<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000"><div><b>De: </b>"Bertrand Rétif" <bretif@phosphore.eu><br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>À: </b>freeipa-users@redhat.com<br><b>Envoyé: </b>Mercredi 19 Octobre 2016 15:42:07<br><b>Objet: </b>Re: [Freeipa-users] Impossible to renew certificate. pki-tomcat issue<br><div><br></div><div style="font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000"><div><span></span><br></div><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>De: </b>"Rob Crittenden" <rcritten@redhat.com><br><b>À: </b>"Bertrand Rétif" <bretif@phosphore.eu>, freeipa-users@redhat.com<br><b>Envoyé: </b>Mercredi 19 Octobre 2016 15:30:14<br><b>Objet: </b>Re: [Freeipa-users] Impossible to renew certificate. pki-tomcat issue<br><div><br></div>Bertrand Rétif wrote:<br>>> De: "Martin Babinsky" <mbabinsk@redhat.com><br>>> À: freeipa-users@redhat.com<br>>> Envoyé: Mercredi 19 Octobre 2016 08:45:49<br>>> Objet: Re: [Freeipa-users] Impossible to renew certificate. pki-tomcat issue<br>><br>>> On 10/18/2016 11:22 PM, Bertrand Rétif wrote:<br>>>> Hello,<br>>>><br>>>> I had an issue with pki-tomcat.<br>>>> I had serveral certificate that was expired and pki-tomcat did not start<br>>>> anymore.<br>>>><br>>>> I set the dateon the server before certificate expiration and then<br>>>> pki-tomcat starts properly.<br>>>> Then I try to resubmit the certificate, but I get below error:<br>>>> "Profile caServerCert Not Found"<br>>>><br>>>> Do you have any idea how I could fix this issue.<br>>>><br>>>> Please find below output of commands:<br>>>><br>>>><br>>>> # getcert resubmit -i 20160108170324<br>>>><br>>>> # getcert list -i 20160108170324<br>>>> Number of certificates and requests being tracked: 7.<br>>>> Request ID '20160108170324':<br>>>> status: MONITORING<br>>>> ca-error: Server at<br>>>> "http://sdkipa01.a.skinfra.eu:8080/ca/ee/ca/profileSubmit" replied:<br>>>> Profile caServerCert Not Found<br>>>> stuck: no<br>>>> key pair storage:<br>>>> type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS<br>>>> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'<br>>>> certificate:<br>>>> type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS<br>>>> Certificate DB'<br>>>> CA: dogtag-ipa-ca-renew-agent<br>>>> issuer: CN=Certificate Authority,O=A.SKINFRA.EU<br>>>> subject: CN=IPA RA,O=A.SKINFRA.EU<br>>>> expires: 2016-06-28 15:25:11 UTC<br>>>> key usage:<br>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment<br>>>> eku: id-kp-serverAuth,id-kp-clientAuth<br>>>> pre-save command: /usr/lib64/ipa/certmonger/renew_ra_cert_pre<br>>>> post-save command: /usr/lib64/ipa/certmonger/renew_ra_cert<br>>>> track: yes<br>>>> auto-renew: yes<br>>>><br>>>><br>>>> Thanksby advance for your help.<br>>>> Bertrand<br>>>><br>>>><br>>>><br>>>><br>><br>>> Hi Betrand,<br>><br>>> what version of FreeIPA and Dogtag are you running?<br>><br>>> Also perform the following search on the IPA master and post the result:<br>><br>>> """<br>>> ldapsearch -D "cn=Directory Manager" -W -b<br>>> 'ou=certificateProfiles,ou=ca,o=ipaca' '(objectClass=certProfile)'<br>>> """<br>><br>> Hi Martin,<br>><br>> Thanks for your reply.<br>><br>> Here is version:<br>> - FreeIPA 4.2.0<br>> - Centos 7.2<br>><br>> I have been able to fix the issue with "Profile caServerCert Not Found" by editing /var/lib/pki/pki-tomcat/ca/conf/CS.cfg<br>> I replace below entry<br>> "subsystem.1.class=com.netscape.cmscore.profile.LDAPProfileSubsystem"<br>> by<br>> "subsystem.1.class=com.netscape.cmscore.profile.ProfileSubsystem"<br>><br>> and then launch "ipa-server-upgrade" command<br>> I found this solution in this post: http://osdir.com/ml/freeipa-users/2016-03/msg00280.html<br>><br>> Then I was able to renew my certificate.<br>><br>> However I reboot my server to and pki-tomcat do not start and provide with a new erreor in /var/log/pki/pki-tomcat/ca/debug<br>><br>> [19/Oct/2016:11:11:52][localhost-startStop-1]: CertUtils: verifySystemCertByNickname() passed: auditSigningCert cert-pki-ca<br>> [19/Oct/2016:11:11:52][localhost-startStop-1]: SignedAuditEventFactory: create() message=[AuditEvent=CIMC_CERT_VERIFICATION][SubjectID=$<br>> System$][Outcome=Success][CertNickName=auditSigningCert cert-pki-ca] CIMC certificate verification<br>><br>> java.lang.Exception: SystemCertsVerification: system certs verification failure<br>> at com.netscape.cms.selftests.common.SystemCertsVerification.runSelfTest(SystemCertsVerification.java:198)<br>> at com.netscape.cmscore.selftests.SelfTestSubsystem.runSelfTestsAtStartup(SelfTestSubsystem.java:861)<br>> at com.netscape.cmscore.selftests.SelfTestSubsystem.startup(SelfTestSubsystem.java:1797)<br>> at com.netscape.cmscore.apps.CMSEngine.startupSubsystems(CMSEngine.java:1701)<br>> at com.netscape.cmscore.apps.CMSEngine.startup(CMSEngine.java:1148)<br>> at