need help to install letsencrypt in freeipa on ubuntu 16.04

List overview All Threads
Download

newer

older

Multiple CA certs

Re: named fails to start

Anush Jayan

27 Sep 2018 27 Sep '18

5:25 a.m.

im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble installing letsencrypt ssl key for https can anyone help me fix this

Show replies by date

Rob Crittenden

27 Sep 27 Sep

8:40 a.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Anush Jayan via FreeIPA-users wrote:

...

im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble installing letsencrypt ssl key for https can anyone help me fix this

It would help if you said what you tried and what you are seeing.

rob

Anush Jayan

9:36 a.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem

ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer

ipa-certupdate

ipa-server-certinstall -w fullchain.pem privkey.pem

then it askd me for directory manager password

then it was asking for something private key unlock password

here i got atuck i dont know which password to insert

On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden rcritten@redhat.com wrote:

...

Anush Jayan via FreeIPA-users wrote:

...
im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble

installing letsencrypt ssl key for https can anyone help me fix this

...
It would help if you said what you tried and what you are seeing.

rob

Rob Crittenden

12:10 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Anush Jayan wrote:

...

|ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem|

|

|ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|

|

|ipa-certupdate |

|

|ipa-server-certinstall -w fullchain.pem privkey.pem|

|then it askd me for directory manager password|

|then it was asking for something private key unlock password |

|here i got atuck i dont know which password to insert|

I can only assume that the private key is encrypted. You need to provide the encryption key for it.

If you look at the contents of privkey.pem and it starts with:

-----BEGIN ENCRYPTED PRIVATE KEY-----

then it is encrypted.

rob

...

On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:

Anush Jayan via FreeIPA-users wrote:
> im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
installing letsencrypt ssl key for https can anyone help me fix this
>

It would help if you said what you tried and what you are seeing.

rob

Anush Jayan

12:23 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

yes it is encrypted but i have created ssl using letsencrypt and it is passwordless i dont know which password i should insert when it ask to enter password for private key do you know any other way by which i can use letsencrypt fullchain.pem chain.pem and privkey pem as ssl

On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden rcritten@redhat.com wrote:

...

Anush Jayan wrote:

...
|ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem|

|

|ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|

|

|ipa-certupdate |

|

|ipa-server-certinstall -w fullchain.pem privkey.pem|

|then it askd me for directory manager password|

|then it was asking for something private key unlock password |

|here i got atuck i dont know which password to insert|

I can only assume that the private key is encrypted. You need to provide the encryption key for it.

If you look at the contents of privkey.pem and it starts with:

-----BEGIN ENCRYPTED PRIVATE KEY-----

then it is encrypted.

rob

...
|

|

|

On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Anush Jayan via FreeIPA-users wrote:
> im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
installing letsencrypt ssl key for https can anyone help me fix this
>

It would help if you said what you tried and what you are seeing.

rob

Anush Jayan

12:27 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

im getting this error when i use the same password which i used for directory manager password

Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert' returned non-zero exit status 255 The ipa-server-certinstall command failed.

On Thu, Sep 27, 2018, 10:53 PM Anush Jayan anush@matchpointgps.com wrote:

...

yes it is encrypted but i have created ssl using letsencrypt and it is passwordless i dont know which password i should insert when it ask to enter password for private key do you know any other way by which i can use letsencrypt fullchain.pem chain.pem and privkey pem as ssl

On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden rcritten@redhat.com wrote:

...
Anush Jayan wrote:

...
|ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem|

|

|ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|

|

|ipa-certupdate |

|

|ipa-server-certinstall -w fullchain.pem privkey.pem|

|then it askd me for directory manager password|

|then it was asking for something private key unlock password |

|here i got atuck i dont know which password to insert|

I can only assume that the private key is encrypted. You need to provide the encryption key for it.

If you look at the contents of privkey.pem and it starts with:

-----BEGIN ENCRYPTED PRIVATE KEY-----

then it is encrypted.

rob

...
|

|

|

On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Anush Jayan via FreeIPA-users wrote:
> im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
installing letsencrypt ssl key for https can anyone help me fix this
>

It would help if you said what you tried and what you are seeing.

rob

Rob Crittenden

2:32 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Anush Jayan via FreeIPA-users wrote:

...

im getting this error when i use the same password which i used for directory manager password

Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert' returned non-zero exit status 255 The ipa-server-certinstall command failed.

