service came up successfully but only when it uses BasicAuth rather than SSL auth. I am not sure about what I need to do in order to get the auth working over SSL again.<div> </div><div>None of the certs are expired when I run getcert list and ipa-getcert list.</div><div> </div><div>Since the failure is with attempts to login to LDAP over 636. I have been attempting to auth to LDAP via port 636 and the ldapsearch is not completing. When looking at packet captures, I see some the TCP handshake and what appears to be the start of a SSL process and then everything hangs.</div><div> </div><div>What is the proper method to test performing a ldapsearch over 636? Also, the CS.cfg shows it wants to auth as cn=Directory Manager. I can successfully auth with cn=Directory Manager over 389 but I think I am not performing ldapsearch over 636 correctly.</div><div class="gmail_extra"> <div><div class="m_-765289375935881056m_8399766940143028104gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"> </div><div dir="ltr"><div dir="ltr" style="font-size:12.8px"> </div><div dir="ltr">Mike Plemmons | Senior DevOps Engineer | CROSSCHX <div>614.427.2411</div><div><a href="mailto:mike.plemmons@crosschx.com" style="font-size:12.8px" target="_blank">mike.plemmons@crosschx.com</a> </div><div style="font-size:12.8px"><a href="http://www.crosschx.com/" target="_blank">www.crosschx.com</a></div></div></div></div></div></div></div></div></div></div></div></div></div> <div class="gmail_quote">On Fri, May 5, 2017 at 3:33 PM, Michael Plemmons <<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I think I found the email thread. Asking for help with crashed freeIPA istance. That email pointed to this link, <a href="https://www.redhat.com/archives/freeipa-users/2017-January/msg00215.html" target="_blank">https://www.redhat.com/archives/freeipa-users/2017-January/msg00215.html</a>. That link talked about changing the CS.cfg file to use port 389 for PKI to auth to LDAP. I made the necessary changes and PKI came up successfully.</div><div class="gmail_extra"> <div><div class="m_-765289375935881056m_8399766940143028104m_582664644711419783gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"> </div><div dir="ltr"><div dir="ltr" style="font-size:12.8px"> </div><div dir="ltr">Mike Plemmons | Senior DevOps Engineer | CROSSCHX <div>614.427.2411</div><div><a href="mailto:mike.plemmons@crosschx.com" style="font-size:12.8px" target="_blank">mike.plemmons@crosschx.com</a> </div><div style="font-size:12.8px"><a href="http://www.crosschx.com/" target="_blank">www.crosschx.com</a></div></div></div></div></div></div></div></div></div></div></div></div></div> <div class="gmail_quote">On Fri, May 5, 2017 at 3:19 PM, Michael Plemmons <<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"> <div class="gmail_extra"> <div><div class="m_-765289375935881056m_8399766940143028104m_582664644711419783m_4438589908806384366gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"> </div><div dir="ltr"><div dir="ltr" style="font-size:12.8px"> </div><div dir="ltr">Mike Plemmons | Senior DevOps Engineer | CROSSCHX <div>614.427.2411</div><div><a href="mailto:mike.plemmons@crosschx.com" style="font-size:12.8px" target="_blank">mike.plemmons@crosschx.com</a> </div><div style="font-size:12.8px"><a href="http://www.crosschx.com/" target="_blank">www.crosschx.com</a></div></div></div></div></div></div></div></div></div></div></div></div></div> <div class="gmail_quote">On Fri, May 5, 2017 at 3:15 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Michael Plemmons wrote: > I just realized that I sent the reply directly to Rob and not to the > list. My response is inline Ok, this is actually good news. I made a similar proposal in another case and I was completely wrong. Flo had the user do something and it totally fixed their auth error, I just can't remember what it was or find the e-mail thread. I'm pretty sure it was this calendar year though. rob </blockquote><div> </div><div>Do you or Flo know what I could search for in the past emails to find the answer to the problem?</div><div> </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> > > > > *Mike Plemmons | Senior DevOps Engineer | CROSSCHX > * > 614.427.2411 > <a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a> <mailto:<a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a>> > <a href="http://www.crosschx.com" rel="noreferrer" target="_blank">www.crosschx.com</a> <<a href="http://www.crosschx.com/" rel="noreferrer" target="_blank">http://www.crosschx.com/</a>> > > On Thu, May 4, 2017 at 9:39 AM, Michael Plemmons > <<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a> <mailto:<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a>>> > wrote: > > > > > > *Mike Plemmons | Senior DevOps Engineer | CROSSCHX > * > 614.427.2411 > <a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a> <mailto:<a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a>> > <a href="http://www.crosschx.com" rel="noreferrer" target="_blank">www.crosschx.com</a> <<a href="http://www.crosschx.com/" rel="noreferrer" target="_blank">http://www.crosschx.com/</a>> > > On Thu, May 4, 2017 at 9:24 AM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a> > <mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>> wrote: > > Michael Plemmons wrote: > > I realized that I was not very clear in my statement about > testing with > > ldapsearch. I had initially run it without logging