<div dir="ltr"><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Hi Rob,</div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Thanks for the reply. </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default"><span style="font-family:'trebuchet ms',sans-serif">The </span><font face="monospace, monospace">ipa-server-certinstall</font><font face="trebuchet ms, sans-serif"> did require that I have the cert and the CA cert in PEM file and the key in another PEM file. And the command went thru successfully. </font></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default"><span style="font-family:'trebuchet ms',sans-serif">But afterwards the HTTP service stopped working. Only way I could get it to start again was to set </span><font face="monospace, monospace">NSSEnforceValidCerts off</font><font face="trebuchet ms, sans-serif"> in </font><font face="monospace, monospace">/etc/httpd/conf.d/nss.conf</font><font face="trebuchet ms, sans-serif">. </font></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Below is the error message from the logs. </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default"><div class="gmail_default"><font face="monospace, monospace">[Sun Jun 21 09:46:09.188241 2015] [:info] [pid 3803] Initializing SSL Session Cache of size 10000. SSL2 timeout = 100, SSL3/TLS timeout = 86400.</font></div><div class="gmail_default"><font face="monospace, monospace">[Sun Jun 21 09:46:09.444378 2015] [:info] [pid 3803] Init: Seeding PRNG with 144 bytes of entropy</font></div><div class="gmail_default"><font face="monospace, monospace">[Sun Jun 21 09:46:09.444395 2015] [:info] [pid 3803] Init: Initializing (virtual) servers for SSL</font></div><div class="gmail_default"><font face="monospace, monospace">[Sun Jun 21 09:46:09.454700 2015] [:error] [pid 3803] SSL Library Error: -8102 Certificate key usage inadequate for attempted operation.</font></div><div class="gmail_default"><font face="monospace, monospace">[Sun Jun 21 09:46:09.454757 2015] [:error] [pid 3803] Unable to verify certificate 'Signing-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.</font></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">On the turning off SSL, I did try with what you are suggesting. A load balancer with the commercial CA and HTTPS from LB to the server behind it and it work! Only problem is, I will have to have have 1 each load balancer for each of the servers. This is because I used naming like <a href="http://ipa.example.com">ipa.example.com</a> and <a href="http://ipa2.example.com">ipa2.example.com</a> etc for the IPA servers. These are all replicas and their name has to match whats on the LB. </div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">Thanks again!</div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">--Prashant</div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 21 June 2015 at 01:51, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">Prashant Bapat wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I tried the steps documented on a test VM. Looks like I ended up in the<br> situation described here<br> <a href="https://www.redhat.com/archives/freeipa-users/2012-January/msg00045.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2012-January/msg00045.html</a>.<br> </blockquote> <br></span> Please be careful when pointing back at old threads. This issue was about expired certs. I suspect you found it because of a similar error message, but the underlying cause is completely unrelated.<br> <br> You probably just need to add in the CA cert that issued the server certificate. I'd have thought that ipa-server-certinstall would enforce that but perhaps not.<span class=""><br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I have one more question. Is there a way to disable HTTPS completely on<br> the WebUI. I can add HTTPS on a load balancer in front of the UI to<br> handle SSL.<br> </blockquote> <br></span> It would be a rather terrible idea. You'd still have a lot of in-the-clear messaging between the IPA web server and the load balancer. I wouldn't recommend that there are real replay issues possible. You should re-encrypt, so terminate SSL at the load balancer and then open a new SSL session to IPA.<span class="HOEnZb"><font color="#888888"><br> <br> rob<br> <br> </font></span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""> <br> <br> <br> On 18 June 2015 at 19:03, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a><br></span><span class=""> <mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>> wrote:<br> <br> Prashant Bapat wrote:<br> <br> Hi All,<br> <br> There is a way to change the certificate for the web UI.<br> <br> I went with a standard install with a self signed CA etc. Now I<br> want to<br> install a cert from a commercial CA. I don't mind using the IPA<br> CA certs<br> for the 389 DS, just want to change the cert for the UI.<br> <br> Any pointers on how to do this ?<br> <br> <br> <a href="http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP" rel="noreferrer" target="_blank">http://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP</a><br> <br> <br> </span></blockquote> <br> </blockquote></div><br></div>