<html><head></head><body><div>See inline below --</div><div><br></div><div>On Fri, 2016-08-19 at 07:28 -0300, Leonardo Bacha Abrantes wrote:</div><blockquote type="cite"><div dir="ltr"><div>Hi guys,</div><div><br></div><div>I'm trying to configure a subordinate CA, but am receiving the message "ERROR: Unable to access security domain: 401 Client Error: Unauthorized".</div><div><br></div><div><br></div><div>I follow these steps:</div><div><br></div><div><br></div><div><br></div><div><br></div><div>===>> On Server01 (root-ca):</div><div><br></div><div><br></div><div><a href="http://setup-ds.pl">setup-ds.pl</a> --silent General.FullMachineName=root-ca.xxx.xxx.xx \</div><div>General.SuiteSpotUserID=nobody General.SuiteSpotGroup=nobody \</div><div>slapd.ServerPort=389 slapd.ServerIdentifier=pki-RootCA \</div><div>slapd.Suffix=dc=EXAMPLE,dc=xxx,dc=xx \</div><div>slapd.RootDN="cn=ldapadmin" slapd.RootDNPwd=PASSWORD</div><div><br></div><div><br></div><div><br></div><div>> myconfig.txt</div><div><br></div><div><br></div><div>[DEFAULT]</div><div>pki_admin_password=Root-CA_pwd</div><div>pki_client_database_password=Root-CA_pwd</div><div>pki_client_pkcs12_password=Root-CA_pwd</div><div>pki_ds_password=Root-CA_pwd</div><div>pki_security_domain_password=Root-CA_pwd</div><div>pki_admin_password=Root-CA_pwd</div><div>pki_client_database_password=Root-CA_pwd</div><div>pki_client_pkcs12_password=Root-CA_pwd</div><div>pki_ds_bind_dn=cn=ldapadmin</div><div>pki_ds_password=Root-CA_pwd</div><div>pki_security_domain_password=Root-CA_pwd</div><div>pki_instance_name=pki-RootCA</div><div><br></div><div>[CA]</div><div>pki_ca_signing_subject_dn=cn=EXAMLE Root Certification Authority,o=XXXXXXXXXXX,c=BR</div><div>pki_admin_nickname=PKI Administrator for EXAMPLE</div><div>pki_admin_subject_dn=cn=PKI Administrator Root CA,e=admin@XXXXX.XXX.xx,o=XXXXXXXXXX,c=BR</div><div>pki_admin_email=admin@XXXXXX.xxx.xx</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>===>> On Server02 (Sub-ca):</div><div><br></div><div><br></div><div><a href="http://setup-ds.pl">setup-ds.pl</a> --silent General.FullMachineName=sub-ca.xxx.xxx.xx \</div><div>General.SuiteSpotUserID=nobody General.SuiteSpotGroup=nobody \</div><div>slapd.ServerPort=389 slapd.ServerIdentifier=pki-SubCA \</div><div>slapd.Suffix=dc=EXAMPLE,dc=xxx,dc=xx \</div><div>slapd.RootDN="cn=ldapadmin" slapd.RootDNPwd=OTHER_PASSWORD</div><div><br></div><div><br></div><div><br></div><div>> myconfig.txt</div><div><br></div><div>[DEFAULT]</div><div>pki_admin_password=SUB-CA_Passord</div><div>pki_client_database_password=SUB-CA_Passord</div><div>pki_client_pkcs12_password=SUB-CA_Passord</div><div>pki_ds_password=SUB-CA_Passord</div><div>pki_security_domain_password=SUB-CA_Passord</div><div>pki_admin_password=SUB-CA_Passord</div><div>pki_client_database_password=SUB-CA_Passord</div><div>pki_client_pkcs12_password=SUB-CA_Passord</div><div>pki_ds_bind_dn=cn=ldapadmin</div><div>pki_ds_password=SUB-CA_Passord</div><div>pki_security_domain_password=SUB-CA_Passord</div></div></blockquote><div><br></div><div>This is incorrect. The security domain password -- which for some reason you have listed twice</div><div>in this section -- should be the password for the admin user in the root CA.</div><div><br></div><div>The subCA is contacting the rootCA - which hosts the secruity domain to register the new subsystem</div><div>with the domain.</div><div><br></div><blockquote type="cite"><div dir="ltr"><div>pki_instance_name=pki-SubCA</div><div>pki_security_domain_hostname=root-ca.xxxx.xxx.xx</div><div>pki_security_domain_https_port=8443</div><div>pki_security_domain_user=caadmin</div><div><br></div><div>[CA]</div><div>pki_subordinate=True</div><div>pki_issuing_ca=<a href="https://root-ca.xxxx.xxxv.xx:8443">https://root-ca.xxxx.xxxv.xx:8443</a></div><div>pki_ca_signing_subject_dn=cn=EXAMPLE Certification Authority L2,o=XXXXXXXXXXX,c=BR</div><div>pki_subordinate_create_new_security_domain=True</div><div>pki_subordinate_security_domain_name=EXAMPLE Certification Authority L2</div><div>pki_admin_nickname=PKI Administrator for Example Sub-CA L2</div><div>pki_admin_subject_dn=cn=PKI Administrator CA L2,e=admin@xxxxx.xxx.xx,o=XXXXXXXXXXX,c=BR</div><div>pki_admin_email=admin@xxxx.xxx.xx</div><div><br></div><div><br></div><div><br></div><div><br></div><div>when I run pkispawn -v -s CA -f myconfig.txt on Server02:</div><div><br></div><div><br></div><div><span class="" style="white-space:pre"> </span>ERROR: Unable to access security domain: 401 Client Error: Unauthorized</div><div><br></div><div><br></div><div><br></div><div>===</div><div><br></div><div><br></div><div><br></div><div>I tried to use the same passwords on myconfig.txt in both servers just to test, but I receive the same message.</div><div><br></div><div><br></div><div>Can you help me please ?</div><div><br></div><div>many thanks!</div><div><br></div><div><br></div></div>
<pre>_______________________________________________
Pki-users mailing list
<a href="mailto:Pki-users@redhat.com">Pki-users@redhat.com</a>
<a href="https://www.redhat.com/mailman/listinfo/pki-users">https://www.redhat.com/mailman/listinfo/pki-users</a></pre></blockquote></body></html>