in with a > DN. I was > > just running the local ldapsearch -x command. I then tested on > > ipa12.mgmt and ipa11.mgmt logging in with a full DN for the > admin and > > "cn=Directory Manager" from ipa12.mgmt (broken server) and > ipa11.mgmt > > and both ldapsearch command succeeded. > > > > I ran the following from ipa12.mgmt and ipa11.mgmt as a non > root user. > > I also ran the command showing a line count for the output and > the line > > counts for each were the same when run from ipa12.mgmt and > ipa11.mgmt. > > > > ldapsearch -LLL -h <a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>> > > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>>> -D "DN" -w PASSWORD -b > > "cn=users,cn=accounts,dc=mgmt,dc=crosschx,dc=com" dn > > > > ldapsearch -LLL -h <a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>> > > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>>> -D "cn=directory manager" -w > PASSWORD dn > > The CA has its own suffix and replication agreements. Given the auth > error and recent (5 months) renewal of CA credentials I'd check > that the > CA agent authentication entries are correct. > > Against each master with a CA run: > > $ ldapsearch -LLL -x -D 'cn=directory manager' -W -b > uid=ipara,ou=people,o=ipaca description > > The format is 2;serial#,subject,issuer > > Then on each run: > > # certutil -L -d /etc/httpd/alias -n ipaCert |grep Serial > > The serial # should match that in the description everywhere. > > rob > > > > On the CA (IPA13.MGMT) I ran the ldapsearch command and see that the > serial number is 7. I then ran the certutil command on all three > servers and the serial number is 7 as well. > > > I also ran the ldapsearch command against the other two servers and > they also showed a serial number of 7. > > > > > > > > > > > > > > > > *Mike Plemmons | Senior DevOps Engineer | CROSSCHX > > * > > 614.427.2411 > > <a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a> <mailto:<a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a>> > <mailto:<a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a> > <mailto:<a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a>>> > > <a href="http://www.crosschx.com" rel="noreferrer" target="_blank">www.crosschx.com</a> <<a href="http://www.crosschx.com" rel="noreferrer" target="_blank">http://www.crosschx.com</a>> > <<a href="http://www.crosschx.com/" rel="noreferrer" target="_blank">http://www.crosschx.com/</a>> > > > > On Wed, May 3, 2017 at 5:28 PM, Michael Plemmons > > <<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a> > <mailto:<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a>> > <mailto:<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a> > <mailto:<a href="mailto:michael.plemmons@crosschx.com" target="_blank">michael.plemmons@crosschx.com</a>>>> > > wrote: > > > > I have a three node IPA cluster. > > > > ipa11.mgmt - was a master over 6 months ago > > ipa13.mgmt - current master > > ipa12.mgmt > > > > ipa13 has agreements with ipa11 and ipa12. ipa11 and > ipa12 do not > > have agreements between each other. > > > > It appears that either ipa12.mgmt lost some level of its > replication > > agreement with ipa13. I saw some level because users / > hosts were > > replicated between all systems but we started seeing DNS > was not > > resolving properly from ipa12. I do not know when this > started. > > > > When looking at replication agreements on ipa12 I did not > see any > > agreement with ipa13. > > > > When I run ipa-replica-manage list all three hosts show > has master. > > > > When I run ipa-replica-manage ipa11.mgmt I see ipa13.mgmt > is a replica. > > > > When I run ipa-replica-manage ipa12.mgmt nothing returned. > > > > I ran ipa-replica-manage connect --cacert=/etc/ipa/ca.crt > > <a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa12.mgmt.crosschx.com</a> <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a> <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>>> > > <a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa13.mgmt.crosschx.com</a> <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>> > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a> > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>>> on ipa12.mgmt > > > > I then ran the following > > > > ipa-replica-manage force-sync --from > <a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa13.mgmt.crosschx.com</a> <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>> > > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a> > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>>> > > > > ipa-replica-manage re-initialize --from > <a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa13.mgmt.crosschx.com</a> <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>> > > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a> > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>>> > > > > I was still seeing bad DNS returns when dig'ing against > ipa12.mgmt. > > I was able to create user and DNS records and see the > information > > replicated properly across all three nodes. > > > > I then ran ipactl stop on ipa12.mgmt and then ipactl start on > > ipa12.mgmt because I wanted to make sure everything was > running > > fresh after the changes above. While IPA was staring up (DNS > > started) we were able to see valid DNS queries returned but > > pki-tomcat would not start. > > > > I am not sure what I need to do in order to get this > working. I > > have