May 2018 - FreeIPA-users - Fedora mailing-lists

Problems Creating a Replica
by Brian Weaver 08 May '18

08 May '18

I had issues with my old FreeIPA installation so I rebuilt using Fedora 28 and FreeIPA 4.6 from the COPR of @freeipa/freeipa-4-6. I managed successfully setup the server and import my DNS data. Now when I try to create a replica it is blowing up. When I run "ipa-replica-install --principal admin(a)IPA.${DOMAIN} -w 'uber-secret-password' -N" it's failing. I've tried Google, cleaned up the directory of the server entries, etc. I'm at an impass. Here is the error Done configuring Kerberos KDC (krb5kdc). Configuring kadmin [1/2]: starting kadmin [2/2]: configuring kadmin to start on boot Done configuring kadmin. Configuring directory server (dirsrv) [1/3]: configuring TLS for DS instance [error] RuntimeError: Certificate issuance failed (CA_REJECTED) Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. I was going to get the error from the log directory. I ran uninstall before I thought about it. Then when I try again it fails on "entry already exists". So when I run uninstall again I have to do 'ipa server-del ipa-server1.ipa.domain'. I'm having no luck and it fails at random places. For example after the last cleanup I got "Insufficient Access" with write privilege on cn=replication,cn=etc,dc=ipa,dc=$domain' Any help would really be appreciated. This is really holding me up. -- /* insert witty comment here */

3 9

New server, can't set passwords
by Bret Wortman 07 May '18

07 May '18

I've just finished setting up a new IPA server, planning to use it and some replicas to replace our existing servers. I did this by dumping all the data from the old ones using a series of ipa commands and then used custom parsers to re-create the entries on the new one (so as not to propagate our lack of CA into the new servers). When I went to set new passwords on all the migrated accounts, I get this error in the web ui: "IPA Error 4031: EmptyResult no matching entry found". The CLI results in this: # ipa user-mod homer --random ipa: ERROR: Operations error: key encryption/encoding failed Any idea what might cause this and how I should fix it? -- photo *Bret Wortman* Founder, Damascus Products LLC 855-644-2783 <tel:855-644-2783> | 303-523-8037 <tel:303-523-8037> | bret(a)damascusproducts.com <mailto:bret@damascusproducts.com> http://damascusproducts.com/ 10332 Main St Suite 319 Fairfax, VA 22030 <http://facebook.com/wrapbuddiesco> <http://www.linkedin.com/in/bretwortman> <http://twitter.com/wrapbuddiesco> <http://instagram.com/wrapbuddies>

3 5

Fedora 28 / FreeIPA note
by Alexander Bokovoy 07 May '18

07 May '18

Hi, Fedora project has released Fedora 28 last week. Unfortunately, FreeIPA 4.6.90.pre1 in Fedora 28 is not ready for production. We do not recommend to upgrade to Fedora 28 on your FreeIPA masters at this time. We are working on finalizing FreeIPA 4.7 release that should replace 4.6.90.pre1 in Fedora 28. Right now the delta between Fedora 28 alpha where 4.6.90.pre1 was released and FreeIPA git master is about two months of work and dozens of fixes, including fixes for upgrade issues. The reason why FreeIPA 4.7 is delayed is due to a need to coordinate with a number of other projects. FreeIPA moved to mod_ssl; Fedora 28 moved to use SQL backend in nss as a new default which broke a lot of assumptions in both FreeIPA and Dogtag. Tomcat version was upgrade and Dogtag needed to adapt which all took a lot of time. Unfortunately, some issues could only be discovered when you are moving forward past the fixes already made, so we are in a ping-pong game across a number of projects. A nightly CI was added to FreeIPA upstream which allows us to test a wider set of configurations against Fedora 27 and 28. We are planning to release another FreeIPA 4.7 prelease this week. It should help with a general upgrade path stabilization from Fedora 27 to 28. Thus, I'd recommend to not upgrade to Fedora 28 until we provide an additional guidance. Thank you, -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

Re: Can't install CA from replica file - Failed to import EncryptedPrivateKeyInfo to token
by H. Frenzel 07 May '18

