[Freeipa-users] CA Certificate didn't automatically transfer to replica(s)

Discussion:

Dewangga Bachrul Alam

2017-04-22 08:41:03 UTC

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello!

Just update, manually add external CA(s) and signed certificated was
successful, but why it's didn't automatically transferred to
replica(s) from master.

Hello!
I've successfully create replica, everything works fine but why my
signed CA certificate didn't automatically transfer to another
replica(s)? Is it normal?
Trying to add manually, but the certificate in replica(s) still
using self-signed. Here's the output from `ipa-certupdate -v`
https://paste.fedoraproject.org/paste/U53pyXUa7Z34kLfiKh1QKV5M1UNdIGYh

yR
LivL9gydE=

DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n IPA CA -a
ipa: DEBUG: Process finished, return code=255 ipa: DEBUG: stdout=
PR_FILE_NOT_FOUND_ERROR: File not found
args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n External CA cert -a
ipa: DEBUG: Process finished, return code=255 ipa: DEBUG: stdout=
ipa: DEBUG: stderr=certutil: Could not find cert: External CA cert
: PR_FILE_NOT_FOUND_ERROR: File not found
FYI: The replica server previously was a client and promoted to be
a replica by hitting this command: `ipa-replica-install
--principal admin --admin-password admin_password`
Any hints?

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Florence Blanc-Renaud

2017-04-25 07:52:27 UTC

Permalink

Hi,

As your email refers to self-signed and signed CA certificate, can you
please clarify the exact steps that you followed? It looks like
- you first installed FreeIPA with a self-signed CA
- you added an external CA (did you use ipa-cacert-manage install on 1
server then ipa-certupdate on all replicas?)
- you replaced the httpd/LDAP certificates with a cert signed from the
external CA (you probably ran ipa-server-certinstall on one server).

In this case it is normal that the httpd/LDAP certificates on the
replica were not updated as they are different (each IPA server has his
own httpd/LDAP cert which contains the hostname in its subject). You can
check this by performing on each server:
ipaserver$ sudo certutil -d /etc/httpd/alias/ -L -n Server-Cert | grep
Subject:
Subject: "CN=ipaserver.domain.com,O=DOMAIN.COM"
^^^^^^^^^

If the goal is to replace the httpd/LDAP certificates on the replica,
the command ipa-server-certinstall must also be run on the replica with
the appropriate certificate.

HTH,
Flo.

Post by Dewangga Bachrul Alam
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hello!
Just update, manually add external CA(s) and signed certificated was
successful, but why it's didn't automatically transferred to
replica(s) from master.

Post by Dewangga Bachrul Alam
Hello!
I've successfully create replica, everything works fine but why my
signed CA certificate didn't automatically transfer to another
replica(s)? Is it normal?
Trying to add manually, but the certificate in replica(s) still
using self-signed. Here's the output from `ipa-certupdate -v`
https://paste.fedoraproject.org/paste/U53pyXUa7Z34kLfiKh1QKV5M1UNdIGYh

yR
LivL9gydE=

Post by Dewangga Bachrul Alam
DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n IPA CA -a
ipa: DEBUG: Process finished, return code=255 ipa: DEBUG: stdout=
PR_FILE_NOT_FOUND_ERROR: File not found
args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n External CA cert -a
ipa: DEBUG: Process finished, return code=255 ipa: DEBUG: stdout=
ipa: DEBUG: stderr=certutil: Could not find cert: External CA cert
: PR_FILE_NOT_FOUND_ERROR: File not found
FYI: The replica server previously was a client and promoted to be
a replica by hitting this command: `ipa-replica-install
--principal admin --admin-password admin_password`
Any hints?

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Dewangga Bachrul Alam

2017-04-25 08:56:39 UTC

Permalink

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello!

Master IPA Server:
- - I install 1 (one) server as master (self-signed) and add/modify
using external CA.
- - I am using ipa-cacert-manage install then ipa-certupdate on master

Replica IPA Server:
- - I install 1 (one) server as client and promoted to ipa-replica:
- I run `ipa-client-install` and autodiscovery
- Then `ipa-replica-install --principal admin --admin-password
<password>`

I've hit ipa-certupdate -v to verbose the logs (attached at first
email). Then replica server aren't using external CA(s) like master did.

So, I did the same like master, using `ipa-cacert-manage` on replica,
and it's work fine. If it's normal, then thanks for clarifying this.

