On 1/8/20 3:30 AM, Ferdinand Babas via FreeIPA-users wrote:

Hi Flo,

Thanks for the response.

...

On 1/6/20 10:12 PM, Ferdinand Babas via FreeIPA-users wrote: Hi, this error usually happens when there are issues with the subsystemCert cert-pki-ca. According to your certutil output, the cert is missing u,u,u flags, can you check if the associated key is present?

• Get the password to access the key:

$ sudo grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt

• Check if the key is present in the NSSdb:

$ sudo certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt | grep subsystemCert

If the key is there, you should see a line with < id> rsa 81c..d04 subsystemCert cert-pki-ca

The above steps failed for me with the following:

Incorrect password/PIN entered. certutil: could not authenticate to token NSS Certificate DB.: SEC_ERROR_BAD_PASSWORD: The security password entered is incorrect.

Do you have the file /var/lib/pki/pki-tomcat/conf/password.conf ? Its content is usually: internal=<password> replicationdb=<number>

If it's empty/missing, you can also check if there is a /etc/pki/pki-tomcat/alias/pwdfile.txt which should contain the password.

You really need this password if you want to manage the private keys inside the NSS DB.

The above steps did work with the other 3 nodes however:

< 3> rsa 48f4a4...2c126e NSS Certificate DB:subsystemCert cert-pki-ca

...

If the key is missing you can recover it from another node where the CA is installed.

How would I recover the key from the other nodes?

Export key + cert with pk12util from an other node, then import. But you will need the NSSDB password.

...

The 'auditSigningCert cert-pki-ca' is the same on all the nodes with CA. If you are able to get it from another machine, you can import the cert on this master. First check if the key is present (with certutil -K), and if needed also get the key from another node.

To export cert+key from a NSSDB to a p12file: pk12util -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -o file.p12 To import cert.key from a p12 file to a NSSDB: pk12util -d /etc/pki/pki-tomcat/alias -i file.p12

Regarding the 'auditSigningCert cert-pki-ca' I ran the export command you provided but got stuck when prompted for the password (Enter Password or Pin for "NSS Certificate DB":). What should I do if I have no idea what the password is?

The password is the NSS DB's password, stored in /var/lib/pki/pki-tomcat/conf/password.conf or /etc/pki/pki-tomcat/alias/pwdfile.txt.

flo

...

HTH, flo

Thanks so much for your help!!

Ferdinand _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

On 1/9/20 6:44 AM, Ferdinand Babas via FreeIPA-users wrote:

...

On 1/8/20 3:30 AM, Ferdinand Babas via FreeIPA-users wrote: Do you have the file /var/lib/pki/pki-tomcat/conf/password.conf ? Its content is usually: internal=<password> replicationdb=<number>

If it's empty/missing, you can also check if there is a /etc/pki/pki-tomcat/alias/pwdfile.txt which should contain the password.

You really need this password if you want to manage the private keys inside the NSS DB.

Export key + cert with pk12util from an other node, then import. But you will need the NSSDB password.

The password is the NSS DB's password, stored in /var/lib/pki/pki-tomcat/conf/password.conf or /etc/pki/pki-tomcat/alias/pwdfile.txt.

flo

Thanks for pointing me in the right direction. I was able to get the NSS DB password and was able to export and import the key and cert like you described.

I had to export and import both the 'auditSigningCert cert-pki-ca' and 'subsystemCert cert-pki-ca' and now on the CA Renewal Master I get the following:

# certutil -L -d /etc/pki/pki-tomcat/alias

Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI

Server-Cert cert-pki-ca u,u,u auditSigningCert cert-pki-ca u,u,Pu caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u

# certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt

certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa cc9d67...53abe6 (orphan) < 1> rsa 7b55ea...d259f7 auditSigningCert cert-pki-ca < 2> rsa f06e29...d0fb44 NSS Certificate DB:Server-Cert cert-pki-ca < 3> rsa bcc164...94ef97 NSS Certificate DB:ocspSigningCert cert-pki-ca < 4> rsa e49b1d...a6a30f NSS Certificate DB:caSigningCert cert-pki-ca < 5> rsa 48f4a4...2c126e subsystemCert cert-pki-ca

Now the the certs that were imported are expired:

# certutil -L -d /etc/pki/pki-tomcat/alias/ -n 'auditSigningCert cert-pki-ca'

     Validity:
         Not Before: Wed Jun 14 20:45:05 2017
         Not After : Tue Jun 04 20:45:05 2019

# certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca'

     Validity:
         Not Before: Thu Jun 29 04:28:11 2017
         Not After : Wed Jun 19 04:28:11 2019

So I changed the date to prior to Jun 04 2019

# timedatectl set-time 2019-06-01

Restarted the pki-tomcatd service and the certmonger service and now I get the following:

ipactl status

Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING ipa_memcached Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: STOPPED pki-tomcatd Service: RUNNING <- Running... Yay!! ipa-otpd Service: RUNNING ipa: INFO: The ipactl command was successful

From /var/log/messages:

Jun 1 03:21:49 francolin systemd: Stopping Certificate monitoring and PKI enrollment... Jun 1 03:21:49 francolin certmonger: 2019-06-01 00:17:28 [24501] Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation2019-06-01 00:38:13 [24501] Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation Jun 1 03:21:49 francolin systemd: Starting Certificate monitoring and PKI enrollment... Jun 1 03:21:50 francolin systemd: Started Certificate monitoring and PKI enrollment. Jun 1 03:21:51 francolin ns-slapd: [01/Jun/2019:03:21:51.309397072 -1000] csngen_new_csn - Warning: too much time skew (-19140576 secs). Current seqnum=a Jun 1 03:21:51 francolin ns-slapd: [01/Jun/2019:03:21:51.372397615 -1000] csngen_new_csn - Warning: too much time skew (-19140576 secs). Current seqnum=b Jun 1 03:23:50 francolin ns-slapd: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket not yet valid) Jun 1 03:23:50 francolin ns-slapd: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket not yet valid) Jun 1 03:23:50 francolin ns-slapd: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket not yet valid)

# getcert list ... Request ID '20170614062601': status: MONITORING ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=LOCAL subject: CN=CA Audit,O=LOCAL expires: 2019-06-04 20:45:05 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes ... Request ID '20170614062603': status: MONITORING ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=LOCAL subject: CN=CA Subsystem,O=LOCAL expires: 2019-06-19 04:28:11 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes

This is the furthest I've gotten and I appreciate all the help you've provided. Hopefully a few more tips will get me going.

Hi,

you need to carefully pick the date in the past. At that given date, all your certs must be valid (ie notbefore < date < notafter). It's likely that you choose a date before the notbefore date of some of the certs.

flo

Thanks so much!!

Ferdinand _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

On 1/14/20 11:41 PM, Ferdinand Babas via FreeIPA-users wrote:

...

On 1/9/20 6:44 AM, Ferdinand Babas via FreeIPA-users wrote: Hi,

you need to carefully pick the date in the past. At that given date, all your certs must be valid (ie notbefore < date < notafter). It's likely that you choose a date before the notbefore date of some of the certs.

flo

Hi flo,

Still working on this and I'm unsure exactly what to do next. Here are the Not Before and Not After dates of all the certs:

/etc/dirsrv/slapd-CFHT-HAWAII-EDU,nickname='Server-Cert' Not Before: Sat May 18 19:15:24 2019 Not After : Tue May 18 19:15:24 2021

/etc/httpd/alias,nickname='Server-Cert' Not Before: Sat May 18 19:15:34 2019 Not After : Tue May 18 19:15:34 2021

/etc/httpd/alias,nickname='ipaCert' Not Before: Wed Jun 14 06:06:40 2017 Not After : Tue Jun 04 06:06:40 2019

/etc/pki/pki-tomcat/alias,nickname='auditSigningCert cert-pki-ca' Not Before: Wed Jun 14 20:45:05 2017 Not After : Tue Jun 04 20:45:05 2019

/etc/pki/pki-tomcat/alias,nickname='ocspSigningCert cert-pki-ca' Not Before: Sat Jun 01 10:29:31 2019 Not After : Fri May 21 10:29:31 2021

/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca Not Before: Thu Jun 29 04:28:11 2017 Not After : Wed Jun 19 04:28:11 2019

/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca Not Before: Wed Jul 22 14:25:13 2015 Not After : Sun Jul 22 14:25:13 2035

/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca' Not Before: Tue May 07 19:15:22 2019 Not After : Mon Apr 26 19:15:22 2021

From what I can tell setting the date to 2019-06-02 should be fine so I did that and restarted pki-tomcatd (which starts up fine when back dated).

Agreed, any date between June 1 and June 4 should be ok.