07 May '18

Am 01.05.2018 09:33, schrieb Fraser Tweedale via FreeIPA-users: >> ipa : DEBUG stderr=TokenException: Failed to import >> EncryptedPrivateKeyInfo to token: (-8152) The key does not support >> the >> requested operation. > 1. Clean up the failed replica via `ipa-server-install --uninstall`. > You may need to use `ipa-replica-manage del` or `ipa server-del` > as well, to clean up replication agreeements. > > 2. Restart Dogtag on the master. (But before you do, out of > interest, what is Dogtag's uptime?) > > 3. Attempt replica installation again. I did the above few times. The recent dogtag uptime was 7h. # service pki-tomcatd@pki-tomcat status Redirecting to /bin/systemctl status pki-tomcatd(a)pki-tomcat.service ● pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat Loaded: loaded (/lib/systemd/system/pki-tomcatd@.service; enabled; vendor preset: disabled) Active: active (running) since Mi 2018-05-02 06:30:44 CEST; 7h ago Process: 13876 ExecStartPre=/usr/bin/pkidaemon start %i (code=exited, status=0/SUCCESS) Main PID: 14018 (java) > Also, see if regular certificate issuance works on the master. (The > other times I saw this error, it was in fact a total failure of the > signing operation on the CA master, and nothing to do with replica > installation specifically.) Certificate issuance works as far as I could see. I tried with 'ipa-getcert request -d /tmp/test' and checked with: # ipa-getcert request -d /tmp/test Request ID '20180502121204': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/tmp/test',nickname='test',token='NSS Certificate DB' certificate: type=NSSDB,location='/tmp/test',nickname='test',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=EXAMPLE.COM subject: CN=ipa-01.example.com,O=EXAMPLE.COM expires: 2020-05-02 12:12:05 UTC dns: ipa-01.example.com principal name: host/ipa-01.example.com(a)EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes > If replica installation fails after the above steps, please provide > the /var/log/pki/pki-tomcat/ca/debug logs from both the master and > the replica-to-be. I tried it again to produce the requested logs. I did the following steps: 1. on master: ipa-replica-prepare (s. pki-tomcat_ca_debug.log.ipa-replica-prepare.1.gz) 2. on replica: ipa-replica-install This failed with 'ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR cannot connect to 'ldaps://ipa-01.example.com': TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.' Then I needed to perform the following steps to get it to work (reproducable each time - both steps are required) 3. on master: ipa-server-upgrade (s. pki-tomcat_ca_debug.log.ipa-server-upgrade.gz) 4. on master: ipa-certupdate (s. pki-tomcat_ca_debug.log.ipa-certupdate.gz) After this, I retried: 5. on master: ipa-replica-prepare (s. pki-tomcat_ca_debug.log.ipa-replica-prepare.2.gz) 6. on replica: ipa-replica-install (s. pki-tomcat_ca_debug.log.ipa-replica-install.2.gz) This worked, so I tried to install the CA replication 7. on replica: ipa-ca-install (s. pki-tomcat_ca_debug.log.ipa-ca-install.2) This failed again with 'ipa : DEBUG stderr=TokenException: Failed to import EncryptedPrivateKeyInfo to token: (-8152) The key does not support the requested operation.' There is no /var/log/pki/pki-tomcat/ca/debug created on the replica, but I attached the pki-ca-spawn.20180502135730.log.gz. Thx for help H.

1 0

IPA server installation failed with "CA did not start in 300.0s" on banana pi M2
by Markus Roth 06 May '18

06 May '18

Hello, I tried to install the freeipa server (fedora 27) on my banana pi M2. But it failed with the error: DEBUG The ipa-server-install command failed, exception: RuntimeError: CA did not start in 300.0s I tried to change the startup_timeout parameter in /usr/lib/python2.7/site-packages/ipalib/constants.py as it was mentioned in the howto https://www.freeipa.org/page/HowTo/FreeIPA_on_banana_pi. But this doesn't solve it. Has anybody a tip/solution for this problem?

