Rob, thank you,you have been so helpful. This appears to have worked in my sandbox environment. I was able to get the new certs for the directory server and apache, stop tracking and remove the old Go Daddy certs, put my original CA certs in the correct locations and import into the databases, then configure the services to use them. I am going to move some clients into sandbox next week(we have rhel5, 6 and SOlaris)and see how they handle the new config before rolling out to prod environment and other ipa servers.
Thank you for everything.
--------------------------------------------
On Wed, 3/25/15, Rob Crittenden <***@redhat.com> wrote:
Subject: Re: [Freeipa-users] Fw: Need to replace cert for ipa servers
To: "sipazzo" <***@yahoo.com>, "freeipa-***@redhat.com" <freeipa-***@redhat.com>
Date: Wednesday, March 25, 2015, 2:43 PM
Post by sipazzoOk I finally was able to get a sandbox
environment up to test the cert
replacement. When I ran this stepgot to the cert request
Post by sipazzoipa-getcert request -d
/etc/dirsrv/slapd-IPADOMAIN-COM -n Server-Cert -p
/etc/dirsrv/slapd-IPADOMAIN-COM/pwdfile.txt -C
'/usr/lib64/ipa/certmonger/restart_dirsrv
IPADOMAIN-COM' -N
Post by sipazzoI got a message
saying the cert at same location is already used by
Post by sipazzorequest with nickname
"20140729215511" , same when I ran it for
Post by sipazzo/etc/httpd/alias. I continued on anyway
but when I get to this step:
You need to tell certmonger to stop tracking
the existing GoDaddy certs,
not that they
would have been renewable anyway.
You may also need to remove them from the NSS
database(s) using
something like:
# certutil -D -n
'nickname' -d /path/to/db
I think the subject will be different enough
that it may be ok as-is.
The other errors are due to the fact that no
certificate was issued.
rob
Post by sipazzo # certutil -V -u V -n Server-Cert -d
/etc/dirsrv/slapd-EXAMPLE-COM
certutil: could not find certificate named
"Server-Cert":
PR_FILE_NOT_FOUND_ERROR: File not found
Post by sipazzoAlthough running certutil -L -d
/etc/dirsrv/slapd-IPADOMAIN-COM/,
returns this:
Certificate Nickname
Trust
Attributes
Post by sipazzoSSL,S/MIME,JAR/XPI
GD_CA
CT,C,C
Post by sipazzoIPADOMAIN.COM IPA CA
CT,,
u,u,u
Post by sipazzoShowing that the IPA
Dogtag cert is now listed whereas it was not
------------------------------------------------------------------------
Post by sipazzo*Sent:* Friday, March 13, 2015 1:32 PM
*Subject:* Re: [Freeipa-users] Fw: Need to
replace cert for ipa servers
Post by sipazzoThis environment is over 350 servers, many
of which are in production so
have to wait a bit for change management approval to attempt
to
Post by sipazzoresolve this issue, particularly if
you think it might break something.
will keep you updated on my progress. Thank you much.
------------------------------------------------------------------------
Post by sipazzo*Sent:* Friday, March 13, 2015 9:21 AM
*Subject:* Re: [Freeipa-users] Fw: Need to
replace cert for ipa servers
Post by sipazzo-----Original Message-----
On Behalf Of Rob Crittenden
Thursday, March 12, 2015 1:52 PM
Post by sipazzoSubject: Re: [Freeipa-users] Fw: Need to
replace cert for ipa servers
do have other CAs (just not the master but it is available
offline
needed)
clear, all IPA servers are masters, some just run more
services
Post by sipazzothan others. It sounds like
you have at least one CA available which
Post by sipazzoshould be sufficient.
Directory server is running
The apache web server is running and I
can get to the gui ipa
works
the place to start is to get certs for Apache and 389-ds,
Post by sipazzothen we can see about using these new
certs.
thread you showed that the IPA 389-ds doesn't have a
Server-Cert
Post by sipazzonickname. You'll want
to do the same for /etc/httpd/alias before running
Post by sipazzothe following commands otherwise you could
end up with non-functional
Post by sipazzoserver.
These should get IPA
certs for 389-ds and Apache. You'll need to edit
Post by sipazzothese commands to match your
#
ipa-getcert request -d /etc/httpd/alias -n Server-Cert -p
Post by sipazzo/etc/httpd/alias/pwdfile.txt -C
/usr/lib64/ipa/certmonger/restart_httpd
request -d /etc/dirsrv/slapd-EXAMPLE-COM -n Server-Cert
-p
/etc/dirsrv/slapd-EXAMPLE-COM/pwdfile.txt -C
'/usr/lib64/ipa/certmonger/restart_dirsrv
EXAMPLE-COM' -N
Post by sipazzoCN=ipa.example.com
I'd do them one
at a time and wait until the cert is issued and tracked.
Post by sipazzoThis will restart both Apache and 389-ds
but it shouldn't affect
because the certs won't be used yet.
Post by sipazzoYou then need to get
the old CA cert and put it into the right places.
Post by sipazzoSince it is already in the PKI-IPA NSS
database let's fetch it from
For giggles you should probably save whatever the contents
of
Post by sipazzo/etc/ipa/ca.crt are before-hand.