Post by Florence Blanc-Renaud
Hi,
As your email refers to self-signed and signed CA certificate, can
you please clarify the exact steps that you followed? It looks
like - you first installed FreeIPA with a self-signed CA - you
added an external CA (did you use ipa-cacert-manage install on 1
server then ipa-certupdate on all replicas?) - you replaced the
httpd/LDAP certificates with a cert signed from the external CA
(you probably ran ipa-server-certinstall on one server).
In this case it is normal that the httpd/LDAP certificates on the
replica were not updated as they are different (each IPA server has
his own httpd/LDAP cert which contains the hostname in its
ipaserver$ sudo certutil -d /etc/httpd/alias/ -L -n Server-Cert |
grep Subject: Subject: "CN=ipaserver.domain.com,O=DOMAIN.COM"
^^^^^^^^^
If the goal is to replace the httpd/LDAP certificates on the
replica, the command ipa-server-certinstall must also be run on the
replica with the appropriate certificate.
HTH, Flo.
On 04/22/2017 10:41 AM, Dewangga Bachrul Alam wrote: Hello!
Just update, manually add external CA(s) and signed certificated
was successful, but why it's didn't automatically transferred to
replica(s) from master.

Post by Dewangga Bachrul Alam
Hello!
I've successfully create replica, everything works fine but
why my signed CA certificate didn't automatically transfer to
another replica(s)? Is it normal?
Trying to add manually, but the certificate in replica(s)
still using self-signed. Here's the output from
`ipa-certupdate -v`
https://paste.fedoraproject.org/paste/U53pyXUa7Z34kLfiKh1QKV5M1UNdI

GYh
yR

Post by Florence Blanc-Renaud
LivL9gydE=

Post by Dewangga Bachrul Alam
ipa: DEBUG: stderr= ipa: DEBUG: Starting external process
ipa: DEBUG: args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n
DEBUG: stdout= ipa: DEBUG: stderr=certutil: Could not find
cert: IPA CA : PR_FILE_NOT_FOUND_ERROR: File not found
args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n External CA
DEBUG: stdout= ipa: DEBUG: stderr=certutil: Could not find
cert: External CA cert : PR_FILE_NOT_FOUND_ERROR: File not
found
FYI: The replica server previously was a client and promoted
`ipa-replica-install --principal admin --admin-password
admin_password`
Any hints?

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Florence Blanc-Renaud

2017-04-26 13:08:55 UTC

Permalink

Post by Dewangga Bachrul Alam
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hello!
- - I install 1 (one) server as master (self-signed) and add/modify
using external CA.
- - I am using ipa-cacert-manage install then ipa-certupdate on master

Hi,

I think I got you wrong...
Do you mean that you installed IPA with an integrated IdM CA which was
self-signed, then your intent was to move to integrated IdM CA
externally signed? In this case, the right command would be
ipa-cacert-manage renew --external-ca, and the procedure is described in
"Changing the certificate chain" [1].

The command ipa-cacert-manage install does not replace the integrated
IdM CA but adds the certificate as a known CA.

Hope this clarifies,
Flo

[1]
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/change-cert-chaining.html

Post by Dewangga Bachrul Alam
- I run `ipa-client-install` and autodiscovery
- Then `ipa-replica-install --principal admin --admin-password
<password>`
I've hit ipa-certupdate -v to verbose the logs (attached at first
email). Then replica server aren't using external CA(s) like master did.
So, I did the same like master, using `ipa-cacert-manage` on replica,
and it's work fine. If it's normal, then thanks for clarifying this.

Post by Dewangga Bachrul Alam
Hello!
I've successfully create replica, everything works fine but
why my signed CA certificate didn't automatically transfer to
another replica(s)? Is it normal?
Trying to add manually, but the certificate in replica(s)
still using self-signed. Here's the output from
`ipa-certupdate -v`
https://paste.fedoraproject.org/paste/U53pyXUa7Z34kLfiKh1QKV5M1UNdI

GYh
yR

Post by Florence Blanc-Renaud
LivL9gydE=

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Dewangga Bachrul Alam

2017-04-28 01:50:27 UTC

Permalink

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello!

On 04/25/2017 10:56 AM, Dewangga Bachrul Alam wrote: Hello!
Master IPA Server: - I install 1 (one) server as master
(self-signed) and add/modify using external CA. - I am using
ipa-cacert-manage install then ipa-certupdate on master

Ah thanks for your corrections and information, then what should I do?
Should I run ipa-cacert-manage renew --external-ca ?

The command ipa-cacert-manage install does not replace the
integrated IdM CA but adds the certificate as a known CA.
Hope this clarifies, Flo
[1]
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linu

x/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/change-ce
rt-chaining.html

Replica IPA Server: - I install 1 (one) server as client and
promoted to ipa-replica: - I run `ipa-client-install` and
autodiscovery - Then `ipa-replica-install --principal admin
--admin-password <password>`
I've hit ipa-certupdate -v to verbose the logs (attached at first
email). Then replica server aren't using external CA(s) like master did.
So, I did the same like master, using `ipa-cacert-manage` on
replica, and it's work fine. If it's normal, then thanks for
clarifying this.