You might try passing -v to the command to get more output.

This particular error in itself isn't treated as fatal.

rob

...

On Thu, Sep 27, 2018, 10:53 PM Anush Jayan <anush@matchpointgps.com mailto:anush@matchpointgps.com> wrote:

yes it is encrypted but i have created ssl using letsencrypt and it
is passwordless i dont know which password i should insert when it
ask to enter password for private key
do you know any other way by which i can use letsencrypt
fullchain.pem chain.pem and privkey pem as ssl 

On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden <rcritten@redhat.com
<mailto:rcritten@redhat.com>> wrote:

    Anush Jayan wrote:
    > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install DTSRootCAX3.pem|
    >
    > |
    >
    > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
    >
    > |
    >
    > |ipa-certupdate |
    >
    > |
    >
    > |ipa-server-certinstall -w fullchain.pem privkey.pem|
    >
    > |then it askd me for directory manager password|
    >
    > |then it was asking for something private key unlock password |
    >
    > |here i got atuck i dont know which password to insert|

    I can only assume that the private key is encrypted. You need to
    provide
    the encryption key for it.

    If you look at the contents of privkey.pem and it starts with:

    -----BEGIN ENCRYPTED PRIVATE KEY-----

    then it is encrypted.

    rob

    >
    > |
    >
    > |
    >
    > |
    >
    >
    > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
    <rcritten@redhat.com <mailto:rcritten@redhat.com>
    > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote:
    >
    >     Anush Jayan via FreeIPA-users wrote:
    >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
    having trouble
    >     installing letsencrypt ssl key for https can anyone help
    me fix this
    >     >
    >
    >     It would help if you said what you tried and what you are
    seeing.
    >
    >     rob
    >

FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

Anush Jayan

11:41 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Hi,

ipa: DEBUG: stderr=certutil: could not find certificate named "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.

i got this error

Regards, *Anush Jayan * *Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*

On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden rcritten@redhat.com wrote:

...

Anush Jayan via FreeIPA-users wrote:

...
im getting this error when i use the same password which i used for directory manager password

Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert' returned non-zero exit status 255 The ipa-server-certinstall command failed.

You might try passing -v to the command to get more output.

This particular error in itself isn't treated as fatal.

rob

...
On Thu, Sep 27, 2018, 10:53 PM Anush Jayan <anush@matchpointgps.com mailto:anush@matchpointgps.com> wrote:
yes it is encrypted but i have created ssl using letsencrypt and it
is passwordless i dont know which password i should insert when it
ask to enter password for private key
do you know any other way by which i can use letsencrypt
fullchain.pem chain.pem and privkey pem as ssl

On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden <rcritten@redhat.com
<mailto:rcritten@redhat.com>> wrote:

    Anush Jayan wrote:
    > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
DTSRootCAX3.pem|

...
    >
    > |
    >
    > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
    >
    > |
    >
    > |ipa-certupdate |
    >
    > |
    >
    > |ipa-server-certinstall -w fullchain.pem privkey.pem|
    >
    > |then it askd me for directory manager password|
    >
    > |then it was asking for something private key unlock password |
    >
    > |here i got atuck i dont know which password to insert|

    I can only assume that the private key is encrypted. You need to
    provide
    the encryption key for it.

    If you look at the contents of privkey.pem and it starts with:

    -----BEGIN ENCRYPTED PRIVATE KEY-----

    then it is encrypted.

    rob

    >
    > |
    >
    > |
    >
    > |
    >
    >
    > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
    <rcritten@redhat.com <mailto:rcritten@redhat.com>
    > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>
wrote:

...
    >
    >     Anush Jayan via FreeIPA-users wrote:
    >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
    having trouble
    >     installing letsencrypt ssl key for https can anyone help
    me fix this
    >     >
    >
    >     It would help if you said what you tried and what you are
    seeing.
    >
    >     rob
    >
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org

...
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:

https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

...

Anush Jayan

28 Sep 28 Sep

12:02 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

hi im getting this error what does this mean how can i fix it do u have any idea

On Fri, Sep 28, 2018, 10:11 AM Anush Jayan anush@matchpointgps.com wrote:

...

