<div dir="ltr">This actually died after restart so I ended up starting over...<div><br></div><div>So here is the process I did that looks like it works and also survives restart</div><div><br></div><div>Step 1 - Before install</div>
<div><a href="http://stackoverflow.com/questions/23374894/mod-nss-with-apache-public-certificate-issue?noredirect=1#comment36504881_23374894" target="_blank" style="font-family:arial,sans-serif;font-size:13px">http://stackoverflow.com/questions/23374894/mod-nss-with-apache-public-certificate-issue?noredirect=1#comment36504881_23374894</a><span style="font-family:arial,sans-serif;font-size:13px"> </span><span style="font-family:arial,sans-serif;font-size:13px">-- start at </span><span style="color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;font-size:14px;line-height:17.804800033569336px">Convert crt file in PEM format and do that whole section completely</span></div>
<div><div><br></div><div>Step 2 - Install IPA server using the p12 file from before and also the intermediate.crt from your provider (I'm not sure why this isn't documented anywhere but I found it in my searches)</div>
<div><br></div><div>ipa-server-install --http_pkcs12 DOMAIN.COM.p12 --dirsrv_pkcs12 collectivebias.com.p12 --root-ca-file intermediate.crt</div><div><br></div><div>Step 3 - re add certs (for some reason I don't know but it's needed) (from <a href="http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" target="_blank" style="font-size:13px;font-family:arial,sans-serif">http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP</a>)</div>
<div><br></div><div>ipa-server-certinstall -w --http_pin=PKPASSWORD DOMAIN.COM.p12</div><div>ipa-server-certinstall -d --dirsrv_pin=PKPASSWORD DOMAIN.COM.p12</div></div><div><br></div><div>Step 4 reboot</div><div>Step 5 You can dance if you wanna...</div>
<div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Aug 25, 2014 at 2:02 PM, Chris Whittle <span dir="ltr"><<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I spoke a little too soon... It's working fine (browser is using new cert and also ldaps is using the new cert) except when you go to the certs page on the ui.<div>
<a href="https://DOMAIN/ipa/ui/#/e/cert/search" target="_blank">https://DOMAIN/ipa/ui/#/e/cert/search</a><br>
</div><div><br></div><div><h1 style="font-size:24px;margin:20px 0px 10px;font-family:'Open Sans',Helvetica,Arial,sans-serif;font-weight:300;line-height:1.1;color:rgb(51,51,51);text-align:center">An error has occurred (IPA Error 4301: CertificateOperationError)</h1>
<div style="margin-top:2em;font-family:monospace;color:rgb(51,51,51);font-size:12px;line-height:20px"><p style="margin:0px 0px 10px">Certificate operation cannot be completed: Unable to communicate with CMS (Internal Server Error)</p>
</div></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Aug 25, 2014 at 1:34 PM, Chris Whittle <span dir="ltr"><<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">ok I think I got it again... If anyone is looking for this here is the answer that worked for me....<div>
<br><div><ol><li>Here are the steps<br></li><ol><li><a href="http://stackoverflow.com/questions/23374894/mod-nss-with-apache-public-certificate-issue?noredirect=1#comment36504881_23374894" target="_blank">http://stackoverflow.com/questions/23374894/mod-nss-with-apache-public-certificate-issue?noredirect=1#comment36504881_23374894</a> -- start at <span style="color:rgb(0,0,0);font-family:Arial,'Liberation Sans','DejaVu Sans',sans-serif;font-size:14px;line-height:17.804800033569336px">Convert crt file in PEM format and do that whole section completely</span></li>
<li>Then with the p12 from above you get do this (skip the line about generating a new one) <a href="http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" target="_blank">http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP</a></li>
<ol><li>If you run across the error "/etc/ipa/ca.crt contains more than one certificate" you will need to go into /etc/ipa/ca.crt, back it up and then try removing one of the certs and try <span style="color:rgb(51,51,51);line-height:20px;white-space:pre-wrap"><font face="arial, helvetica, sans-serif">ipa-server-certinstall from above again (if it doesn't work revert ca.crt to the original and then remove the other)</font></span></li>
