[Freeipa-users] Replica Cert failed to renew ...

[Martin Kosek]

On 07/31/2014 07:49 AM, Matt Bryant wrote:
> All,
> 
> Got an issue with an IPA replica in that the certs in /etc/httpd/alias &
> /etc/dirsrv/slapd-IPA-REALM have expired.

I assume that this replica does not have a CA and we are only dealing with
service HTTPD and DIRSRV service certificates.

> Have tried setting date back before expiry on the replica and doing an
> 'ipa-getcert resubmit -i <id>' but that hasn't worked it looks like the CA
> master is actually rejecting it since the havent set the date back on that server.
> 
> Error am getting on replica is ...
> 
> Request ID '20120719044839':
>     status: CA_UNREACHABLE
>     ca-error: Server failed request, will retry: -504 (libcurl failed to
> execute the HTTP POST transaction.  Peer certificate cannot be authenticated
> with known CA certificates).

Isn't this rather a problem that the replica does not trust the master server
HTTPD certificate because it's certificates are not valid from replica POV?

> is there any way of forcing a re-newel or manual process for updating these
> certs .. ???

If this is just a replica without PKI, I would suggest synchronizing the time
back with the master CA server and restarting all the services.

If the HTTPD service does not want to start, follow chapter "⁠25.2.2. Starting
IdM with Expired Certificates" in
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/cas.html
and then try to resubmit the certificates so that they can be renewed on the
master. Do not forget to revert the above configuration changes when you are done.

Also, what version of FreeIPA are you running?

HTH,
Martin