Hi,

ipa: DEBUG: stderr=certutil: could not find certificate named "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.

i got this error

Regards, *Anush Jayan * *Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*

On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden rcritten@redhat.com wrote:

...
Anush Jayan via FreeIPA-users wrote:

...
im getting this error when i use the same password which i used for directory manager password

Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert' returned non-zero exit status 255 The ipa-server-certinstall command failed.

You might try passing -v to the command to get more output.

This particular error in itself isn't treated as fatal.

rob

...
On Thu, Sep 27, 2018, 10:53 PM Anush Jayan <anush@matchpointgps.com mailto:anush@matchpointgps.com> wrote:
yes it is encrypted but i have created ssl using letsencrypt and it
is passwordless i dont know which password i should insert when it
ask to enter password for private key
do you know any other way by which i can use letsencrypt
fullchain.pem chain.pem and privkey pem as ssl

On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden <rcritten@redhat.com
<mailto:rcritten@redhat.com>> wrote:

    Anush Jayan wrote:
    > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
DTSRootCAX3.pem|

...
    >
    > |
    >
    > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
    >
    > |
    >
    > |ipa-certupdate |
    >
    > |
    >
    > |ipa-server-certinstall -w fullchain.pem privkey.pem|
    >
    > |then it askd me for directory manager password|
    >
    > |then it was asking for something private key unlock password
|

...
    >
    > |here i got atuck i dont know which password to insert|

    I can only assume that the private key is encrypted. You need to
    provide
    the encryption key for it.

    If you look at the contents of privkey.pem and it starts with:

    -----BEGIN ENCRYPTED PRIVATE KEY-----

    then it is encrypted.

    rob

    >
    > |
    >
    > |
    >
    > |
    >
    >
    > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
    <rcritten@redhat.com <mailto:rcritten@redhat.com>
    > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>
wrote:

...
    >
    >     Anush Jayan via FreeIPA-users wrote:
    >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
    having trouble
    >     installing letsencrypt ssl key for https can anyone help
    me fix this
    >     >
    >
    >     It would help if you said what you tried and what you are
    seeing.
    >
    >     rob
    >
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org

...
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:

https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

...

Rob Crittenden

1 Oct 1 Oct

8:57 a.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Anush Jayan via FreeIPA-users wrote:

...

Hi, ipa: DEBUG: stderr=certutil: could not find certificate named "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.

i got this error

You could try adding a cert with this nickname to see if it proceeds. Take a cert, any cert, and add it using the Server-Cert nickname:

# certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i /path/to/cert

Then run ipa-server-certinstall again.

rob

...

Regards, *Anush Jayan * *Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*

On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:

Anush Jayan via FreeIPA-users wrote:
> im getting this error when i use the same password  which i used for
> directory manager password
>
>
> Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert'
> returned non-zero exit status 255
> The ipa-server-certinstall command failed.

You might try passing -v to the command to get more output.

This particular error in itself isn't treated as fatal.

rob

>
>
> On Thu, Sep 27, 2018, 10:53 PM Anush Jayan
<anush@matchpointgps.com <mailto:anush@matchpointgps.com>
> <mailto:anush@matchpointgps.com <mailto:anush@matchpointgps.com>>>
wrote:
>
>     yes it is encrypted but i have created ssl using letsencrypt
and it
>     is passwordless i dont know which password i should insert when it
>     ask to enter password for private key
>     do you know any other way by which i can use letsencrypt
>     fullchain.pem chain.pem and privkey pem as ssl 
>
>     On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden
<rcritten@redhat.com <mailto:rcritten@redhat.com>
>     <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote:
>
>         Anush Jayan wrote:
>         > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
DTSRootCAX3.pem|
>         >
>         > |
>         >
>         > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install ca.cer|
>         >
>         > |
>         >
>         > |ipa-certupdate |
>         >
>         > |
>         >
>         > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>         >
>         > |then it askd me for directory manager password|
>         >
>         > |then it was asking for something private key unlock
password |
>         >
>         > |here i got atuck i dont know which password to insert|
>
>         I can only assume that the private key is encrypted. You
need to
>         provide
>         the encryption key for it.
>
>         If you look at the contents of privkey.pem and it starts with:
>
>         -----BEGIN ENCRYPTED PRIVATE KEY-----
>
>         then it is encrypted.
>
>         rob
>
>         >
>         > |
>         >
>         > |
>         >
>         > |
>         >
>         >
>         > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
>         <rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>
>         > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote:
>         >
>         >     Anush Jayan via FreeIPA-users wrote:
>         >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
>         having trouble
>         >     installing letsencrypt ssl key for https can anyone help
>         me fix this
>         >     >
>         >
>         >     It would help if you said what you tried and what
you are
>         seeing.
>         >
>         >     rob
>         >
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>