# certutil -L -d
/etc/dirsrv/slapd-PKI-IPA -n 'IPADOMAIN.COM IPA CA'
-a
Post by sipazzo/etc/ipa/ca.crt
Now add that to the
# certutil -A -n 'IPADOMAIN.COM IPA
CA' -d /etc/httpd/alias -t CT,C, -a
-i /etc/ipa/ca.crt # certutil -A -n 'IPADOMAIN.COM IPA
CA' -d
/etc/dirsrv/slapd-EXAMPLE-COM -t CT,, -a -i
/etc/ipa/ca.crt
Next add it to /etc/pki/nssdb if it isn't already
-A -n 'IPA CA' -d /etc/pki/nssdb -t CT,C,C -a -i
/etc/ipa/ca.crt
Post by sipazzo# certutil -V -u V
-n Server-Cert -d /etc/httpd/alias # certutil -V -u V
Post by sipazzo-n Server-Cert -d
/etc/dirsrv/slapd-EXAMPLE-COM
certutil: certificate is valid
Post by sipazzoNext is to configure the services to use
the new certs. I'd stop IPA to
this: ipactl stop
Edit /etc/httpd/conf.d/nss.conf and change the NSSNickname
to Server-Cert
Edit /etc/dirsrv/slapd-EXAMPLE-COM/dse.ldif and set
nsSSLPersonalitySSL
Post by sipazzoto Server-Cert
Now try to start the
world: ipactl start
Post by sipazzo# ipa user-show admin
# ipa cert-show 1
Both should work.
Assuming all has gone well to this point,
copy /etc/ipa/ca.crt to
/usr/share/ipa/html/ca.crt
Post by sipazzoFinally run: ipa-ldap-updater --upgrade
This should load the
new CA certificate into LDAP.
Post by sipazzoThis has the potential to break a whole
bunch of your clients. It is
enough to just copy over the new CA cert to the right
Post by sipazzolocation(s) on the clients. The mechanics
of this depend on the OS.
Post by sipazzoAre the TLS errors due to the mismatch
in certs between slapd-PKI-CA
slapd-NETWORKFLEET-COM?
Post by sipazzoNo, has nothing to do with the CA at all.
The client doesn't have (or
the CA that issued the LDAP server cert.
Post by sipazzorob
-----Original
Message-----
On Behalf Of Rob Crittenden
Wednesday, March 11, 2015 7:20 PM
Post by sipazzoSubject: Re: [Freeipa-users] Need to
replace cert for ipa servers
Post by sipazzoThanks Rob, I apologize that error
was probably not helpful. This is
Post by sipazzowhat I see when running install in
Verifying that
ipa2-corp.networkfleet.com (realm EXAMPLE.COM) is an
Post by sipazzoIPA server Init LDAP connection
with:
ldap://ipa2-corp.networkfleet.com:389
Post by sipazzoLDAP Error: Connect error: TLS
error -8179:Peer's Certificate issuer
Post by sipazzois not recognized.
Verifying that
ipa1-xo.networkfleet.com (realm EXAMPLE.COM) is an IPA
ldap://ipa1-xo.networkfleet.com:389
Post by sipazzoLDAP Error: Connect error: TLS
error -8179:Peer's Certificate issuer
Post by sipazzois not recognized.
Verifying that
ipa1-io.networkfleet.com (realm EXAMPLE.COM) is an IPA
ldap://ipa1-io.networkfleet.com:389
Post by sipazzoLDAP Error: Connect error: TLS
error -8179:Peer's Certificate issuer
Post by sipazzois not recognized.
Verifying that
ipa2-io.networkfleet.com (realm EXAMPLE.COM) is an IPA
ldap://ipa2-io.networkfleet.com:389
Post by sipazzoLDAP Error: Connect error: TLS
error -8179:Peer's Certificate issuer
Post by sipazzois not recognized.
Verifying that
ipa2-xo.networkfleet.com (realm EXAMPLE.COM) is an IPA
ldap://ipa2-xo.networkfleet.com:389
Post by sipazzoLDAP Error: Connect error: TLS
error -8179:Peer's Certificate issuer
certificates are very confusing to me. I don't
understand how
working when we have a set of GoDaddy certs in
Post by sipazzoslapd-NETWORKFLEET-COM and a set
of the Dogtag certs in slapd-PKI-CA.
/usr/share/ipa/html/ca.crt looks like the original one
Post by sipazzoissued by the Dogtag cert system
and matches the ones on the clients.
Post by sipazzoNot to further confuse things but
the original master server that
signed all these certs was taken offline months ago due to
some
Post by sipazzoissues it was having. I do
still have access to it if necessary.
far as why the godaddy certs were swapped out for the Dogtag
certs
something as simple as the untrusted
Post by sipazzocertificate dialogue when
accessing the ipa gui. I did not swap out
Post by sipazzothe certs so am unsure of exactly
what happened. There is no real
need to use the GoDaddy certs as far as I am concerned. I
just want
the issues I am seeing as I am in kind of a bind
Post by sipazzowith the GoDaddy cert being
revoked and needing to be replaced and
Post by sipazzothe master Dogtag certificate
server offline. We have a mixed
environment with Rhel 5, 6 and Solaris clients so are not
using sssd
know this is asking a lot but appreciate any help you can
give.
is the current state of things? Does your IPA Apache server
work?
Post by sipazzoIs 389-ds up and running? Do
you have a working IPA CA?
Post by sipazzoDoes ipa cert-show 1 work?
If the answer
is yes to all then we should be able to generate new
Post by sipazzocerts for all the services.
rob
--
Manage
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org <http://freeipa.org/><http://freeipa.org/>for
more info on the
project
Post by sipazzo--
Manage your
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org <http://freeipa.org/>for more info on
the project
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project