included the output of certutil and getcert below > from all > > three servers as well as the debug output for pki. > > > > > > While the IPA system is coming up I am able to > successfully run > > ldapsearch -x as the root user and see results. I am also > able to > > login with the "cn=Directory Manager" account and see results. > > > > > > The debug log shows the following error. > > > > > > [03/May/2017:21:22:01][localhost-startStop-1]: > > ============================================ > > [03/May/2017:21:22:01][localhost-startStop-1]: ===== DEBUG > > SUBSYSTEM INITIALIZED ======= > > [03/May/2017:21:22:01][localhost-startStop-1]: > > ============================================ > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > restart at > > autoShutdown? false > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > autoShutdown crumb file path? > > /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > about to > > look for cert for auto-shutdown support:auditSigningCert > cert-pki-ca > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > found > > cert:auditSigningCert cert-pki-ca > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > done init > > id=debug > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > initialized debug > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > initSubsystem id=log > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > ready to > > init id=log > > [03/May/2017:21:22:01][localhost-startStop-1]: Creating > > > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) > > [03/May/2017:21:22:01][localhost-startStop-1]: Creating > > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) > > [03/May/2017:21:22:01][localhost-startStop-1]: Creating > > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > restart at > > autoShutdown? false > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > autoShutdown crumb file path? > > /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > about to > > look for cert for auto-shutdown support:auditSigningCert > cert-pki-ca > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > found > > cert:auditSigningCert cert-pki-ca > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > done init > > id=log > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > initialized log > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > initSubsystem id=jss > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > ready to > > init id=jss > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > restart at > > autoShutdown? false > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > autoShutdown crumb file path? > > /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > about to > > look for cert for auto-shutdown support:auditSigningCert > cert-pki-ca > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > found > > cert:auditSigningCert cert-pki-ca > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > done init > > id=jss > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > initialized jss > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > > initSubsystem id=dbs > > [03/May/2017:21:22:01][localhost-startStop-1]: CMSEngine: > ready to > > init id=dbs > > [03/May/2017:21:22:01][localhost-startStop-1]: > DBSubsystem: init() > > mEnableSerialMgmt=true > > [03/May/2017:21:22:01][localhost-startStop-1]: Creating > > LdapBoundConnFactor(DBSubsystem) > > [03/May/2017:21:22:01][localhost-startStop-1]: > LdapBoundConnFactory: > > init > > [03/May/2017:21:22:01][localhost-startStop-1]: > > LdapBoundConnFactory:doCloning true > > [03/May/2017:21:22:01][localhost-startStop-1]: > LdapAuthInfo: init() > > [03/May/2017:21:22:01][localhost-startStop-1]: > LdapAuthInfo: init begins > > [03/May/2017:21:22:01][localhost-startStop-1]: > LdapAuthInfo: init ends > > [03/May/2017:21:22:01][localhost-startStop-1]: init: before > > makeConnection errorIfDown is true > > [03/May/2017:21:22:01][localhost-startStop-1]: makeConnection: > > errorIfDown true > > [03/May/2017:21:22:02][localhost-startStop-1]: > > SSLClientCertificateSelectionCB: Setting desired cert > nickname to: > > subsystemCert cert-pki-ca > > [03/May/2017:21:22:02][localhost-startStop-1]: > LdapJssSSLSocket: set > > client auth cert nickname subsystemCert cert-pki-ca > > [03/May/2017:21:22:02][localhost-startStop-1]: > > SSLClientCertificatSelectionCB: Entering! > > [03/May/2017:21:22:02][localhost-startStop-1]: > > SSLClientCertificateSelectionCB: returning: null > > [03/May/2017:21:22:02][localhost-startStop-1]: SSL > handshake happened > > Could not connect to LDAP server host > <a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa12.mgmt.crosschx.com</a> <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>> > > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>>> port 636 Error > > netscape.ldap.LDAPException: Authentication failed (48) > > at > > > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:205) > > at > > > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:166) > > at > > > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:130) > > at > com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) > > at > > > com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1169) > > at > > > com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1075) > > at > com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:571) > > at com.netscape.certsrv.apps.CMS.init(CMS.java:187) > > at