Anush Jayan

4 Oct 4 Oct

11:22 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Regards, *Anush Jayan * *Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*

certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i /path/to/cert this command is for centos if im not wrong im using ubuntu 16.04 so what should i put instead of /etc/httpd/alias

On Mon, Oct 1, 2018 at 7:27 PM Rob Crittenden rcritten@redhat.com wrote:

...

Anush Jayan via FreeIPA-users wrote:

...

Hi,

ipa: DEBUG: stderr=certutil: could not find certificate named "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.

i got this error

You could try adding a cert with this nickname to see if it proceeds. Take a cert, any cert, and add it using the Server-Cert nickname:

# certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i /path/to/cert

Then run ipa-server-certinstall again.

rob

...

Regards, *Anush Jayan * *Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*

On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Anush Jayan via FreeIPA-users wrote:
> im getting this error when i use the same password  which i used

for

...

> directory manager password
>
>
> Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n Server-Cert'
> returned non-zero exit status 255
> The ipa-server-certinstall command failed.

You might try passing -v to the command to get more output.

This particular error in itself isn't treated as fatal.

rob

>
>
> On Thu, Sep 27, 2018, 10:53 PM Anush Jayan
<anush@matchpointgps.com <mailto:anush@matchpointgps.com>
> <mailto:anush@matchpointgps.com <mailto:anush@matchpointgps.com>>>
wrote:
>
>     yes it is encrypted but i have created ssl using letsencrypt
and it
>     is passwordless i dont know which password i should insert

when it

...

>     ask to enter password for private key
>     do you know any other way by which i can use letsencrypt
>     fullchain.pem chain.pem and privkey pem as ssl
>
>     On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden
<rcritten@redhat.com <mailto:rcritten@redhat.com>
>     <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>

wrote:

...

>
>         Anush Jayan wrote:
>         > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
DTSRootCAX3.pem|
>         >
>         > |
>         >
>         > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install

ca.cer|

...

>         >
>         > |
>         >
>         > |ipa-certupdate |
>         >
>         > |
>         >
>         > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>         >
>         > |then it askd me for directory manager password|
>         >
>         > |then it was asking for something private key unlock
password |
>         >
>         > |here i got atuck i dont know which password to insert|
>
>         I can only assume that the private key is encrypted. You
need to
>         provide
>         the encryption key for it.
>
>         If you look at the contents of privkey.pem and it starts

with:

...

>
>         -----BEGIN ENCRYPTED PRIVATE KEY-----
>
>         then it is encrypted.
>
>         rob
>
>         >
>         > |
>         >
>         > |
>         >
>         > |
>         >
>         >
>         > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
>         <rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>
>         > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote:
>         >
>         >     Anush Jayan via FreeIPA-users wrote:
>         >     > im currently using freeipa 4.3.1 on ubuntu 16.04 im
>         having trouble
>         >     installing letsencrypt ssl key for https can anyone

help

...

>         me fix this
>         >     >
>         >
>         >     It would help if you said what you tried and what
you are
>         seeing.
>         >
>         >     rob
>         >
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:

https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

...

>
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to

freeipa-users-leave@lists.fedorahosted.org

...

Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:

https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...

...

Rob Crittenden

5 Oct 5 Oct

12:42 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Anush Jayan wrote:

...

Regards, *Anush Jayan * *Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*

certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i /path/to/cert this command is for centos if im not wrong im using ubuntu 16.04 so what should i put instead of /etc/httpd/alias

I think in Ubuntu the Apache database is in /etc/apache2/nssdb.

rob

...

