<div dir="ltr"><div><br></div><div class="gmail_extra"><div class="gmail_quote">2016-02-11 1:34 GMT+01:00 Fraser Tweedale <span dir="ltr"><<a href="mailto:ftweedal@redhat.com" target="_blank">ftweedal@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div class=""><div class="h5">On Sun, Feb 07, 2016 at 12:05:19PM +0100, John Obaterspok wrote:<br> > 2016-02-06 23:29 GMT+01:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>:<br> ><br> > > John Obaterspok wrote:<br> > ><br> > >> Hi,<br> > >><br> > >> I have a ipa.my.lan and a cname gitserver.my.lan pointing to ipa.my.lan<br> > >><br> > >> I recently started to get nss error "SSL peer has no certificate for the<br> > >> requested DNS name." when I'm accesing my <a href="https://gitserver.my.lan" rel="noreferrer" target="_blank">https://gitserver.my.lan</a><br> > >><br> > >> Previously this worked fine if I had set "git config --global<br> > >> http.sslVerify false" according to<br> > >> <a href="https://www.redhat.com/archives/freeipa-users/2015-November/msg00213.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2015-November/msg00213.html</a><br> > >><br> > >> Now I tried to solve this by adding a SubjectAltName to the<br> > >> HTTP/ipa.my.lan certitficate like this:<br> > >><br> > >> status: MONITORING<br> > >> stuck: no<br> > >> key pair storage:<br> > >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS<br> > >> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'<br> > >> certificate:<br> > >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS<br> > >> Certificate DB'<br> > >> CA: IPA<br> > >> issuer: CN=Certificate Authority,O=MY.LAN<br> > >> subject: CN=ipa.my.lan,O=MY.LAN<br> > >> expires: 2018-02-06 19:24:52 UTC<br> > >> dns: gitserver.my.lan,ipa.my.lan<br> > >> principal name: http/ipa.my.lan@MY.LAN<br> > >> key usage:<br> > >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment<br> > >> eku: id-kp-serverAuth,id-kp-clientAuth<br> > >> pre-save command:<br> > >> post-save command: /usr/lib64/ipa/certmonger/restart_httpd<br> > >> track: yes<br> > >> auto-renew: yes<br> > >><br> > >> But I still get the below error:<br> > >><br> > >> * NSS error -12182 (SSL_ERROR_UNRECOGNIZED_NAME_ALERT)<br> > >> * SSL peer has no certificate for the requested DNS name<br> > >><br> > ><br> > > What version of mod_nss? It recently added support for SNI. You can try<br> > > turning it off by adding NSSSNI off to /etc/httpd/conf.d/nss.conf but I'd<br> > > imagine you were already relying on it.<br> > ><br> > ><br> > Hi,<br> ><br> > Turning it off didn't help<br> ><br> > I'm on F23 with latest updates so I have mod_nss-1.0.12-1<br> > I noticed it worked if I set "ServerName gitserver.my.lan" in<br> > gitserver.conf, but then I got the NAME ALERT when accessing ipa.my.lan.<br> ><br> > I then tried to put ipa.conf in <VirtualHost *:443> but then I got error<br> > about SSL_ERROR_RX_RECORD_TOO_LONG<br> ><br> > gitserver.conf has this:<br> ><br> > <VirtualHost *:443><br> > DocumentRoot /opt/wwwgit<br> > SetEnv GIT_PROJECT_ROOT /opt/wwwgit<br> > SetEnv GIT_HTTP_EXPORT_ALL<br> > SetEnv REMOTE_USER $REDIRECT_REMOTE_USER<br> > ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/<br> ><br> > ServerName gitserver.my.lan<br> ><br> > <Directory "/usr/libexec/git-core"><br> > Options Indexes<br> > AllowOverride None<br> > Require all granted<br> > </Directory><br> ><br> > <Directory "/opt/wwwgit"><br> > Options Indexes<br> > AllowOverride None<br> > Require all granted<br> > </Directory><br> ><br> > <LocationMatch "/git/"><br> > #SSLRequireSSL<br> > AuthType Kerberos<br> > AuthName "Kerberos Login"<br> > KrbAuthRealm MY.LAN<br> > Krb5KeyTab /etc/httpd/conf/ipa.keytab<br> > KrbMethodNegotiate on<br> > KrbMethodK5Passwd off # Set to on to query for pwd if negotiation<br> > failed due to no ticket available<br> > KrbSaveCredentials on<br> > KrbVerifyKDC on<br> > KrbServiceName HTTP/ipa.my.lan@MY.LAN<br> ><br> > AuthLDAPUrl ldaps://ipa.my.lan/dc=my,dc=lan?krbPrincipalName<br> > AuthLDAPBindDN "uid=httpbind,cn=sysaccounts,cn=etc,dc=my,dc=lan"<br> > AuthLDAPBindPassword "secret123abc"<br> > Require ldap-group cn=ipausers,cn=groups,cn=accounts,dc=my,dc=lan<br> > </LocationMatch><br> ><br> > </VirtualHost><br> ><br> ><br> > Any more ideas what I do wrong?