1 0

Fedora 28 as a FreeIPA desktop client
by Alex Corcoles 05 May '18

05 May '18

Hi, I'm running Fedora 27 as my main desktop enrolled on my FreeIPA domain for a while and it's awesome. I was toying with the idea of building a cloud VM as a remote desktop, but xrdp is a bit annoying on Fedora 27 so I postponed that. Now I'm playing with Fedora 28 on a VM, where xrdp works *beautifully* but I have a couple of annoyances with FreeIPA integration: * Gnome Keyring prompts me for a password, when I think in Fedora 27 was integrated into FreeIPA (or at least, I don't think I see password prompts) * I just dnf updated, but I used to get a colord elevation prompt on login, which I couldn't get to work (i.e. it doesn't pick up my password) * Gnome elevation prompts (such as Gnome Software) as for the credentials of the user I created during system installation, instead of my FreeIPA user sudo is working on the console perfectly through FreeIPA. Are those known issues? Is there any useful troubleshooting I can do? Cheers, Álex -- ___ {~._.~} ( Y ) ()~*~() mail: alex at corcoles dot net (_)-(_) http://alex.corcoles.net/

1 0

https://www.freeipa.org/page/V4/Authselect_migration review
by Rob Crittenden 04 May '18

04 May '18

Not sure worth adding but `authselect list` will show available profiles. I think commands should use a <code> tag rather than bold (authselect select sssd with-mkhomedir). The NIS domain change is mentioned but not the proposed or actual solution. rob

2 1

Named not pulling authoritative zones from LDAP
by Matt Ungaro 03 May '18

03 May '18

Hello there, Having an issue with named on one of our IPA servers. Our IPA server gets the following messages in named.run when it starts: 0 master zones from LDAP instance 'ipa' loaded (0 zones defined, 0 inactive, 0 failed to load) 0 master zones is suspicious number, please check access control instructions on LDAP server We have been rolling through and upgrading our IPA infrastructure, and it looks like DNS privileges were lost for this host during the upgrade, and the issue was exposed on a restart of named. We're looking to get this server back into the proper pbac group so that it can read in authoritative zones. Any assistance is greatly appreciated! Host information: Upgraded from 4.2.0-15 to 4.5.0-22 OS Version: CentOS 7.2.1511 Issue description: named starts, but cannot get authoritative zones from LDAP. Kerberos authentication is functioning (Tested using the named.keytab and ldapsearch as shown below), but the host does not have DNS Server privileges. Followed troubleshooting steps located at: https://docs.pagure.org/bind-dyndb-ldap/BIND9/NamedCannotStart.html Domain name has been scrubbed, but host names are intact. I assure you, we are not example.net. :) In any of this output we are looking for ipa-002.example.net. From the non-functioning host (FreeIPA version 4.5): > kinit -kt /etc/named.keytab DNS/ipa-002.example.net > ldapsearch -H 'ldapi://%2fvar%2frun%2fslapd-EXAMPLE-NET.socket' -Y GSSAPI -b 'cn=dns,dc=example,dc=net' SASL/GSSAPI authentication started SASL username: DNS/ipa-002.example.net(a)EXAMPLE.NET SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <cn=dns,dc=example,dc=net> with scope subtree # filter: (objectclass=*) # requesting: ALL # # dns, example.net dn: cn=dns,dc=example,dc=net cn: dns objectClass: idnsConfigObject objectClass: nsContainer objectClass: ipaConfigObject objectClass: top objectClass: ipadnscontainer # sec, dns, example.net dn: cn=sec,cn=dns,dc=example,dc=net cn: sec objectClass: nsContainer objectClass: top # keys, sec, dns, example.net dn: cn=keys,cn=sec,cn=dns,dc=example,dc=net cn: keys objectClass: nsContainer objectClass: top # servers, dns, example.net dn: cn=servers,cn=dns,dc=example,dc=net cn: servers objectClass: nsContainer objectClass: top # servers + 79ae4ffe-6b7211e7-9fb996c1-641091b3, dns, example.net dn: cn=servers+nsuniqueid=79ae4ffe-6b7211e7-9fb996c1-641091b3,cn=dns,dc=example ,dc=net cn: servers objectClass: nsContainer objectClass: top # search result search: 4 result: 0 Success # numResponses: 6 # numEntries: 5 > ipa privilege-show 'DNS Servers' --all --raw dn: cn=DNS Servers,cn=privileges,cn=pbac,dc=example,dc=net cn: DNS Servers description: DNS Servers member: krbprincipalname=DNS/ipa-001.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ipa-001.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/eu-ipa-02.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/eu-ipa-02.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/eu-ipa-01.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/eu-ipa-01.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/dev-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ dev-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/rslon-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ rslon-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/rslon-ipa-02.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ rslon-ipa-02.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/rsiad-ipa-02.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ rsiad-ipa-02.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/rsiad-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ rsiad-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/rsdfw-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ rsdfw-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/rsdfw-ipa-02.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ rsdfw-ipa-02.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=DNS/prod-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net member: krbprincipalname=ipa-dnskeysyncd/ prod-ipa-01.mgmt.example.net(a)EXAMPLE.NET ,cn=services,cn=accounts,dc=example,dc=net memberof: cn=System: Read DNS Configuration,cn=permissions,cn=pbac,dc=example,dc=net memberof: cn=System: Write DNS Configuration,cn=permissions,cn=pbac,dc=example,dc=net memberof: cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=example,dc=net memberof: cn=System: Manage DNSSEC keys,cn=permissions,cn=pbac,dc=example,dc=net memberof: cn=System: Manage DNSSEC metadata,cn=permissions,cn=pbac,dc=example,dc=net memberof: cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=example,dc=net memberof: cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=example,dc=net memberof: cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=example,dc=net memberof: cn=System: Read DNS Servers Configuration,cn=permissions,cn=pbac,dc=example,dc=net objectClass: top objectClass: groupofnames objectClass: nestedgroup -- Matt Ungaro (mungaro(a)armsbusinesssolutions.com) Phone: 608-616-5367 Engineer 3 ARMS Business Solutions -- IMPORTANT: This e-mail (including any attachments) is intended for the use of the individual or entity to which it is addressed and may contain information that is classified, private, or confidential. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is prohibited. If you have received this communication in error, please notify us immediately by replying to this e-mail. Thank you.