On Mon, Oct 1, 2018 at 7:27 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:

Anush Jayan via FreeIPA-users wrote:
> Hi,
>  
> ipa: DEBUG: stderr=certutil: could not find certificate named
> "Server-Cert": SEC_ERROR_BAD_DATABASE: security library: bad database.
>
> i got this error

You could try adding a cert with this nickname to see if it proceeds.
Take a cert, any cert, and add it using the Server-Cert nickname:

# certutil -A -d /etc/httpd/alias -n Server-Cert -t u,u,u -a -i
/path/to/cert

Then run ipa-server-certinstall again.

rob

>
>
> Regards,
> *Anush Jayan *
> *Devops Engineer*
> *
> *
> *TRACKPOINT GPS PVT. LTD.*
>
>
>
> On Fri, Sep 28, 2018 at 1:02 AM Rob Crittenden
<rcritten@redhat.com <mailto:rcritten@redhat.com>
> <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote:
>
>     Anush Jayan via FreeIPA-users wrote:
>     > im getting this error when i use the same password  which i
used for
>     > directory manager password
>     >
>     >
>     > Command '/usr/bin/certutil -d /etc/apache2/nssdb -D -n
Server-Cert'
>     > returned non-zero exit status 255
>     > The ipa-server-certinstall command failed.
>
>     You might try passing -v to the command to get more output.
>
>     This particular error in itself isn't treated as fatal.
>
>     rob
>
>     >
>     >
>     > On Thu, Sep 27, 2018, 10:53 PM Anush Jayan
>     <anush@matchpointgps.com <mailto:anush@matchpointgps.com>
<mailto:anush@matchpointgps.com <mailto:anush@matchpointgps.com>>
>     > <mailto:anush@matchpointgps.com
<mailto:anush@matchpointgps.com> <mailto:anush@matchpointgps.com
<mailto:anush@matchpointgps.com>>>>
>     wrote:
>     >
>     >     yes it is encrypted but i have created ssl using letsencrypt
>     and it
>     >     is passwordless i dont know which password i should
insert when it
>     >     ask to enter password for private key
>     >     do you know any other way by which i can use letsencrypt
>     >     fullchain.pem chain.pem and privkey pem as ssl 
>     >
>     >     On Thu, Sep 27, 2018, 10:40 PM Rob Crittenden
>     <rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>
>     >     <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>> wrote:
>     >
>     >         Anush Jayan wrote:
>     >         > |ipa-cacert-manage -n DSTRootCAX3 -t C,, install
>     DTSRootCAX3.pem|
>     >         >
>     >         > |
>     >         >
>     >         > |ipa-cacert-manage -n LetsEncryptX3 -t C,, install
ca.cer|
>     >         >
>     >         > |
>     >         >
>     >         > |ipa-certupdate |
>     >         >
>     >         > |
>     >         >
>     >         > |ipa-server-certinstall -w fullchain.pem privkey.pem|
>     >         >
>     >         > |then it askd me for directory manager password|
>     >         >
>     >         > |then it was asking for something private key unlock
>     password |
>     >         >
>     >         > |here i got atuck i dont know which password to
insert|
>     >
>     >         I can only assume that the private key is encrypted. You
>     need to
>     >         provide
>     >         the encryption key for it.
>     >
>     >         If you look at the contents of privkey.pem and it
starts with:
>     >
>     >         -----BEGIN ENCRYPTED PRIVATE KEY-----
>     >
>     >         then it is encrypted.
>     >
>     >         rob
>     >
>     >         >
>     >         > |
>     >         >
>     >         > |
>     >         >
>     >         > |
>     >         >
>     >         >
>     >         > On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden
>     >         <rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>
>     <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>
>     >         > <mailto:rcritten@redhat.com
<mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com
<mailto:rcritten@redhat.com>>
>     <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>>>> wrote:
>     >         >
>     >         >     Anush Jayan via FreeIPA-users wrote:
>     >         >     > im currently using freeipa 4.3.1 on ubuntu
16.04 im
>     >         having trouble
>     >         >     installing letsencrypt ssl key for https can
anyone help
>     >         me fix this
>     >         >     >
>     >         >
>     >         >     It would help if you said what you tried and what
>     you are
>     >         seeing.
>     >         >
>     >         >     rob
>     >         >
>     >
>     >
>     >
>     > _______________________________________________
>     > FreeIPA-users mailing list --
freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>     <mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>     > To unsubscribe send an email to
>     freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>     <mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>     > Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
>     > List Guidelines:
>     https://fedoraproject.org/wiki/Mailing_list_guidelines
>     > List Archives:
>   
 https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>     >
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>

