<div dir="ltr"><div>Hi, I even tried the command using an export from the http service nss db, same issue. </div><div>regarding SElinux: ausearch -m AVC -ts recent <no matches> </div><div>Sending you the log personally. </div><div>Regards, </div><div>D </div></div><div class="gmail_extra"> <div class="gmail_quote">2015-04-10 17:03 GMT+02:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">David Dejaeghere wrote: > Hi Rob, > > Without the --http-pin the command will give a prompt to enter the password. > Tried both. > > I am sending the output of the pk12util -l to you in another email. > It holds the wildcard certificate and the godaddy bundle for as far as I > can tell. I have to admit, I'm a bit stumped. (SEC_ERROR_LIBRARY_FAILURE) is a rather generic NSS error which can mean any number of things. It often means that the NSS database it is using is bad in some way but given that this is a temporary database created just for this purpose I doubt that's it. You may want to look for SELinux AVCs though: ausearch -m AVC -ts recent. At the point where it is blowing up, the PKCS#12 file has already been imported and IPA is walking through the results trying to ensure that the full cert trust chain is available. It does this by reading the certs out of the database, and at that point it's blowing up. The PKCS#12 output you sent me looks ok. I don't believe this is an issue with trust or missing parts of the chain. I created a simple PKCS#12 file and was able to prepare a replica using it, so AFAICT the code isn't completely broken. Can you provide the full output from ipa-replica-prepare? rob > > Regards, > > D > > 2015-04-09 21:39 GMT+02:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> > <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>>: > > David Dejaeghere wrote: > > Hi, > > > > Sorry for the lack of details! > > You are indeed correct about the version its 4.1 > > The command I am using is this: > > ipa-replica-prepare <a href="http://ipa-r1.myobscureddomain.com" target="_blank">ipa-r1.myobscureddomain.com</a> <<a href="http://ipa-r1.myobscureddomain.com" target="_blank">http://ipa-r1.myobscureddomain.com</a>> > > <<a href="http://ipa-r1.myobscureddomain.com" target="_blank">http://ipa-r1.myobscureddomain.com</a>> --http-cert-file > > /home/fedora/newcert.pk12 --dirsrv-cert-file /home/fedora/newcert.pk12 > > --ip-address 172.31.16.31 -v > > I was pretty sure a pin was required with those options as well. > > What do the PKCS#12 files look like: pk12util -l > /home/fedora/newcert.pk12 > > rob > > > > > Regards, > > > > D > > > > 2015-04-09 16:16 GMT+02:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>> > > <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>>>: <div class="HOEnZb"><div class="h5">> > > > David Dejaeghere wrote: > > > Hi, > > > > > > Does somebody have any pointers for me regarding this issue? > > > > It would help very much if you'd include the version you're working > > with. Based on line numbers I'll assume IPA 4.1. > > > > It's hard to say since you don't include the command-line you're using, > > or what those files consist of. > > > > It looks like it is blowing up trying to verify that the whole > > certificate chain is available. NSS unfortunately doesn't always provide > > the best error messages so it's hard to say why this particular cert > > can't be loaded. > > > > rob > > > > > > > > Regards, > > > > > > D > > > > > > 2015-04-07 13:34 GMT+02:00 David Dejaeghere <<a href="mailto:david.dejaeghere@gmail.com">david.dejaeghere@gmail.com</a> <mailto:<a href="mailto:david.dejaeghere@gmail.com">david.dejaeghere@gmail.com</a>> > <mailto:<a href="mailto:david.dejaeghere@gmail.com">david.dejaeghere@gmail.com</a> <mailto:<a href="mailto:david.dejaeghere@gmail.com">david.dejaeghere@gmail.com</a>>> > > > <mailto:<a href="mailto:david.dejaeghere@gmail.com">david.dejaeghere@gmail.com</a> > <mailto:<a href="mailto:david.dejaeghere@gmail.com">david.dejaeghere@gmail.com</a>> > > <mailto:<a href="mailto:david.dejaeghere@gmail.com">david.dejaeghere@gmail.com</a> > <mailto:<a href="mailto:david.dejaeghere@gmail.com">david.dejaeghere@gmail.com</a>>>>>: > > > > > > Hello, > > > > > > I am trying to setup a replica for my master which has > been setup > > > with an external CA to use our godaddy wildcard certificate. > > > The ipa-replica-prepare is failing with the following debug > > information. > > > I am using --http-cert and --dirsrv-cert with my pk12 > server > > > certificate. > > > What can I verify to get an idea of what is going wrong? > > > > > > ipa: DEBUG: stderr= > > > > ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: DEBUG: > > > File > > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line > > > 169, in execute > > > self.ask_for_options() > > > File > > > > > > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_replica_prepare.py", > > > line 276, in ask_for_options > > > options.http_cert_name) > > > File > > > > > > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_replica_prepare.py", > > > line 176, in load_pkcs12 > > > host_name=self.replica_fqdn) > > > File > > > > > > "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", > > line > > > 785, in load_pkcs12 > > > nss_cert = x509.load_certificate(cert, x509.DER) > > > File > "/usr/lib/python2.7/site-packages/ipalib/x509.py", line > > 128, > > > in load_certificate > > > return nss.Certificate(buffer(data)) > > > > > > ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: > > DEBUG: The > > > ipa-replica-prepare command failed, exception: NSPRError: > > > (SEC_ERROR_LIBRARY_FAILURE) security library failure. > > > > ipa.ipaserver.install.ipa_replica_prepare.ReplicaPrepare: ERROR: > > > (SEC_ERROR_LIBRARY_FAILURE) security library failure. > > > > > > Regards, > > > > > > D > > > > > > > > > > > > > > > > > > </div></div></blockquote></div> </div>