<div dir="ltr"><div><div><div>Yes, you're right, I was also surprised by the subject of the error.<br>I made changes in the /etc/httpd/conf.d/nss.conf file.<br></div>I changed <br>Listen 443 to Listen 8443<br></div>and <br><VirtualHost _default_:443> to <VirtualHost _default_:8443><br></div>as it was in the /etc/httpd/conf.d/nss.conf file before the update.</div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 3, 2016 at 3:30 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">seli irithyl wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
# getcert list<br>
returns 9 request ID. All 9 are in status "MONITORING" and expire after<br>
2017.<br>
So no expired certificate.<br>
<br>
Number of certificates and requests being tracked: 9.<br>
</blockquote></span>
[snip]<span class=""><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Request ID '20150313092456':<br>
status: MONITORING<br>
stuck: no<br>
key pair storage:<br>
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS<br>
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'<br>
certificate:<br>
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS<br>
Certificate DB'<br>
CA: IPA<br>
issuer: CN=Certificate Authority,O=BIOINF.LOCAL<br>
subject: CN=lead.bioinf.local,O=BIOINF.LOCAL<br>
expires: 2017-03-13 09:24:56 UTC<br>
key usage:<br>
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment<br>
eku: id-kp-serverAuth,id-kp-clientAuth<br>
pre-save command:<br>
post-save command: /usr/lib64/ipa/certmonger/restart_httpd<br>
track: yes<br>
auto-renew: yes<br>
</blockquote>
<br></span>
[ more snip ]<span class=""><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
> Unfortunately when trying to run any ipa command:<br>
> [root@lead ~]# ipa service-find lead.bioinf.local<br>
> ipa: ERROR: cert validation failed for<br>
> "E=root@lead.bioinf.local,CN=lead.bioinf.local,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--"<br>
> ((SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.)<br>
> ipa: ERROR: cannot connect to '<a href="https://lead.bioinf.local/ipa/json" rel="noreferrer" target="_blank">https://lead.bioinf.local/ipa/json</a>':<br>
> (SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.<br>
</blockquote>
<br></span>
Note that the subject of the certmonger-tracked certificate is different from the subject reported in the error. This looks like a default mod_ssl-generated certificate to me. Did you tweak your Apache config?<span class="HOEnZb"><font color="#888888"><br>
<br>
rob<br>
</font></span></blockquote></div><br></div>