Anush Jayan

11 Oct 11 Oct

1:34 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

can you tell me how can i install lets encrypt ssl certificate on freeipa 4.3 on Ubuntu 16.04 or centos 7.5 can you please guide me so that my web ui load without any https warning

On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden rcritten@redhat.com wrote:

...

Anush Jayan via FreeIPA-users wrote:

...
im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble

installing letsencrypt ssl key for https can anyone help me fix this

...
It would help if you said what you tried and what you are seeing.

rob

Anush Jayan

1:36 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

hi im getting duplicate certificate error

ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI

MPGPSDC.COM http://mpgpsdc.com/ IPA CA CT,C,C CN=DST Root CA X3,O=Digital Signature Trust Co. C,, CN=freeipa.do-blr.mpgpsdc.com http://ut-nagios01.do-blr.mpgpsdc.com/ u,u,u CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US ,,

ipa: DEBUG: stderr= ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 110, in run self.install_dirsrv_cert() File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 129, in install_dirsrv_cert 'restart_dirsrv %s' % serverid) File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 180, in import_cert command) File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py", line 302, in track_server_cert request_id = certmonger.start_tracking(nickname, self.secdir, password_file, command) File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py", line 357, in start_tracking result = cm.obj_if.add_request(params) File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line 651, in call_blocking message, timeout)

ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: The ipa-server-certinstall command failed, exception: DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: The ipa-server-certinstall command failed.

On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden rcritten@redhat.com wrote:

...

Anush Jayan via FreeIPA-users wrote:

...
im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble

installing letsencrypt ssl key for https can anyone help me fix this

...
It would help if you said what you tried and what you are seeing.

rob

Rob Crittenden

12 Oct 12 Oct

9:42 a.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Anush Jayan wrote:

...

hi im getting duplicate certificate error

ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI

MPGPSDC.COM http://mpgpsdc.com/ IPA CA CT,C,C CN=DST Root CA X3,O=Digital Signature Trust Co. C,, CN=freeipa.do-blr.mpgpsdc.com http://ut-nagios01.do-blr.mpgpsdc.com/ u,u,u CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US ,,

ipa: DEBUG: stderr= ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 110, in run self.install_dirsrv_cert() File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 129, in install_dirsrv_cert 'restart_dirsrv %s' % serverid) File "/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py", line 180, in import_cert command) File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py", line 302, in track_server_cert request_id = certmonger.start_tracking(nickname, self.secdir, password_file, command) File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py", line 357, in start_tracking result = cm.obj_if.add_request(params) File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line 651, in call_blocking message, timeout)

ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: The ipa-server-certinstall command failed, exception: DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: The ipa-server-certinstall command failed.

You just need to tell certmonger to stop tracking the old one:

# getcert stop-tracking -i 20181011115500

rob

...

On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:

Anush Jayan via FreeIPA-users wrote:
> im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
installing letsencrypt ssl key for https can anyone help me fix this
>

It would help if you said what you tried and what you are seeing.

rob

Anush Jayan

13 Oct 13 Oct

10:15 a.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

i did that but still its not serving page in https what should i do

On Fri, Oct 12, 2018, 8:12 PM Rob Crittenden rcritten@redhat.com wrote:

...

Anush Jayan wrote:

...
hi im getting duplicate certificate error

ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI

MPGPSDC.COM http://mpgpsdc.com/ IPA CA CT,C,C CN=DST Root CA X3,O=Digital Signature Trust Co. C,, CN=freeipa.do-blr.mpgpsdc.com http://ut-nagios01.do-blr.mpgpsdc.com/ u,u,u CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US ,,

ipa: DEBUG: stderr= ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File

"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 110, in run self.install_dirsrv_cert() File

"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 129, in install_dirsrv_cert 'restart_dirsrv %s' % serverid) File

"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 180, in import_cert command) File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py", line 302, in track_server_cert request_id = certmonger.start_tracking(nickname, self.secdir, password_file, command) File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py", line 357, in start_tracking result = cm.obj_if.add_request(params) File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line 651, in call_blocking message, timeout)

ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: The ipa-server-certinstall command failed, exception: DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: The ipa-server-certinstall command failed.

