Hello,
We are able to add ipa-client, but ipa-replica-install fails at the point when it starts replication process.
On at the log we noticed that, it fails due to LDAP connections.
ldapsearch from client works, on same host which we are trying to create replica. (ran ipa-client to test and then uninstall).
[root@ds04 certs]# ldapsearch -x -v -H ldaps://ds01.example.com -s base -b '' namingContexts -d 1 ldap_url_parse_ext(ldaps://ds01.example.com) ldap_initialize( ldaps://ds01.example.com:636/??base ) ldap_create ldap_url_parse_ext(ldaps://ds01.example.com:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ds01.example.com:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.10.146:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success TLS: certdb config: configDir='/etc/openldap/certs' tokenDescription='ldap(0)' certPrefix='' keyPrefix='' flags=readOnly TLS: using moznss security dir /etc/openldap/certs prefix . TLS: certificate [CN=Certificate Authority,O=EXAMPLE.COM] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user.. TLS: error: connect - force handshake failure: errno 21 - moznss error -8172 TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) [root@ds04 certs]#
Our ds01:/etc/openldap/ldap.conf is set to: SASL_NOCANON on URI ldaps://ds01.example.com BASE dc=example,dc=com #TLS_CACERT /etc/openldap/certs/cacert.crt TLS_CACERT /etc/ipa/ca.crt
[root@ds01 openldap]# certutil -d /etc/openldap/cacerts -L certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.
All other replicas and clients (including new) runs this command perfectly fine.
Can not figure out past couple of days.
thank you and with regards, Bhavin
On 10/27/2017 06:41 PM, Bhavin Vaidya via FreeIPA-users wrote:
ldapsearch from client works, on same host which we are trying to create replica. (ran ipa-client to test and then uninstall). [root@ds04 certs]# ldapsearch -x -v -H ldaps://ds01.example.com -s base -b '' namingContexts -d 1 ... TLS: certificate [CN=Certificate Authority,O=EXAMPLE.COM] is not valid
- error -8172:Peer's certificate issuer has been marked as not trusted
by the user.. ... ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
It doesn't look like ldapsearch is working. Why do you say that it works?
[root@ds01 openldap]# certutil -d /etc/openldap/cacerts -L certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.
I'm not sure that's relevant to the problem you're having on ds04, since that directory isn't used by the FreeIPA LDAP server (as far as I know). But now it looks like ds04 doesn't have the CA cert for FreeIPA, and therefore does not trust its TLS certificates. Without that trust, it naturally follows that both ldapsearch fails and replication does not start.
It also looks like your FreeIPA installation on ds01 is somehow inconsistent, with /etc/openldap/certs being out of date or corrupt. That may or may not be related.
If this problem only affects one host, I'd suggest wiping it clean and starting over. If you can't add any new host, then it would probably be helpful to see the logs from the ipa server setup on a brand new host which you try to add to the cluster.
freeipa-users@lists.fedorahosted.org
-
Bhavin Vaidya -
Gordon Messmer