When I restart certmonger I'm getting log messages of:

Jun 3 00:00:24 francolin ns-slapd: [03/Jun/2019:00:00:24.572219961 -1000] csngen_new_csn - Warning: too much time skew (-19483202 secs). Current seqnum=1 Jun 3 00:00:24 francolin ns-slapd: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket not yet valid) Jun 3 00:00:24 francolin ns-slapd: [03/Jun/2019:00:00:24.612098416 -1000] csngen_new_csn - Warning: too much time skew (-19483203 secs). Current seqnum=1 Jun 3 00:00:24 francolin ns-slapd: [03/Jun/2019:00:00:24.628118429 -1000] csngen_new_csn - Warning: too much time skew (-19483204 secs). Current seqnum=1

And getcert list displays the following:

... Request ID '20170614061938': status: NEED_CSR_GEN_TOKEN

ipaCert is the most important cert to renew and should be handled first. The man page for getcert-list explains this error as: NEED_CSR_GEN_TOKEN The service was unable to find the token in which the key pair is supposed to be stored.

So I would check if /etc/httpd/alias has the right permissions, if /etc/httpd/alias/pwdfile.txt contains the password for /etc/httpd/alias and has the right permissions. On a RHEL 7.2 system I can see: [root ~]# ls -ld /etc/httpd/alias/ drwxr-xr-x. 2 root root 4096 Jan 15 10:48 /etc/httpd/alias/ [root ~]# ls -l /etc/httpd/alias/ total 188 -r--r--r--. 1 root root 1427 Jan 15 10:48 cacert.asc -r--r--r--. 1 root root 1427 Jan 13 14:19 cacert.asc.orig -rw-rw----. 1 root apache 65536 Jan 15 10:49 cert8.db -rw-rw----. 1 root apache 65536 Jan 13 14:27 cert8.db.orig -rw-------. 1 root root 5872 Nov 16 2018 install.log -rw-rw----. 1 root apache 16384 Jan 15 10:49 key3.db -rw-rw----. 1 root apache 16384 Jan 13 14:27 key3.db.orig -r--r-----. 1 root apache 3481 Jan 15 10:47 kra-agent.pem lrwxrwxrwx. 1 root root 33 Nov 16 2018 libnssckbi.so -> ../../..//usr/lib64/libnssckbi.so -rw-rw----. 1 root apache 20 Jan 15 10:47 pwdfile.txt -rw-rw----. 1 root apache 20 Jan 13 14:18 pwdfile.txt.orig -rw-rw----. 1 root apache 16384 Jan 15 10:47 secmod.db -rw-rw----. 1 root apache 16384 Jan 13 14:18 secmod.db.orig

And to check the password: [root@ ~]# certutil -K -d /etc/httpd/alias/ -f /etc/httpd/alias/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 1b212c867ebde61fdc295ecd63ef690cd93fc783 NSS Certificate DB:ipaCert < 1> rsa da7a2b61ed951d1cfff1309534a3232258da9487 NSS Certificate DB:Signing-Cert < 2> rsa e5fdd7ec9d8daa97566695ac562fb1697a811401 NSS Certificate DB:Server-Cert

(if the password file is wrong, you will see: Incorrect password/PIN entered)

flo

stuck: yes key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=LOCAL subject: CN=IPA RA,O=LOCAL expires: 2019-06-04 06:06:40 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20170614062601': status: MONITORING ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=LOCAL subject: CN=CA Audit,O=LOCAL expires: 2019-06-04 20:45:05 UTC key usage: digitalSignature,nonRepudiation pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes ... Request ID '20170614062603': status: MONITORING ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=LOCAL subject: CN=CA Subsystem,O=LOCAL expires: 2019-06-19 04:28:11 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes ...

Thanks for all of your help.

Ferdinand _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

On 1/16/20 12:26 AM, Ferdinand Babas via FreeIPA-users wrote:

...

On 1/14/20 11:41 PM, Ferdinand Babas via FreeIPA-users wrote: Agreed, any date between June 1 and June 4 should be ok.

ipaCert is the most important cert to renew and should be handled first. The man page for getcert-list explains this error as: NEED_CSR_GEN_TOKEN The service was unable to find the token in which the key pair is supposed to be stored.