com.netscape.certsrv.apps.CMS.start(CMS.java:1616) > > at > > > com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) > > at > javax.servlet.GenericServlet.init(GenericServlet.java:158) > > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native > Method) > > at > > > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) > > at > > > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > > at java.lang.reflect.Method.invoke(Method.java:498) > > at > > > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) > > at > > > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) > > at java.security.AccessController.doPrivileged(Native > Method) > > at <a href="http://javax.security.auth.Subject.do" rel="noreferrer" target="_blank">javax.security.auth.Subject.do</a> > <<a href="http://javax.security.auth.Subject.do" rel="noreferrer" target="_blank">http://javax.security.auth.Subject.do</a>>AsPrivileged(Subject.java:549) > > at > > > org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) > > at > > > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) > > at > > > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124) > > at > > > org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1270) > > at > > > org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1195) > > at > > > org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) > > at > > > org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5318) > > at > > > org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5610) > > at > > > org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) > > at > > > org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899) > > at > > > org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) > > at > > > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156) > > at > > > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145) > > at java.security.AccessController.doPrivileged(Native > Method) > > at > > > org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) > > at > > > org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) > > at > > > org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679) > > at > > > org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966) > > at > > > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > > at java.util.concurrent.FutureTask.run(FutureTask.java:266) > > at > > > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > > at > > > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > > at java.lang.Thread.run(Thread.java:745) > > Internal Database Error encountered: Could not connect to LDAP > > server host <a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>> <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>>> > > port 636 Error netscape.ldap.LDAPException: Authentication > failed (48) > > at > com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) > > at > > > com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1169) > > at > > > com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1075) > > at > com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:571) > > at com.netscape.certsrv.apps.CMS.init(CMS.java:187) > > at com.netscape.certsrv.apps.CMS.start(CMS.java:1616) > > at > > > com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) > > at > javax.servlet.GenericServlet.init(GenericServlet.java:158) > > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native > Method) > > at > > > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) > > at > > > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > > at java.lang.reflect.Method.invoke(Method.java:498) > > at > > > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) > > at > > > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) > > at java.security.AccessController.doPrivileged(Native > Method) > > at <a href="http://javax.security.auth.Subject.do" rel="noreferrer" target="_blank">javax.security.auth.Subject.do</a> > <<a href="http://javax.security.auth.Subject.do" rel="noreferrer" target="_blank">http://javax.security.auth.Subject.do</a>>AsPrivileged(Subject.java:549) > > at > > > org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) > > at > > > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175) > > at > > > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:124) > > at > > > org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1270) > > at > > > org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1195) > > at > > > org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) > > at > > > org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5318) > > at > > > org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5610) > > at > > > org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) > > at > > > org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:899) > > at > > > org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) > > at > > > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156) > > at > > > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145) > > at java.security.AccessController.doPrivileged(Native > Method) > > at > > > org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) > > at > > > org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) > > at > > > org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679) > > at > > > org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1966) > > at > > > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > > at java.util.concurrent.FutureTask.run(FutureTask.java:266) > > at > > > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > > at > > > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > > at java.lang.Thread.run(Thread.java:745) > > [03/May/2017:21:22:02][localhost-startStop-1]: > CMSEngine.shutdown() > > > > > > ============================= > > > > > > IPA11.MGMT > > > > (root)>certutil -L -d /etc/dirsrv/slapd-MGMT-CROSSCHX-COM/ > > Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI > Server-Cert > > u,u,u <a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> IPA CA CT,C,C > > (root)>certutil -L -d /var/lib/pki/pki-tomcat/alias/ > Certificate > > Nickname Trust Attributes SSL,S/MIME,JAR/XPI caSigningCert > > cert-pki-ca CTu,Cu,Cu auditSigningCert cert-pki-ca u,u,Pu > > ocspSigningCert cert-pki-ca u,u,u subsystemCert > cert-pki-ca u,u,u > > Server-Cert cert-pki-ca u,u,u IPA13.MGMT (root)>certutil -L -d > > /etc/dirsrv/slapd-MGMT-CROSSCHX-COM/ Certificate Nickname > Trust > > Attributes SSL,S/MIME,JAR/XPI Server-Cert u,u,u > <a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> IPA CA CT,C,C (root)>certutil -L -d > > /var/lib/pki/pki-tomcat/alias/ Certificate Nickname Trust > Attributes > > SSL,S/MIME,JAR/XPI caSigningCert cert-pki-ca CTu,Cu,Cu > > auditSigningCert cert-pki-ca u,u,Pu ocspSigningCert > cert-pki-ca > > u,u,u subsystemCert cert-pki-ca u,u,u Server-Cert > cert-pki-ca u,u,u > > IPA12.MGMT (root)>certutil -L -d > > /etc/dirsrv/slapd-MGMT-CROSSCHX-COM/ Certificate Nickname > Trust > > Attributes SSL,S/MIME,JAR/XPI Server-Cert u,u,u > <a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> IPA CA C,, (root)>certutil -L -d > > /var/lib/pki/pki-tomcat/alias/ Certificate Nickname Trust > Attributes > > SSL,S/MIME,JAR/XPI caSigningCert cert-pki-ca CTu,Cu,Cu > > auditSigningCert cert-pki-ca u,u,Pu ocspSigningCert > cert-pki-ca > > u,u,u subsystemCert cert-pki-ca u,u,u Server-Cert > cert-pki-ca u,u,u > > ================================================= IPA11.MGMT > > (root)>getcert list Number of certificates and requests being > > tracked: 8. Request ID '20161229155314': status: > MONITORING stuck: > > no key pair storage: > > > type=NSSDB,location='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM',nickname='Server-Cert',token='NSS > > Certificate > > DB',pinfile='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM/pwdfile.txt' > > certificate: > > > type=NSSDB,location='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM',nickname='Server-Cert',token='NSS > > Certificate DB' CA: IPA issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa11.mgmt.crosschx.com</a> <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a>> > > <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a> > <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-30 15:52:43 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > post-save > > command: /usr/libexec/ipa/certmonger/restart_dirsrv > > MGMT-CROSSCHX-COM track: yes auto-renew: yes Request ID > > '20161229155652': status: MONITORING stuck: no key pair > storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=CA Audit,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: > > 2018-11-12 13:00:29 UTC key usage: > digitalSignature,nonRepudiation > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save > > command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229155654': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=OCSP Subsystem,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > expires: 2018-11-12 13:00:26 UTC key usage: > > digitalSignature,nonRepudiation,keyCertSign,cRLSign eku: > > id-kp-OCSPSigning pre-save command: > > /usr/libexec/ipa/certmonger/stop_pkicad post-save command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229155655': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=CA Subsystem,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > expires: 2018-11-12 13:00:28 UTC key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > > /usr/libexec/ipa/certmonger/stop_pkicad post-save command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229155657': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=Certificate Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2036-11-22 13:00:25 > UTC key > > usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > pre-save > > command: /usr/libexec/ipa/certmonger/stop_pkicad post-save > command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229155659': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS > > Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS > > Certificate DB' CA: dogtag-ipa-renew-agent issuer: > CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa11.mgmt.crosschx.com</a> <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a>> > > <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a> > <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-19 15:56:20 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save > > command: /usr/libexec/ipa/certmonger/renew_ca_cert > "Server-Cert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229155921': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > > > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > > Certificate DB' CA: IPA issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa11.mgmt.crosschx.com</a> <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a>> > > <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a> > <<a href="http://ipa11.