You just need to tell certmonger to stop tracking the old one:

# getcert stop-tracking -i 20181011115500

rob

...
On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Anush Jayan via FreeIPA-users wrote:
> im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
installing letsencrypt ssl key for https can anyone help me fix this
>

It would help if you said what you tried and what you are seeing.

rob

Anush Jayan

14 Oct 14 Oct

10:50 p.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

On Sat, Oct 13, 2018, 8:45 PM Anush Jayan anush@matchpointgps.com wrote:

...

i did that but still its not serving page in https what should i do

On Fri, Oct 12, 2018, 8:12 PM Rob Crittenden rcritten@redhat.com wrote:

...
Anush Jayan wrote:

...
hi im getting duplicate certificate error

ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI

MPGPSDC.COM http://mpgpsdc.com/ IPA CA CT,C,C CN=DST Root CA X3,O=Digital Signature Trust Co. C,, CN=freeipa.do-blr.mpgpsdc.com http://ut-nagios01.do-blr.mpgpsdc.com/ u,u,u CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US ,,

ipa: DEBUG: stderr= ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File

"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 110, in run self.install_dirsrv_cert() File

"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 129, in install_dirsrv_cert 'restart_dirsrv %s' % serverid) File

"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 180, in import_cert command) File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py", line 302, in track_server_cert request_id = certmonger.start_tracking(nickname, self.secdir, password_file, command) File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py", line 357, in start_tracking result = cm.obj_if.add_request(params) File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line 651, in call_blocking message, timeout)

ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: The ipa-server-certinstall command failed, exception: DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: The ipa-server-certinstall command failed.

You just need to tell certmonger to stop tracking the old one:

# getcert stop-tracking -i 20181011115500

rob

...
On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Anush Jayan via FreeIPA-users wrote:
> im currently using freeipa 4.3.1 on ubuntu 16.04 im having trouble
installing letsencrypt ssl key for https can anyone help me fix this
>

It would help if you said what you tried and what you are seeing.

rob

Anush Jayan

15 Oct 15 Oct

1:44 a.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

from where can i get Server-Cert file for freeipa or how can i create it Regards, *Anush Jayan * *Devops Engineer*

*TRACKPOINT GPS PVT. LTD.*

On Mon, Oct 15, 2018 at 9:20 AM Anush Jayan anush@matchpointgps.com wrote:

...

On Sat, Oct 13, 2018, 8:45 PM Anush Jayan anush@matchpointgps.com wrote:

...
i did that but still its not serving page in https what should i do

On Fri, Oct 12, 2018, 8:12 PM Rob Crittenden rcritten@redhat.com wrote:

...
Anush Jayan wrote:

...
hi im getting duplicate certificate error

ipa: DEBUG: stderr= ipa: DEBUG: Starting external process ipa: DEBUG: args=/usr/bin/certutil -d /etc/dirsrv/slapd-MPGPSDC-COM/ -L ipa: DEBUG: Process finished, return code=0 ipa: DEBUG: stdout= Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI

MPGPSDC.COM http://mpgpsdc.com/ IPA CA

...
       CT,C,C
CN=DST Root CA X3,O=Digital Signature Trust Co. C,, CN=freeipa.do-blr.mpgpsdc.com <http://ut-nagios01.do-blr.mpgpsdc.com/
                      u,u,u
CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US ,,

ipa: DEBUG: stderr= ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line 171, in execute return_value = self.run() File
"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 110, in run self.install_dirsrv_cert() File

"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 129, in install_dirsrv_cert 'restart_dirsrv %s' % serverid) File

"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",

...
line 180, in import_cert command) File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py", line 302, in track_server_cert request_id = certmonger.start_tracking(nickname, self.secdir, password_file, command) File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py", line 357, in start_tracking result = cm.obj_if.add_request(params) File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line 651, in call_blocking message, timeout)

ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG: The ipa-server-certinstall command failed, exception: DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20181011115500". ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR: The ipa-server-certinstall command failed.