</ol><li>Then restart the both instances (bottom of the freeipa link) and you should be good to go.<br></li></ol></ol></div><div><div>
<div class="gmail_extra"><span style="background-color:rgb(255,255,255)"><br></span><div class="gmail_quote"><span style="background-color:rgb(255,255,255)">On Mon, Aug 25, 2014 at 8:45 AM, Chris Whittle <span dir="ltr"><<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>></span> wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><span style="background-color:rgb(255,255,255)">I found this but I think it's just IPA certs?</span><div>
<span style="background-color:rgb(255,255,255)"><a href="http://www.freeipa.org/page/V4/CA_certificate_renewal" target="_blank">http://www.freeipa.org/page/V4/CA_certificate_renewal</a><br></span></div><div><span style="background-color:rgb(255,255,255)"><br>
</span></div><div><span style="background-color:rgb(255,255,255)">Basically I want to use my existing wildcard cert for https and ldaps... </span></div>
<div><span style="background-color:rgb(255,255,255)">I did this on my 3.3 install on CentOS but now I'm on a 4 install on Fedora Core.</span></div><div><span style="background-color:rgb(255,255,255)"><br></span></div>
<div><span style="background-color:rgb(255,255,255)">Any help would be more than appreciated! </span></div><div><span style="background-color:rgb(255,255,255)">Thanks!</span></div></div><div><div><div class="gmail_extra">
<span style="background-color:rgb(255,255,255)"><br><br></span><div class="gmail_quote"><span style="background-color:rgb(255,255,255)">
On Mon, Aug 25, 2014 at 6:24 AM, Chris Whittle <span dir="ltr"><<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>></span> wrote:<br></span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<p dir="ltr"><span style="background-color:rgb(255,255,255)">I have 4 installed and I get it when I try to generate the pk12</span></p><div><div>
<div class="gmail_quote"><span style="background-color:rgb(255,255,255)">On Aug 25, 2014 3:50 AM, "Jan Cholasta" <<a href="mailto:jcholast@redhat.com" target="_blank">jcholast@redhat.com</a>> wrote:<br type="attribution">
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span style="background-color:rgb(255,255,255)">
Hi,<br>
<br>
Dne 25.8.2014 v 03:04 Chris Whittle napsal(a):<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span style="background-color:rgb(255,255,255)">
Trying to do this<br>
<a href="http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" target="_blank">http://www.freeipa.org/page/<u></u>Using_3rd_part_certificates_<u></u>for_HTTP/LDAP</a><br>
<br>
And I keep getting "Error unable to get local issuer certificate getting<br>
chain."<br>
</span></blockquote>
<span style="background-color:rgb(255,255,255)"><br>
Where are you getting this error? ipa-server-certinstall, or httpd, or somewhere else?<br>
<br>
What version of ipa do you have installed?<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span style="background-color:rgb(255,255,255)"><br>
I'm wondering if it's because of this from the doc<br>
"The certificate in mysite.crt must be signed by the CA used when<br>
installing FreeIPA."<br>
but it might not either...<br>
</span></blockquote>
<span style="background-color:rgb(255,255,255)"><br>
In this case you should get a "file.p12 is not signed by /etc/ipa/ca.crt, or the full certificate chain is not present in the PKCS#12 file" error in ipa-server-certinstall.<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span style="background-color:rgb(255,255,255)"><br>
Any ideas?<br>
<br>
<br>
</span></blockquote>
<span style="background-color:rgb(255,255,255)"><br>
Honza<br>
<br>
-- <br>
Jan Cholasta<br>
</span></blockquote></div>
</div></div></blockquote></div><span style="background-color:rgb(255,255,255)"><br></span></div>
</div></div></blockquote></div><br></div></div></div></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>