So I would check if /etc/httpd/alias has the right permissions, if /etc/httpd/alias/pwdfile.txt contains the password for /etc/httpd/alias and has the right permissions. On a RHEL 7.2 system I can see: [root ~]# ls -ld /etc/httpd/alias/ drwxr-xr-x. 2 root root 4096 Jan 15 10:48 /etc/httpd/alias/ [root ~]# ls -l /etc/httpd/alias/ total 188 -r--r--r--. 1 root root 1427 Jan 15 10:48 cacert.asc -r--r--r--. 1 root root 1427 Jan 13 14:19 cacert.asc.orig -rw-rw----. 1 root apache 65536 Jan 15 10:49 cert8.db -rw-rw----. 1 root apache 65536 Jan 13 14:27 cert8.db.orig -rw-------. 1 root root 5872 Nov 16 2018 install.log -rw-rw----. 1 root apache 16384 Jan 15 10:49 key3.db -rw-rw----. 1 root apache 16384 Jan 13 14:27 key3.db.orig -r--r-----. 1 root apache 3481 Jan 15 10:47 kra-agent.pem lrwxrwxrwx. 1 root root 33 Nov 16 2018 libnssckbi.so -> ../../..//usr/lib64/libnssckbi.so -rw-rw----. 1 root apache 20 Jan 15 10:47 pwdfile.txt -rw-rw----. 1 root apache 20 Jan 13 14:18 pwdfile.txt.orig -rw-rw----. 1 root apache 16384 Jan 15 10:47 secmod.db -rw-rw----. 1 root apache 16384 Jan 13 14:18 secmod.db.orig

And to check the password: [root@ ~]# certutil -K -d /etc/httpd/alias/ -f /etc/httpd/alias/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 1b212c867ebde61fdc295ecd63ef690cd93fc783 NSS Certificate DB:ipaCert < 1> rsa da7a2b61ed951d1cfff1309534a3232258da9487 NSS Certificate DB:Signing-Cert < 2> rsa e5fdd7ec9d8daa97566695ac562fb1697a811401 NSS Certificate DB:Server-Cert

(if the password file is wrong, you will see: Incorrect password/PIN entered)

flo

Hi flo,

Everything looks okay as far as permissions but when I run the certutil -K -d /etc/httpd/alias/ -f /etc/httpd/alias/pwdfile.txt command I get the following:

certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 0fa7d5a5d032d3d9bb0845425b4ce4c3588c5eba NSS Certificate DB:Server-Cert

ipaCert is missing from the output, but it is there when I run certutil -L -d /etc/httpd/alias/:

Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI

Server-Cert u,u,u LOCAL IPA CA CT,C,C ipaCert ,,

It is missing the trust attributes though? How would I resolve that?

Hi, the cert is present but its private key is missing. It looks like you lost many of the private keys on that node, do you have a backup somewhere of the NSS database? Otherwise, the private key may be present on other nodes and can be recovered from them using the export and import commands I provided earlier (pk12util).

flo

Thanks,

Ferdinand _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

On 1/17/20 8:40 AM, Ferdinand Babas via FreeIPA-users wrote:

...

On 1/16/20 12:26 AM, Ferdinand Babas via FreeIPA-users wrote: Hi, the cert is present but its private key is missing. It looks like you lost many of the private keys on that node, do you have a backup somewhere of the NSS database? Otherwise, the private key may be present on other nodes and can be recovered from them using the export and import commands I provided earlier (pk12util).

flo

Hi flo,

No backup but I was able to export and import the ipaCert from another node and pki-tomcatd starts up now when back dated.

When I stop and start certmonger and run getcert list I get the following errors for a couple of certs:

ca-error: Server at "https://francolin.local:8443/ca/agent/ca/profileProcess" replied: 1: You did not provide a valid certificate for this operation

Hi,

IPA is using the ipaCert to authenticate to Dogtag when it requests new certs. You need to check that the ipaCert is valid and consistent with the content of uid=ipara,ou=people,o=ipaca. This ldap entry must contain a "userCertificate" attribute (can be multivalued) that contains the certificate + a description attribute with the format "2;<serial number>;<issuer>;<subject>". With all the manual operations done on IPA, it's likely that this entry is inconsistent with the ipaCert and you will need to update it with ldapmodify. When it's done you can check if the cert is valid and allows authentication with the command: # kinit admin # ipa cert-show 1

If it's working, you can resubmit the tracking requests that were showing the error: # getcert resubmit -i <id>

After that, your CA renewal master should be good to go and you can set the date to the current date. HTH, flo

The above error is reported for:

key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'

and

key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'

But when I run the following everything checks out:

# grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -f /tmp/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 48f4a4...2c126e subsystemCert cert-pki-ca # certutil -K -d /etc/pki/pki-tomcat/alias -n 'auditSigningCert cert-pki-ca' -f /tmp/pwdfile.txt certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa 7b55ea...d259f7 auditSigningCert cert-pki-ca

Things seem to checkout. I'm unsure what I should do next, I appreciate all the tips and help you've been providing.

Thanks,

Ferdinand _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...