Post by Florence Blanc-Renaud
Hi,
As your email refers to self-signed and signed CA
certificate, can you please clarify the exact steps that you
followed? It looks like - you first installed FreeIPA with a
self-signed CA - you added an external CA (did you use
ipa-cacert-manage install on 1 server then ipa-certupdate on
all replicas?) - you replaced the httpd/LDAP certificates
with a cert signed from the external CA (you probably ran
ipa-server-certinstall on one server).
In this case it is normal that the httpd/LDAP certificates on
the replica were not updated as they are different (each IPA
server has his own httpd/LDAP cert which contains the
hostname in its subject). You can check this by performing on
each server: ipaserver$ sudo certutil -d /etc/httpd/alias/ -L
"CN=ipaserver.domain.com,O=DOMAIN.COM" ^^^^^^^^^
If the goal is to replace the httpd/LDAP certificates on the
replica, the command ipa-server-certinstall must also be run
on the replica with the appropriate certificate.
HTH, Flo.
On 04/22/2017 10:41 AM, Dewangga Bachrul Alam wrote: Hello!
Just update, manually add external CA(s) and signed
certificated was successful, but why it's didn't
automatically transferred to replica(s) from master.

Post by Dewangga Bachrul Alam
Hello!
I've successfully create replica, everything works fine
but why my signed CA certificate didn't automatically
transfer to another replica(s)? Is it normal?
Trying to add manually, but the certificate in
replica(s) still using self-signed. Here's the output
from `ipa-certupdate -v`
https://paste.fedoraproject.org/paste/U53pyXUa7Z34kLfiKh1QKV5M1U

NdI
GYh

Post by Florence Blanc-Renaud
LivL9gydE=

Post by Dewangga Bachrul Alam
ipa: DEBUG: stderr= ipa: DEBUG: Starting external
process ipa: DEBUG: args=/usr/bin/certutil -d
/etc/ipa/nssdb -L -n IPA CA -a ipa: DEBUG: Process
PR_FILE_NOT_FOUND_ERROR: File not found
args=/usr/bin/certutil -d /etc/ipa/nssdb -L -n External
CA cert -a ipa: DEBUG: Process finished, return
stderr=certutil: Could not find cert: External CA cert
: PR_FILE_NOT_FOUND_ERROR: File not found
FYI: The replica server previously was a client and
`ipa-replica-install --principal admin
--admin-password admin_password`
Any hints?

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Florence Blanc-Renaud

2017-04-28 07:16:54 UTC

Permalink

Post by Dewangga Bachrul Alam
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hello!

Ah thanks for your corrections and information, then what should I do?
Should I run ipa-cacert-manage renew --external-ca ?

Yes, this is the way to go, documented here [1]. This is a 2-step
process: when the command is run, it will create a CSR that needs to be
signed by an external CA. Then the command must be re-launched with the
new certificate delivered by the CA.

Also do not forget to run ipa-certupdate on the master and all the
replicas/clients.

Flo.

[1]
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/cert-renewal.html#manual-cert-renewal-ext

Post by Dewangga Bachrul Alam

x/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/change-ce
rt-chaining.html

Post by Florence Blanc-Renaud
Hi,
As your email refers to self-signed and signed CA
certificate, can you please clarify the exact steps that you
followed? It looks like - you first installed FreeIPA with a
self-signed CA - you added an external CA (did you use
ipa-cacert-manage install on 1 server then ipa-certupdate on
all replicas?) - you replaced the httpd/LDAP certificates
with a cert signed from the external CA (you probably ran
ipa-server-certinstall on one server).
In this case it is normal that the httpd/LDAP certificates on
the replica were not updated as they are different (each IPA
server has his own httpd/LDAP cert which contains the
hostname in its subject). You can check this by performing on
each server: ipaserver$ sudo certutil -d /etc/httpd/alias/ -L
"CN=ipaserver.domain.com,O=DOMAIN.COM" ^^^^^^^^^
If the goal is to replace the httpd/LDAP certificates on the
replica, the command ipa-server-certinstall must also be run
on the replica with the appropriate certificate.
HTH, Flo.
On 04/22/2017 10:41 AM, Dewangga Bachrul Alam wrote: Hello!
Just update, manually add external CA(s) and signed
certificated was successful, but why it's didn't
automatically transferred to replica(s) from master.

Post by Dewangga Bachrul Alam
Hello!
I've successfully create replica, everything works fine
but why my signed CA certificate didn't automatically
transfer to another replica(s)? Is it normal?
Trying to add manually, but the certificate in
replica(s) still using self-signed. Here's the output
from `ipa-certupdate -v`
https://paste.fedoraproject.org/paste/U53pyXUa7Z34kLfiKh1QKV5M1U

NdI
GYh

Post by Florence Blanc-Renaud
LivL9gydE=

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project