<div dir="ltr">ok I think I got it again... If anyone is looking for this here is the answer that worked for me....<div><br><div><ol><li>Here are the steps<br></li><ol><li><a href="http://stackoverflow.com/questions/23374894/mod-nss-with-apache-public-certificate-issue?noredirect=1#comment36504881_23374894">http://stackoverflow.com/questions/23374894/mod-nss-with-apache-public-certificate-issue?noredirect=1#comment36504881_23374894</a> -- start at <span style="color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;font-size:14px;line-height:17.804800033569336px">Convert crt file in PEM format and do that whole section completely</span></li>
<li>Then with the p12 from above you get do this (skip the line about generating a new one) <a href="http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP">http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP</a></li>
<ol><li>If you run across the error "/etc/ipa/ca.crt contains more than one certificate" you will need to go into /etc/ipa/ca.crt, back it up and then try removing one of the certs and try <span style="color:rgb(51,51,51);line-height:20px;white-space:pre-wrap"><font face="arial, helvetica, sans-serif">ipa-server-certinstall from above again (if it doesn't work revert ca.crt to the original and then remove the other)</font></span></li>
</ol><li>Then restart the both instances (bottom of the freeipa link) and you should be good to go.<br></li></ol></ol></div>
<div class="gmail_extra"><span style="background-color:rgb(255,255,255)"><br></span><div class="gmail_quote"><span style="background-color:rgb(255,255,255)">On Mon, Aug 25, 2014 at 8:45 AM, Chris Whittle <span dir="ltr"><<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>></span> wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><span style="background-color:rgb(255,255,255)">I found this but I think it's just IPA certs?</span><div>
<span style="background-color:rgb(255,255,255)"><a href="http://www.freeipa.org/page/V4/CA_certificate_renewal" target="_blank">http://www.freeipa.org/page/V4/CA_certificate_renewal</a><br></span></div><div><span style="background-color:rgb(255,255,255)"><br>
</span></div><div><span style="background-color:rgb(255,255,255)">Basically I want to use my existing wildcard cert for https and ldaps... </span></div>
<div><span style="background-color:rgb(255,255,255)">I did this on my 3.3 install on CentOS but now I'm on a 4 install on Fedora Core.</span></div><div><span style="background-color:rgb(255,255,255)"><br></span></div>
<div><span style="background-color:rgb(255,255,255)">Any help would be more than appreciated! </span></div><div><span style="background-color:rgb(255,255,255)">Thanks!</span></div></div><div class=""><div class="h5"><div class="gmail_extra">
<span style="background-color:rgb(255,255,255)"><br><br></span><div class="gmail_quote"><span style="background-color:rgb(255,255,255)">
On Mon, Aug 25, 2014 at 6:24 AM, Chris Whittle <span dir="ltr"><<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>></span> wrote:<br></span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<p dir="ltr"><span style="background-color:rgb(255,255,255)">I have 4 installed and I get it when I try to generate the pk12</span></p><div><div>
<div class="gmail_quote"><span style="background-color:rgb(255,255,255)">On Aug 25, 2014 3:50 AM, "Jan Cholasta" <<a href="mailto:jcholast@redhat.com" target="_blank">jcholast@redhat.com</a>> wrote:<br type="attribution">
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span style="background-color:rgb(255,255,255)">
Hi,<br>
<br>
Dne 25.8.2014 v 03:04 Chris Whittle napsal(a):<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span style="background-color:rgb(255,255,255)">
Trying to do this<br>
<a href="http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" target="_blank">http://www.freeipa.org/page/<u></u>Using_3rd_part_certificates_<u></u>for_HTTP/LDAP</a><br>
<br>
And I keep getting "Error unable to get local issuer certificate getting<br>
chain."<br>
</span></blockquote>
<span style="background-color:rgb(255,255,255)"><br>
Where are you getting this error? ipa-server-certinstall, or httpd, or somewhere else?<br>
<br>
What version of ipa do you have installed?<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span style="background-color:rgb(255,255,255)"><br>
I'm wondering if it's because of this from the doc<br>
"The certificate in mysite.crt must be signed by the CA used when<br>
installing FreeIPA."<br>
but it might not either...<br>
</span></blockquote>
<span style="background-color:rgb(255,255,255)"><br>
In this case you should get a "file.p12 is not signed by /etc/ipa/ca.crt, or the full certificate chain is not present in the PKCS#12 file" error in ipa-server-certinstall.<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span style="background-color:rgb(255,255,255)"><br>
Any ideas?<br>
<br>
<br>
</span></blockquote>
<span style="background-color:rgb(255,255,255)"><br>
Honza<br>
<br>
-- <br>
Jan Cholasta<br>
</span></blockquote></div>
</div></div></blockquote></div><span style="background-color:rgb(255,255,255)"><br></span></div>
</div></div></blockquote></div><br></div></div></div>