You just need to tell certmonger to stop tracking the old one:

# getcert stop-tracking -i 20181011115500

rob

...
On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
Anush Jayan via FreeIPA-users wrote:
> im currently using freeipa 4.3.1 on ubuntu 16.04 im having
trouble

...
installing letsencrypt ssl key for https can anyone help me fix
this

...
>

It would help if you said what you tried and what you are seeing.

rob

Rob Crittenden

9:40 a.m.

New subject: need help to install letsencrypt in freeipa on ubuntu 16.04

Anush Jayan wrote:

...

i did that but still its not serving page in https what should i do

Removing the existing tracking by itself won't do anything. Re-run ipa-server-certinstall.

rob

...

On Fri, Oct 12, 2018, 8:12 PM Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:

Anush Jayan wrote:
> hi im getting duplicate certificate error 
>
>
>
> ipa: DEBUG: stderr=
> ipa: DEBUG: Starting external process
> ipa: DEBUG: args=/usr/bin/certutil -d
/etc/dirsrv/slapd-MPGPSDC-COM/ -L
> ipa: DEBUG: Process finished, return code=0
> ipa: DEBUG: stdout=
> Certificate Nickname                                         Trust
> Attributes                                                           
>  SSL,S/MIME,JAR/XPI
>
> MPGPSDC.COM <http://MPGPSDC.COM> <http://mpgpsdc.com/> IPA CA     
                         
>            CT,C,C
> CN=DST Root CA X3,O=Digital Signature Trust Co.              C,,
> CN=freeipa.do-blr.mpgpsdc.com <http://freeipa.do-blr.mpgpsdc.com>
<http://ut-nagios01.do-blr.mpgpsdc.com/> 
>                           u,u,u
> CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US           ,,
>
> ipa: DEBUG: stderr=
> ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall:
DEBUG: 
>  File "/usr/lib/python2.7/dist-packages/ipapython/admintool.py", line
> 171, in execute
>     return_value = self.run()
>   File
>
"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> line 110, in run
>     self.install_dirsrv_cert()
>   File
>
"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> line 129, in install_dirsrv_cert
>     'restart_dirsrv %s' % serverid)
>   File
>
"/usr/lib/python2.7/dist-packages/ipaserver/install/ipa_server_certinstall.py",
> line 180, in import_cert
>     command)
>   File "/usr/lib/python2.7/dist-packages/ipaserver/install/certs.py",
> line 302, in track_server_cert
>     request_id = certmonger.start_tracking(nickname, self.secdir,
> password_file, command)
>   File "/usr/lib/python2.7/dist-packages/ipapython/certmonger.py",
line
> 357, in start_tracking
>     result = cm.obj_if.add_request(params)
>   File "/usr/lib/python2.7/dist-packages/dbus/proxies.py", line
145, in
> __call__
>     **keywords)
>   File "/usr/lib/python2.7/dist-packages/dbus/connection.py", line
651,
> in call_blocking
>     message, timeout)
>
> ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: DEBUG:
> The ipa-server-certinstall command failed, exception: DBusException:
> org.fedorahosted.certmonger.duplicate: Certificate at same location is
> already used by request with nickname "20181011115500".
> ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
> org.fedorahosted.certmonger.duplicate: Certificate at same location is
> already used by request with nickname "20181011115500".
> ipa.ipaserver.install.ipa_server_certinstall.ServerCertInstall: ERROR:
> The ipa-server-certinstall command failed.

You just need to tell certmonger to stop tracking the old one:

# getcert stop-tracking -i 20181011115500

rob

>
>
> On Thu, Sep 27, 2018, 7:10 PM Rob Crittenden <rcritten@redhat.com
<mailto:rcritten@redhat.com>
> <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote:
>
>     Anush Jayan via FreeIPA-users wrote:
>     > im currently using freeipa 4.3.1 on ubuntu 16.04 im having
trouble
>     installing letsencrypt ssl key for https can anyone help me
fix this
>     >
>
>     It would help if you said what you tried and what you are seeing.
>
>     rob
>

2029

Age (days ago)

2047

Last active (days ago)

freeipa-users@lists.fedorahosted.org

18 comments

2 participants

tags (0)

participants (2)

Anush Jayan
Rob Crittenden