<html dir="ltr"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" id="owaParaStyle"></style> </head> <body fpstyle="1" ocsi="0" class=" hasGoogleVoiceExt"> <div style="direction: ltr;font-family: Helvetica;color: #000000;font-size: 10pt;"> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">When I check the host certificate I see a ca-error saying it cannot find a suitable key.</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"># ipa-getcert list</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">Number of certificates and requests being tracked: 1.</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">Request ID '20130719035440':</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>status: CA_UNCONFIGURED</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>ca-error: Error setting up ccache for local "host" service using default keytab: Keytab contains no suitable keys for host/det-webdl01@.</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>stuck: yes</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>key pair storage: type=NSSDB,location='/etc/pki/nssdb',nickname='Server-Cer',token='NSS Certificate DB'</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>certificate: type=NSSDB,location='/etc/pki/nssdb',nickname='Server-Cer'</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>CA: IPA</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>issuer:</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>subject:</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>expires: unknown</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>pre-save command:</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>post-save command:</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>track: yes</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><span class="Apple-tab-span" style="white-space:pre"></span>auto-renew: yes</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">When I check my keytab</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"># kinit -kt /etc/krb5.keytab host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">No error</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">If I list my keytab,</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"># klist -kt /etc/krb5.keytab</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">Keytab name: FILE:/etc/krb5.keytab</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">KVNO Timestamp Principal</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">---- ----------------- --------------------------------------------------------</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> 2 07/18/13 13:14:06 host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> 2 07/18/13 13:14:07 host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> 2 07/18/13 13:14:07 host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> 2 07/18/13 13:14:07 host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> 1 07/18/13 13:14:07 host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> 1 07/18/13 13:14:07 host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> 1 07/18/13 13:14:07 host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> 1 07/18/13 13:14:07 host/det-webdl01.sub.example.com@EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">My /etc/krb5.conf file looks like:</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">[libdefaults]</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> default_keytab_name = FILE:/etc/krb5.keytab</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> default_realm = EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> dns_lookup_realm = false</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> dns_lookup_kdc = false</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> rdns = false</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> ticket_lifetime = 24h</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> forwardable = yes</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">[realms]</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> EXAMPLE.COM = {</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> kdc = det-ldmpl01.sub.example.com:88</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> master_kdc = det-ldmpl01.sub.example.com:88</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> admin_server = det-ldmpl01.sub.example.com:749</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> default_domain = example.com</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> pkinit_anchors = FILE:/etc/ipa/ca.crt</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> }</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">[domain_realm]</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> .example.com = EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> example.com = EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> .sub.example.com = EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"> sub.example.com = EXAMPLE.COM</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">It seems the error from ipa-getcert list shows:</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">ca-error: Error setting up ccache for local "host" service using default keytab: Keytab contains no suitable keys for host/det-webdl01@.</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">where it is trunking the hostname and not including the realm name after @ seems to be the problem, but I cannot figure out why. If I run `hostname` on this host it prints det-webdl01.sub.example.com. </font></div> <div><br> </div> </div> </body> </html>