3 5

Problems setting up replica on Raspberry Pi 3B (ARM)
by Jonathan Vaughn 02 May '18

02 May '18

Yes, I know, not recommended etc, low performance. I'm not going to run the CA on it. I just want to have a backup LDAP/Kerberos server. Right now I'm just trying to test things out. I've got a master and a replica (so you could say two masters I suppose) running in Virtualbox VMs, and I'm trying to set up a 3rd replica on a Pi. All are Fedors 27. I had to downgrade httpd due to https://pagure.io/freeipa/issue/7493 to even set up the first VM replica, but this issue is separate. Currently, the problem is it can't connect to it's own LDAP instance due to some kind of error ... ipa-replica-install worked fine on the x86_64 VM but on the armv71 Pi 3B when it tries to connect to LDAPI instead of using 'ldapi:///var/run//slapd-COMPANY-INTERNAL.socket' it uses 'ldapi://%2Fvar%2Frun%2Fslapd-COMPANY-INTERNAL.socket'. So it seems there is yet another ARM (or non-x86_64) bug ... similar to the problem with httpd and passing the KRB5CCNAME properly https://pagure.io/freeipa/issue/7337 Any ideas on where to look to patch in a fix to this so it uses the correct filename? The socket file is there ... and (at the time it tries) LDAP is running.

2 1

Potentially Corrupted Tomcat PKI database, recovery steps?
by Brian Weaver 01 May '18

