<div dir="ltr"><div>I think I already input all ca cert and server cert</div><div> </div><div> </div><div>certutil -d /etc/dirsrv/slapd-PKI-IPA/ -L Trust Attributes SSL,S/MIME,JAR/XPI</div><div>*.<a href="http://wisers.com">wisers.com</a> < it is the server wild card cert already EXT-CA CT,C,C <is the combo cert CA <a href="http://ABC.COM">ABC.COM</a> IPA CA CT,,C Server-Cert u,u,u </div><div> </div><div> </div><div>When I make replica it comes out error form master server <a href="http://central.ABC.com">central.ABC.com</a> ..any I missing? </div><div> </div><div>Creating SSL certificate for the dogtag Directory Server ipa : ERROR cert validation failed for "CN=central.ABC ROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired.) preparation of replica failed: cannot connect to '<a href="https://central.ABC9444/ca/ee/ca/profileSubmitSSLClient">https://central.ABC9444/ca/ee/ca/profileSubmitSSLClient</a>': (SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired. cannot connect to '<a href="https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient">https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient</a>': (SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired. File "/usr/sbin/ipa-replica-prepare", line 490, in <module> </div><div> </div><div> </div><div> </div><div> </div></div><div class="gmail_extra"> <div class="gmail_quote">2017-03-07 21:51 GMT+08:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><a href="mailto:barrykfl@gmail.com">barrykfl@gmail.com</a> wrote: > same as as replica gpg making.////...Found this cert 2015 expired > only,,? but I follow manual here: > > <a href="https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP#Procedure_in_IPA_.3C_4.1" target="_blank" rel="noreferrer">https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP#Procedure_in_IPA_.3C_4.1</a> > <<a href="https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP#Procedure_in_IPA_.3C_4.1" target="_blank" rel="noreferrer">https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP#Procedure_in_IPA_.3C_4.1</a>> If you are using 3rd party certs elsewhere then why not provide 3rd party certs for this replica as well? It seems like you aren't using the IPA-provided CA at all given its certs expired in 2015. rob > > It imported as EXT-CA as Alias rather than sever cert by default...Is > there anywhere pointing wrong ? > > Certificate Nickname Trust > Attributes > > SSL,S/MIME,JAR/XPI > *.ABC.com ,, > EXT-CA CT,C,C > <a href="http://ABC.COM" target="_blank" rel="noreferrer">ABC.COM</a> <<a href="http://ABC.COM" target="_blank" rel="noreferrer">http://ABC.COM</a>> IPA > CA CT,,C > Server-Cert u,u,u > > > Request ID '20160516111257': > status: CA_UNREACHABLE > ca-error: Server at <a href="https://central.ABC.com/ipa/xml" target="_blank" rel="noreferrer">https://central.ABC.com/ipa/xml</a> failed > request, will retry: 907 (RPC failed at server. cannot connect to > '<a href="https://central.ABC.com:443/ca/agent/ca/displayBySerial" target="_blank" rel="noreferrer">https://central.ABC.com:443/ca/agent/ca/displayBySerial</a>': > (SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is not recognized.). > stuck: no > key pair storage: > type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS > Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA/pwdfile.txt' > certificate: > type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS > Certificate DB' > CA: IPA > issuer: CN=Certificate Authority,O=<a href="http://ABC.COM" target="_blank" rel="noreferrer">ABC.COM</a> <<a href="http://ABC.COM" target="_blank" rel="noreferrer">http://ABC.COM</a>> > subject: CN=<a href="http://central.ABC.com" target="_blank" rel="noreferrer">central.ABC.com</a> <<a href="http://central.ABC.com" target="_blank" rel="noreferrer">http://central.ABC.com</a>>,O=<a href="http://ABC.COM" target="_blank" rel="noreferrer">ABC.COM</a> > <<a href="http://ABC.COM" target="_blank" rel="noreferrer">http://ABC.COM</a>> > expires: 2015-11-23 08:42:52 UTC > key usage: > digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: > post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv PKI-IPA > track: yes > auto-renew: yes > > 2017-03-07 19:24 GMT+08:00 Barry <<a href="mailto:kliu@alumni.warwick.ac.uk">kliu@alumni.warwick.ac.uk</a> > <mailto:<a href="mailto:kliu@alumni.warwick.ac.uk">kliu@alumni.warwick.ac.uk</a>>>: > > Same as before I already follow part < 4.1 as below: > > <a href="https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP#Procedure_in_IPA_.3C_4.1" target="_blank" rel="noreferrer">https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP#Procedure_in_IPA_.3C_4.1</a> > <<a href="https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP#Procedure_in_IPA_.3C_4.1" target="_blank" rel="noreferrer">https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP#Procedure_in_IPA_.3C_4.1</a>> > comdo cert is new cert / > It seem I m nearly right ....HTTP server side can read trust cert > BUT seem dirsrv still lacking of a ca cert to verify it ./.. > but ca.crt changed to new already and imported > > ABC-COM...[07/Mar/2017:19:17:22 +0800] - SSL alert: > CERT_VerifyCertificateNow: verify certificate failed for cert > *.ABC.com - COMODO CA Limited of family > cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error > -8179 - Peer's Certificate issuer is not recognized.) > > > 2017-03-07 17:16 GMT+08:00 Florence Blanc-Renaud <<a href="mailto:flo@redhat.com">flo@redhat.com</a> > <mailto:<a href="mailto:flo@redhat.com">flo@redhat.com</a>>>: > > Hi, > > In IPA < 4.5, ipa-replica-prepare was using /etc/ipa/ca.crt as > Certificate Authority, and this file may be outdated. Running > ipa-certupdate may fix your issue. See [1] > > If it doesn't, you can start by identifying which certificate > expired with > $ sudo getcert list | egrep -e 'expires|Request ID|subject' > > HTH, > Flo > > [1] <a href="https://pagure.io/freeipa/issue/6375" target="_blank" rel="noreferrer">https://pagure.io/freeipa/issue/6375</a> > <<a href="https://pagure.io/freeipa/issue/6375" target="_blank" rel="noreferrer">https://pagure.io/freeipa/issue/6375</a>> > > On 03/07/2017 04:14 AM, <a href="mailto:barrykfl@gmail.com">barrykfl@gmail.com</a> > <mailto:<a href="mailto:barrykfl@gmail.com">barrykfl@gmail.com</a>> wrote: > > gpg > > Creating SSL certificate for the Directory Server > ipa : ERROR cert validation failed for > "CN=<a href="http://central.ABC.com" target="_blank" rel="noreferrer">central.ABC.com</a> <<a href="http://central.ABC.com" target="_blank" rel="noreferrer">http://central.ABC.com</a>> > <<a href="http://central.ABC.com" target="_blank" rel="noreferrer">http://central.ABC.com</a>>,O=<a href="http://ABC.COM" target="_blank" rel="noreferrer">ABC.COM</a> <<a href="http://ABC.COM" target="_blank" rel="noreferrer">http://ABC.COM</a>> > <<a href="http://ABC.COM" target="_blank" rel="noreferrer">http://ABC.COM</a>>" > ((SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has > expired.) > preparation of replica failed: cannot connect to > '<a href="https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient" target="_blank" rel="noreferrer">https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient</a> <<a href="https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient" target="_blank" rel="noreferrer">https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient</a>>': > (SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired. > cannot connect to > '<a href="https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient" target="_blank" rel="noreferrer">https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient</a> <<a href="https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient" target="_blank" rel="noreferrer">https://central.ABC.com:9444/ca/ee/ca/profileSubmitSSLClient</a>>': <div class="HOEnZb"><div class="h5">> (SEC_ERROR_EXPIRED_CERTIFICATE) Peer's Certificate has expired. > File "/usr/sbin/ipa-replica-prepare", line 490, in <module> > main() > > File "/usr/sbin/ipa-replica-prepare", line 361, in main > export_certdb(api.env.realm, ds_dir, dir, passwd_fname, > "dscert", > replica_fqdn, subject_base) > > File "/usr/sbin/ipa-replica-prepare", line 150, in > export_certdb > raise e > > > > > > > > </div></div></blockquote></div> </div>