com.netscape.certsrv.apps.CMS.startup(CMS.java:200)<br>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1602)<br>> at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114)<br>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)<br>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br>> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)<br>> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br>> at java.lang.reflect.Method.invoke(Method.java:606)<br>> at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277)<br>> at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274)<br>> at java.security.AccessController.doPrivileged(Native Method)<br>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:536)<br>> at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)<br>> at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169)<br>> at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:123)<br>> at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1272)<br>> at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1197)<br>> at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1087)<br>> at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5210)<br>> at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5493)<br>> at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)<br>> at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)<br>> at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)<br>> at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:156)<br>> at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:145)<br>> at java.security.AccessController.doPrivileged(Native Method)<br>> at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:875)<br>> at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:632)<br>> at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:672)<br>> at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1862)<br>> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)<br>> at java.util.concurrent.FutureTask.run(FutureTask.java:262)<br>> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)<br>> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)<br>> at java.lang.Thread.run(Thread.java:745)<br>> [19/Oct/2016:11:11:52][localhost-startStop-1]: SignedAuditEventFactory: create() message=[AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Failure] self tests execution (see selftests.log for details)<br>> [19/Oct/2016:11:11:52][localhost-startStop-1]: CMSEngine.shutdown()<br>><br>><br>> I am currently stuck here.<br>> Thanks a lot for your help.<br><div><br></div>I'm guessing at least one of the CA subsystem certificates are still <br>expired. Look at the "getcert list" output to see if there are any <br>expired certificates.<br><div><br></div>rob<br><div><br></div>><br>> Bertrand<br>><br>><br><div><br></div></blockquote><div>Hello Rob,<br></div><div><br></div><div>I check on my 2 servers and no certificate is expired<br></div><div><br></div><div>[root@sdkipa03 ~]# getcert list |grep expire<br> expires: 2018-06-22 22:02:26 UTC<br> expires: 2018-06-22 22:02:47 UTC<br> expires: 2034-07-09 15:24:34 UTC<br> expires: 2016-10-30 13:35:29 UTC<br><div><br></div></div><div>[root@sdkipa01 conf]# getcert list |grep expire<br> expires: 2018-06-12 23:38:01 UTC<br> expires: 2018-06-12 23:37:41 UTC<br> expires: 2018-06-11 22:53:57 UTC<br> expires: 2018-06-11 22:55:50 UTC<br> expires: 2018-06-11 22:57:47 UTC<br> expires: 2034-07-09 15:24:34 UTC<br> expires: 2018-06-11 22:59:55 UTC<br><div><br></div></div><div>I see that one certificate is in status: CA_UNREACHABLE, maybe I reboot to soon my server...<br><div><br></div></div><div>I continue to investigate<br></div><div><br></div><div>Thanks for your help.<br></div><div>Bertrand<br></div></div></blockquote><div>I fix my previous issue.<br></div><div>Now I have an issue with a server.<br></div><div>This server can not start pki-tomcatd, I get this error in debug file:<br></div><div>"Error netscape.ldap.LDAPExceptio n: IO Error creating JSS SSL Socket (-1)"<br></div><div><br></div><div>After investigation i see that I do not have "ipaCert" certificat in "/etc/httpd/alias"<br></div><div>cf below command:<br></div><div><br></div><div>[root@sdkipa03 ~]# getcert list -d /etc/httpd/alias <br>Number of certificates and requests being tracked: 4.<br>Request ID '20141110133632':<br> status: MONITORING<br> stuck: no<br> key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'<br> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'<br> CA: IPA<br> issuer: CN=Certificate Authority,O=A.SKINFRA.EU<br> subject: CN=sdkipa03.skinfra.eu,O=A.SKINFRA.EU<br> expires: 2018-06-22 22:02:47 UTC<br> principal name: HTTP/sdkipa03.skinfra.eu@A.SKINFRA.EU<br> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment<br> eku: id-kp-serverAuth,id-kp-clientAuth<br> pre-save command: <br> post-save command: /usr/lib64/ipa/certmonger/restart_httpd<br> track: yes<br> auto-renew: yes<br><br></div><div><br></div><div>How can I add the certificate to /etc/httpd/alias?<br></div><div><br></div><div>Thanks fo ryour support.<br></div><div>Regards<br></div><div>Bertrand<br></div><div><br></div></div></body></html>