01 May '18

After a recent power outage the IPA master server I built a few years ago is having some issues. I've done as much troubleshooting as I can and I think I've tracked down the issue to the certificate database in '/etc/pki/pki-tomcat/alias'. I can use 'certutil' to view a list of certificates. I can also view the key ID of the keys, when no nickname is used to specify a specific key. When I try to look at a specific key it fails. [root@ipa-server0 alias]# certutil -d $PWD -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI caSigningCert cert-pki-ca CTu,Cu,Cu subsystemCert cert-pki-ca u,u,u Server-Cert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu ocspSigningCert cert-pki-ca u,u,u [root@ipa-server0 alias]# certutil -d $PWD -K -f /tmp/xxx certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa ab76588f20ba1e9d5f4dc4fe6f62dc70dc96484f NSS Certificate DB:auditSigningCert cert-pki-ca < 1> rsa ad2699ef775d3d685d08e6c34b64a02295d6bcef caSigningCert cert-pki-ca < 2> rsa a96b674224d50615416ef25644441887b410db3f (orphan) < 3> rsa 38b6a1d6d1be0dc2f80a2330cf52c73abd22d10d NSS Certificate DB:ocspSigningCert cert-pki-ca < 4> rsa 2beb83b689255e03be47430e204d34067fd873f8 NSS Certificate DB:Server-Cert cert-pki-ca < 5> rsa 0d733da9de0045c502dbb9f20ea8d4ba426afb47 NSS Certificate DB:subsystemCert cert-pki-ca [root@ipa-server0 alias]# for i in $(certutil -d $PWD -L | grep cert-pki | awk '{print $1}') ; do certutil -d $PWD -K -f /tmp/xxx -n "$i cert-pki-ca" ; done certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa ad2699ef775d3d685d08e6c34b64a02295d6bcef caSigningCert cert-pki-ca certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. Does anyone have any suggestions on how to recover from this particular error. It would seem that some of the certificates were recently regenerated by certmonger based on these lines from the logging Mar 30 07:26:30 ipa-server0.ipa.sunbirddcim.com certmonger[19770]: Certificate named "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will no Mar 30 07:26:30 ipa-server0.ipa.sunbirddcim.com certmonger[19769]: Certificate named "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will n Mar 30 07:26:30 ipa-server0.ipa.sunbirddcim.com certmonger[19772]: Certificate named "ipaCert" in token "NSS Certificate DB" in database "/etc/httpd/alias" will not be valid after 201804261702 Mar 30 07:26:30 ipa-server0.ipa.sunbirddcim.com certmonger[19773]: Certificate named "Server-Cert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" will not be Mar 30 07:28:57 ipa-server0.ipa.sunbirddcim.com certmonger[20025]: Certificate named "ipaCert" in token "NSS Certificate DB" in database "/etc/httpd/alias" issued by CA and saved. Mar 30 07:29:48 ipa-server0.ipa.sunbirddcim.com certmonger[20102]: Certificate named "auditSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" issued Mar 30 07:30:03 ipa-server0.ipa.sunbirddcim.com certmonger[20125]: Certificate named "ocspSigningCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" issued Mar 30 07:30:20 ipa-server0.ipa.sunbirddcim.com certmonger[20148]: Certificate named "subsystemCert cert-pki-ca" in token "NSS Certificate DB" in database "/etc/pki/pki-tomcat/alias" issued by Apr 10 07:26:31 ipa-server0.ipa.sunbirddcim.com certmonger[23627]: Certificate named "Server-Cert" in token "NSS Certificate DB" in database "/etc/dirsrv/slapd-IPA-SUNBIRDDCIM-COM" will not be Apr 10 07:27:23 ipa-server0.ipa.sunbirddcim.com certmonger[23724]: Certificate named "Server-Cert" in token "NSS Certificate DB" in database "/etc/httpd/alias" issued by CA and saved. Apr 10 07:27:40 ipa-server0.ipa.sunbirddcim.com certmonger[23783]: Certificate named "Server-Cert" in token "NSS Certificate DB" in database "/etc/dirsrv/slapd-IPA-SUNBIRDDCIM-COM" issued by C I going to continue to try to muddle my way through it. I'm hoping someone with more knowledge than myself can help me find the correct path. The result of `ipa --version` is VERSION: 4.3.1, API_VERSION: 2.164. The system is running Fedora 23 and FreeIPA came from a COPR release name=Copr repo for freeipa-4-3 owned by @freeipa baseurl= https://copr-be.cloud.fedoraproject.org/results/@freeipa/freeipa-4-3/fedora… Any help would be greatly appreciated. -- /* insert witty comment here */

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2018