[Freeipa-users] CA not found?

[Fraser Tweedale]

On Thu, Feb 09, 2017 at 09:01:01PM -0500, Guillermo Fuentes wrote:
> As we're enforcing encryption, here is via ldaps:
> $ ldapsearch -H ldaps://`hostname` -D "cn=Directory Manager"  -W -s
> sub -b ou=authorities,ou=ca,o=ipaca                   Enter LDAP
> Password:
> # extended LDIF
> #
> # LDAPv3
> # base <ou=authorities,ou=ca,o=ipaca> with scope subtree
> # filter: (objectclass=*)
> # requesting: ALL
> #
> 
> # authorities, ca, ipaca
> dn: ou=authorities,ou=ca,o=ipaca
> objectClass: top
> objectClass: organizationalUnit
> ou: authorities
> 
> # 0af769bd-a7ed-4f3a-8859-a877724ea8f2, authorities, ca, ipaca
> dn: cn=0af769bd-a7ed-4f3a-8859-a877724ea8f2,ou=authorities,ou=ca,o=ipaca
> objectClass: authority
> objectClass: top
> cn: 0af769bd-a7ed-4f3a-8859-a877724ea8f2
> authorityID: 0af769bd-a7ed-4f3a-8859-a877724ea8f2
> authorityKeyNickname: caSigningCert cert-pki-ca
> authorityEnabled: TRUE
> authorityDN: CN=Certificate Authority,O=EXAMPLE.COM
> description: Host authority
> 
> # search result
> search: 2
> result: 0 Success
> 
> # numResponses: 3
> # numEntries: 2
> 
> I'll attach the log files soon.
>
Hi Guillermo,

Thanks for the files.  At a glance, everything looks normal in ipa
upgrade and server startup.

There is a discrepancy between the authority record in Dogtag
(in the ldapsearch output above) and the corresponding entry in
FreeIPA:

>> $ ipa ca-show ipa
>>  Name: ipa
>>  Description: IPA CA
>>  Authority ID: 0cb513ea-6084-4144-a61c-7a0a8368d25c
>>  Subject DN: CN=Certificate Authority,O=EXAMPLE.COM
>>  Issuer DN: CN=Certificate Authority,O=EXAMPLE.COM

If these are indeed different (not a result of substitutions you
performed in releasing the data), this is a problem I have not seen
before (can you think of anything that might have caused this e.g.
deletion of the authority entry from Dogtag?).  To resolve, change
the 'ipacaid' attribute of cn=ipa,cn=cas,cn=ca,dc=ipa,dc=local to
'0af769bd-a7ed-4f3a-8859-a877724ea8f2'

HTH,
Fraser

P.S. I am away next week, so please help Guillermo if he's still
having trouble.