[Freeipa-users] Certificates not renewed

Thomas Sailer sailer at sailer.dynip.lugs.ch
Mon Nov 25 17:42:01 UTC 2013 

I have a few certificates that fail to be updated, for example the ldap 
and http certificates. If I read the error message from getcert list 
(see below) correctly, then the contents of the pinfiles are incorrect. 
How do I fix this?

Thanks,
Tom

Number of certificates and requests being tracked: 8.
Request ID '20111116140151':
     status: CA_UNREACHABLE
     ca-error: Server failed request, will retry: 4301 (RPC failed at 
server.  Certificate operation cannot be completed: EXCEPTION (Invalid 
Credential.)).
     stuck: yes
     key pair storage: 
type=NSSDB,location='/etc/dirsrv/slapd-XXXX-COM',nickname='Server-Cert',token='NSS 
Certificate DB',pinfile='/etc/dirsrv/slapd-XXXX-COM//pwdfile.txt'
     certificate: 
type=NSSDB,location='/etc/dirsrv/slapd-XXXX-COM',nickname='Server-Cert',token='NSS 
Certificate DB'
     CA: IPA
     issuer: CN=Certificate Authority,O=XXXX.COM
     subject: CN=server.xxxx.com,O=XXXX.COM
     expires: 2013-11-16 14:01:50 UTC
     key usage: 
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
     eku: id-kp-serverAuth,id-kp-clientAuth
     pre-save command:
     post-save command:
     track: yes
     auto-renew: yes
Request ID '20111116140217':
     status: CA_UNREACHABLE
     ca-error: Server failed request, will retry: 4301 (RPC failed at 
server.  Certificate operation cannot be completed: EXCEPTION (Invalid 
Credential.)).
     stuck: yes
     key pair storage: 
type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS 
Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA//pwdfile.txt'
     certificate: 
type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS 
Certificate DB'
     CA: IPA
     issuer: CN=Certificate Authority,O=XXXX.COM
     subject: CN=server.xxxx.com,O=XXXX.COM
     expires: 2013-11-16 14:02:17 UTC
     key usage: 
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
     eku: id-kp-serverAuth,id-kp-clientAuth
     pre-save command:
     post-save command:
     track: yes
     auto-renew: yes
Request ID '20111116140238':
     status: CA_UNREACHABLE
     ca-error: Server failed request, will retry: 4301 (RPC failed at 
server.  Certificate operation cannot be completed: EXCEPTION (Invalid 
Credential.)).
     stuck: yes
     key pair storage: 
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS 
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
     certificate: 
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS 
Certificate DB'
     CA: IPA
     issuer: CN=Certificate Authority,O=XXXX.COM
     subject: CN=server.xxxx.com,O=XXXX.COM
     expires: 2013-11-16 14:02:38 UTC
     key usage: 
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
     eku: id-kp-serverAuth,id-kp-clientAuth
     pre-save command:
     post-save command:
     track: yes
     auto-renew: yes
Request ID '20130424090625':
     status: MONITORING
     stuck: no
     key pair storage: 
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='auditSigningCert 
cert-pki-ca',token='NSS Certificate DB',pin='399557979284'
     certificate: 
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='auditSigningCert 
cert-pki-ca',token='NSS Certificate DB'
     CA: dogtag-ipa-renew-agent
     issuer: CN=Certificate Authority,O=XXXX.COM
     subject: CN=CA Audit,O=XXXX.COM
     expires: 2015-09-29 09:22:17 UTC
     key usage: digitalSignature,nonRepudiation
     pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
     post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert 
"auditSigningCert cert-pki-ca"
     track: yes
     auto-renew: yes
Request ID '20130424090626':
     status: MONITORING
     stuck: no
     key pair storage: 
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='ocspSigningCert 
cert-pki-ca',token='NSS Certificate DB',pin='399557979284'
     certificate: 
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='ocspSigningCert 
cert-pki-ca',token='NSS Certificate DB'
     CA: dogtag-ipa-renew-agent
     issuer: CN=Certificate Authority,O=XXXX.COM
     subject: CN=OCSP Subsystem,O=XXXX.COM
     expires: 2015-09-29 09:21:17 UTC
     eku: id-kp-OCSPSigning
     pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
     post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert 
"ocspSigningCert cert-pki-ca"
     track: yes
     auto-renew: yes
Request ID '20130424090627':
     status: MONITORING
     stuck: no
     key pair storage: 
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='subsystemCert 
cert-pki-ca',token='NSS Certificate DB',pin='399557979284'
     certificate: 
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='subsystemCert 
cert-pki-ca',token='NSS Certificate DB'
     CA: dogtag-ipa-renew-agent
     issuer: CN=Certificate Authority,O=XXXX.COM
     subject: CN=CA Subsystem,O=XXXX.COM
     expires: 2015-09-29 09:21:17 UTC
     key usage: 
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
     eku: id-kp-serverAuth,id-kp-clientAuth
     pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
     post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert 
"subsystemCert cert-pki-ca"
     track: yes
     auto-renew: yes
Request ID '20130424090628':
     status: MONITORING
     stuck: no
     key pair storage: 
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS 
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
     certificate: 
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS 
Certificate DB'
     CA: dogtag-ipa-renew-agent
     issuer: CN=Certificate Authority,O=XXXX.COM
     subject: CN=IPA RA,O=XXXX.COM
     expires: 2015-09-29 09:21:17 UTC
     key usage: 
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
     eku: id-kp-serverAuth,id-kp-clientAuth
     pre-save command:
     post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert
     track: yes
     auto-renew: yes
Request ID '20130424090629':
     status: MONITORING
     stuck: no
     key pair storage: 
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='Server-Cert 
cert-pki-ca',token='NSS Certificate DB',pin='399557979284'
     certificate: 
type=NSSDB,location='/var/lib/pki-ca/alias',nickname='Server-Cert 
cert-pki-ca',token='NSS Certificate DB'
     CA: dogtag-ipa-renew-agent
     issuer: CN=Certificate Authority,O=XXXX.COM
     subject: CN=server.xxxx.com,O=XXXX.COM
     expires: 2015-09-29 09:21:17 UTC
     key usage: 
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
     eku: id-kp-serverAuth,id-kp-clientAuth
     pre-save command:
     post-save command:
     track: yes
     auto-renew: yes

More information about the Freeipa-users mailing list