<br> <br> </div></div>It was suggested that this may be due to the certificate not being<br> compliant with RFC 2818. This is likely true, but I think it is not<br> likely to be the problem. You can use `openssl s_client` to confirm<br> what certificate the server is sending:<br> <br> openssl s_client -showcerts \<br> -servername gitserver.my.lan -connect gitserver.my.lan:443<br> <br> This will dump the certificates (in PEM format), which you can copy<br> to a file examine with `opeenssl x509 -text < cert.pem`.<br> <br> Feel free to reply with the output; I am happy to have a closer<br> look.<br> <br></blockquote><div> </div></div></div><div class="gmail_extra">Hi Fraser,<div><br></div><div>*cough*, I didn't see this until now :)</div><div><br></div><div>Anyway, </div><div><br></div><div><div>[admin@ipa ~]$ openssl s_client -showcerts -servername gitserver.my.lan -connect gitserver.my.lan:443</div><div>CONNECTED(00000003)</div><div>140404557162360:error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 unrecognized name:s23_clnt.c:769:</div><div>---</div><div>no peer certificate available</div><div>---</div><div>No client certificate CA names sent</div><div>---</div><div>SSL handshake has read 7 bytes and written 227 bytes</div><div>---</div><div>New, (NONE), Cipher is (NONE)</div><div>Secure Renegotiation IS NOT supported</div><div>Compression: NONE</div><div>Expansion: NONE</div><div>No ALPN negotiated</div><div>SSL-Session:</div><div> Protocol : TLSv1.2</div><div> Cipher : 0000</div><div> Session-ID:</div><div> Session-ID-ctx:</div><div> Master-Key:</div><div> Key-Arg : None</div><div> Krb5 Principal: None</div><div> PSK identity: None</div><div> PSK identity hint: None</div><div> Start Time: 1461568003</div><div> Timeout : 300 (sec)</div><div> Verify return code: 0 (ok)</div><div>---</div></div><div><br></div><div><br></div><div><div>[root@ipa ~]# ipa-getcert list</div><div>Number of certificates and requests being tracked: 8.</div><div>Request ID '20160206184156':</div><div> status: MONITORING</div><div> stuck: no</div><div> key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-MY-LAN',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-MY-LAN/pwdfile.txt'</div><div> certificate: type=NSSDB,location='/etc/dirsrv/slapd-MY-LAN',nickname='Server-Cert',token='NSS Certificate DB'</div><div> CA: IPA</div><div> issuer: CN=Certificate Authority,O=my.lan</div><div> subject: CN=ipa.my.lan,O=my.lan</div><div> expires: 2017-12-23 22:50:30 UTC</div><div> principal name: ldap/ipa.my.lan@my.lan</div><div> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment</div><div> eku: id-kp-serverAuth,id-kp-clientAuth</div><div> pre-save command:</div><div> post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv MY-LAN</div><div> track: yes</div><div> auto-renew: yes</div><div>Request ID '20160206192447':</div><div> status: MONITORING</div><div> stuck: no</div><div> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'</div><div> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'</div><div> CA: IPA</div><div> issuer: CN=Certificate Authority,O=my.lan</div><div> subject: CN=ipa.my.lan,O=my.lan</div><div> expires: 2018-02-06 19:24:52 UTC</div><div> <b>dns: gitserver.my.lan,ipa.my.lan</b></div><div> principal name: http/ipa.my.lan@my.lan</div><div> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment</div><div> eku: id-kp-serverAuth,id-kp-clientAuth</div><div> pre-save command:</div><div> post-save command: /usr/lib64/ipa/certmonger/restart_httpd</div><div> track: yes</div><div> auto-renew: yes</div></div><div><br></div><div><br></div><div>Any ideas?</div><div><br></div><div>-- john</div><div><br></div></div><div class="gmail_extra"><br></div></div>