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa11.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-30 15:52:46 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > post-save > > command: /usr/libexec/ipa/certmonger/restart_httpd track: yes > > auto-renew: yes Request ID '20161229160009': status: > MONITORING > > stuck: no key pair storage: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: > CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=IPA RA,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: > > 2018-11-12 13:01:34 UTC key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > > /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save > command: > > /usr/libexec/ipa/certmonger/renew_ra_cert track: yes > auto-renew: yes > > ================================== IPA13.MGMT > (root)>getcert list > > Number of certificates and requests being tracked: 8. > Request ID > > '20161229143449': status: MONITORING stuck: no key pair > storage: > > > type=NSSDB,location='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM',nickname='Server-Cert',token='NSS > > Certificate > > DB',pinfile='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM/pwdfile.txt' > > certificate: > > > type=NSSDB,location='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM',nickname='Server-Cert',token='NSS > > Certificate DB' CA: IPA issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa13.mgmt.crosschx.com</a> <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>> > > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a> > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-30 14:34:20 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > post-save > > command: /usr/libexec/ipa/certmonger/restart_dirsrv > > MGMT-CROSSCHX-COM track: yes auto-renew: yes Request ID > > '20161229143826': status: MONITORING stuck: no key pair > storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=CA Audit,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: > > 2018-11-12 13:00:29 UTC key usage: > digitalSignature,nonRepudiation > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save > > command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229143828': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=OCSP Subsystem,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > expires: 2018-11-12 13:00:26 UTC key usage: > > digitalSignature,nonRepudiation,keyCertSign,cRLSign eku: > > id-kp-OCSPSigning pre-save command: > > /usr/libexec/ipa/certmonger/stop_pkicad post-save command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229143831': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=CA Subsystem,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > expires: 2018-11-12 13:00:28 UTC key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > > /usr/libexec/ipa/certmonger/stop_pkicad post-save command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229143833': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=Certificate Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2036-11-22 13:00:25 > UTC key > > usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > pre-save > > command: /usr/libexec/ipa/certmonger/stop_pkicad post-save > command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229143835': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS > > Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS > > Certificate DB' CA: dogtag-ipa-renew-agent issuer: > CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa13.mgmt.crosschx.com</a> <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>> > > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a> > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-19 14:37:54 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save > > command: /usr/libexec/ipa/certmonger/renew_ca_cert > "Server-Cert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229144057': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > > > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > > Certificate DB' CA: IPA issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa13.mgmt.crosschx.com</a> <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>> > > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a> > <<a href="http://ipa13.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa13.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-30 14:34:23 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > post-save > > command: /usr/libexec/ipa/certmonger/restart_httpd track: yes > > auto-renew: yes Request ID '20161229144146': status: > MONITORING > > stuck: no key pair storage: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: > CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=IPA RA,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: > > 2018-11-12 13:01:34 UTC key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > > /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save > command: > > /usr/libexec/ipa/certmonger/renew_ra_cert track: yes > auto-renew: yes > > =========================== IPA12.MGMT (root)>getcert list > Number of > > certificates and requests being tracked: 8. Request ID > > '20161229151518': status: MONITORING stuck: no key pair > storage: > > > type=NSSDB,location='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM',nickname='Server-Cert',token='NSS > > Certificate > > DB',pinfile='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM/pwdfile.txt' > > certificate: > > > type=NSSDB,location='/etc/dirsrv/slapd-MGMT-CROSSCHX-COM',nickname='Server-Cert',token='NSS > > Certificate DB' CA: IPA issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa12.mgmt.crosschx.com</a> <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>> > > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-30 15:14:51 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > post-save > > command: /usr/libexec/ipa/certmonger/restart_dirsrv > > MGMT-CROSSCHX-COM track: yes auto-renew: yes Request ID > > '20161229151850': status: MONITORING stuck: no key pair > storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=CA Audit,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: > > 2018-11-12 13:00:29 UTC key usage: > digitalSignature,nonRepudiation > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save > > command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229151852': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=OCSP Subsystem,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > expires: 2018-11-12 13:00:26 UTC key usage: > > digitalSignature,nonRepudiation,keyCertSign,cRLSign eku: > > id-kp-OCSPSigning pre-save command: > > /usr/libexec/ipa/certmonger/stop_pkicad post-save command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229151854': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=CA Subsystem,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > expires: 2018-11-12 13:00:28 UTC key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > > /usr/libexec/ipa/certmonger/stop_pkicad post-save command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229151856': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > > cert-pki-ca',token='NSS Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > > cert-pki-ca',token='NSS Certificate DB' CA: > > dogtag-ipa-ca-renew-agent issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=Certificate Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2036-11-22 13:00:25 > UTC key > > usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > pre-save > > command: /usr/libexec/ipa/certmonger/stop_pkicad post-save > command: > > /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229151858': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS > > Certificate DB',pin set certificate: > > > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS > > Certificate DB' CA: dogtag-ipa-renew-agent issuer: > CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa12.mgmt.crosschx.com</a> <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>> > > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-19 15:18:16 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection > > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save > > command: /usr/libexec/ipa/certmonger/renew_ca_cert > "Server-Cert > > cert-pki-ca" track: yes auto-renew: yes Request ID > '20161229152115': > > status: MONITORING stuck: no key pair storage: > > > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > > > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS > > Certificate DB' CA: IPA issuer: CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">ipa12.mgmt.crosschx.com</a> <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>> > > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a> > <<a href="http://ipa12.mgmt.crosschx.com" rel="noreferrer" target="_blank">http://ipa12.mgmt.crosschx.com</a>>>,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: 2018-12-30 15:14:54 > UTC key > > usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > post-save > > command: /usr/libexec/ipa/certmonger/restart_httpd track: yes > > auto-renew: yes Request ID '20161229152204': status: > MONITORING > > stuck: no key pair storage: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' > certificate: > > > type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS > > Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: > CN=Certificate > > Authority,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> subject: > > CN=IPA RA,O=<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">MGMT.CROSSCHX.COM</a> <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> > <<a href="http://MGMT.CROSSCHX.COM" rel="noreferrer" target="_blank">http://MGMT.CROSSCHX.COM</a>> expires: > > 2018-11-12 13:01:34 UTC key usage: > > > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > > eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: > > /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save > command: > > /usr/libexec/ipa/certmonger/renew_ra_cert track: yes > auto-renew: yes > > > > > > *Mike Plemmons | Senior DevOps Engineer | CROSSCHX > > * > > 614.427.2411 > > <a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a> > <mailto:<a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a>> > <mailto:<a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a> > <mailto:<a href="mailto:mike.plemmons@crosschx.com" target="_blank">mike.plemmons@crosschx.com</a>>> > > <a href="http://www.crosschx.com" rel="noreferrer" target="_blank">www.crosschx.com</a> <<a href="http://www.crosschx.com" rel="noreferrer" target="_blank">http://www.crosschx.com</a>> > <<a href="http://www.crosschx.com/" rel="noreferrer" target="_blank">http://www.crosschx.com/</a>> > > > > > > > > > > > > > </blockquote></div> </div></div> </blockquote></div> </div> </blockquote></div> </div></div> </blockquote></div> </div>