[Freeipa-users] ipa-server-install & certificates

[Leo Baltus]

Hi,

(first time user, firts post on this ML)

I am setting up ipa-server on a fresh CentOS-7 system.

After running:

/usr/sbin/ipa-server-install -U --realm XXXYYYYY.NL --domain xxxyyyyy.nl \
   --admin-password foobarxy --ds-password foobarxy \
   --idstart 5000 \
   --no-ntp

Connecting my Chrome browser to this machine results in a 'Your
connection is not private' errorpage. And no option to go the
insecure way.

Now I have my own CA, created a certifcate keypair with it and I would
like to import this keypair together with my CA to add trust.

Following http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP

ipa-cacert-manage -p foobarxy -n NICKNAME -t C,, install myca.crt
ipa-certupdate
ipa-server-certinstall -w -d mysite.key mysite.crt

after running ipa-certupdate again I get:

trying https://lab-k1.xxxyyyyy.nl/ipa/json
Forwarding 'ca_is_enabled' to json server 'https://lab-k1.xxxyyyyy.nl/ipa/json'
cert validation failed for "CN=Object Signing Cert,O=XXXYYYYY.NL" ((SEC_ERROR_INADEQUATE_KEY_USAGE) Certificate key usage inadequate for attempted operation.)

On other attempts I get a timeout on ipa-certupdate:
Resubmitting certmonger request '20161115122715' timed out, please check the request manually

Any idea what is going on? Am I using the right docs?

versions:
ipa-server-4.2.0-15.0.1.el7.centos.19.x86_64
krb5-libs-1.13.2-12.el7_2.x86_64
krb5-pkinit-1.13.2-12.el7_2.x86_64
krb5-server-1.13.2-12.el7_2.x86_64
krb5-workstation-1.13.2-12.el7_2.x86_64
libsss_nss_idmap-1.13.0-40.el7_2.12.x86_64
mod_nss-1.0.11-6.el7.x86_64
nss-3.21.0-9.el7_2.x86_64
nss-softokn-3.16.2.3-14.2.el7_2.x86_64
nss-softokn-freebl-3.16.2.3-14.2.el7_2.x86_64
nss-sysinit-3.21.0-9.el7_2.x86_64
nss-tools-3.21.0-9.el7_2.x86_64
nss-util-3.21.0-2.2.el7_2.x86_64
nss_compat_ossl-0.9.6-8.el7.x86_64
openssl-1.0.1e-51.el7_2.7.x86_64
openssl-libs-1.0.1e-51.el7_2.7.x86_64
pam_krb5-2.4.8-4.el7.x86_64
pki-base-10.2.5-10.el7_2.noarch
pki-ca-10.2.5-10.el7_2.noarch
pki-kra-10.2.5-10.el7_2.noarch
pki-server-10.2.5-10.el7_2.noarch
pki-tools-10.2.5-10.el7_2.x86_64
python-nss-0.16.0-3.el7.x86_64
sssd-krb5-1.13.0-40.el7_2.12.x86_64
sssd-krb5-common-1.13.0-40.el7_2.12.x86_64

-- 
Leo Baltus