Hello!
Guys, I had set up FreeIPA 4.5 on Centos 7 with self-signed SSL cert. Now I want to install my main wildcard cert (from Comodo CA) for domain where IPA-server located, just for web-service, so web browsers won't complain to users about ssl. As expected - when I'm trying to do:
# ipa-server-certinstall -w comodo.crt comodo.key
I'm getting:
Peer's certificate issuer is not trusted ((SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is not recognized.). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate. The ipa-server-certinstall command failed.
I've found on https://support.comodo.com/index.php?/comodo/Knowledgebase/Article/View/979/... all CA certs for Comodo and set them up via
# ipa-cacert-manage -p DM_PASSWORD -n NICKNAME -t C,, install ca.crt # ipa-certupdate
As pointed on https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
But nontheless, when I'm trying after it - ipa-server-certinstall, I get above error anyway.
I'm starting to go crazy with it and don't know what should I do to solve this :( Help me please! Thank you.
randrewg--- via FreeIPA-users wrote:
Hello!
Guys, I had set up FreeIPA 4.5 on Centos 7 with self-signed SSL cert. Now I want to install my main wildcard cert (from Comodo CA) for domain where IPA-server located, just for web-service, so web browsers won't complain to users about ssl. As expected - when I'm trying to do:
# ipa-server-certinstall -w comodo.crt comodo.key
I'm getting:
Peer's certificate issuer is not trusted ((SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is not recognized.). Please run ipa-cacert-manage install and ipa-certupdate to install the CA certificate. The ipa-server-certinstall command failed.
I've found on https://support.comodo.com/index.php?/comodo/Knowledgebase/Article/View/979/... all CA certs for Comodo and set them up via
# ipa-cacert-manage -p DM_PASSWORD -n NICKNAME -t C,, install ca.crt # ipa-certupdate
As pointed on https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP
But nontheless, when I'm trying after it - ipa-server-certinstall, I get above error anyway.
I'm starting to go crazy with it and don't know what should I do to solve this :(
IPA requires the full chain. What I tend to do is grab the subject from the server cert and find the issuer, then look at the issuer of that, and continue working backwards until I find the self-signed original CA. Install all those CA certs and things should work.
Their bundles usually don't have the full chains because most other servers don't do the full chain checking that IPA does (because we've been burned too many times we are a bit twitchy about it).
rob
I see, mechanism is clear for me.
I took my CA chain from https://support.comodo.com/index.php?/comodo/Knowledgebase/Article/View/979/...
And my chain is following:
main cert Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA Subject: OU=Domain Control Validated, OU=EssentialSSL Wildcard, CN=*.mydomain.com
inter1 Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
inter2 Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
root Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root Subject: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
Is it seems correct? According sources from google - it's not. And what order to import CA's via ipa-cacert-manage? Am I should import them just one by one or from one file in correct order? https://www.ssllabs.com/ssltest/analyze.html tells me that chain is full and order is correct...
On 11/30/2017 08:24 AM, Andrew Radygin via FreeIPA-users wrote:
I see, mechanism is clear for me.
I took my CA chain from https://support.comodo.com/index.php?/comodo/Knowledgebase/Article/View/979/...
And my chain is following:
main cert Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA Subject: OU=Domain Control Validated, OU=EssentialSSL Wildcard, CN=*.mydomain.com
inter1 Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
inter2 Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
root Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root Subject: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root
Is it seems correct? According sources from google - it's not. And what order to import CA's via ipa-cacert-manage? Am I should import them just one by one or from one file in correct order? https://www.ssllabs.com/ssltest/analyze.html tells me that chain is full and order is correct... _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Hi,
the ca certs need to be added from the root to the one that issued the server cert: 1/ ipa-cacert-manage install root.crt + ipa-certupdate 2/ ipa-cacert-manage install inter1.crt + ipa-certupdate 3/ ipa-cacert-manage install inter2.crt + ipa-certupdate 4/ ipa-server-certinstall -w main.crt + restart http service
After step3, you can check that all the CA certs have been added to /etc/httpd/alias with $ certutil -L -d /etc/httdp/alias
HTH, Flo
On 11/30/2017 08:24 AM, Andrew Radygin via FreeIPA-users wrote: Hi,
the ca certs need to be added from the root to the one that issued the server cert: 1/ ipa-cacert-manage install root.crt + ipa-certupdate 2/ ipa-cacert-manage install inter1.crt + ipa-certupdate 3/ ipa-cacert-manage install inter2.crt + ipa-certupdate 4/ ipa-server-certinstall -w main.crt + restart http service
After step3, you can check that all the CA certs have been added to /etc/httpd/alias with $ certutil -L -d /etc/httdp/alias
HTH, Flo
Florence, I'm already added certs, but probably with wrong order, and now if I'm trying to add the same but in order you pointed, they aren't adding, even with another nicknames (with out any error, just don't showing in certutil -L). Maybe it's better to delete all new CA certs from databases and repeat adding with right order? How can I delete those certs? I suppose via certutil, but from what directories and databases should I do that? I tried something like that: certutil -D -d /etc/httdp/alias -n "Nickname" but after ipa-certupdate they show up again.
By the way, how can I include my private key to ipa-server-certinstall? Is it just # ipa-server-certinstall -w comodo.crt comodo.key ?
Also, if I'm trying to install file with only main domain cert (with out chain), command resulting in error:
# ipa-server-certinstall -w comodo_base.crt comodo.key Directory Manager password:
Enter private key unlock password:
The full certificate chain is not present in comodo_base.crt, comodo.key The ipa-server-certinstall command failed.
On 11/30/2017 10:30 AM, Andrew Radygin via FreeIPA-users wrote:
On 11/30/2017 08:24 AM, Andrew Radygin via FreeIPA-users wrote: Hi,
the ca certs need to be added from the root to the one that issued the server cert: 1/ ipa-cacert-manage install root.crt + ipa-certupdate 2/ ipa-cacert-manage install inter1.crt + ipa-certupdate 3/ ipa-cacert-manage install inter2.crt + ipa-certupdate 4/ ipa-server-certinstall -w main.crt + restart http service
After step3, you can check that all the CA certs have been added to /etc/httpd/alias with $ certutil -L -d /etc/httdp/alias
HTH, Flo
Florence, I'm already added certs, but probably with wrong order, and now if I'm trying to add the same but in order you pointed, they aren't adding, even with another nicknames (with out any error, just don't showing in certutil -L).
Hi,
no need to start over with a different nickname if the certificates are already in LDAP. "ipa-cacert-manage install" adds them in the LDAP server below cn=certificates,cn=ipa,cn=etc,$BASEDN, so I would start by checking if they are all present there: ldapsearch -h localhost -p 389 -D cn=directory\ manager -W -b cn=certificates,cn=ipa,cn=etc,$BASEDN (replace BASEDN with your deployment's basedn that can be found in /etc/ipa/default.conf)
The entries will also contain an attribute ipakeytrust (either trusted or distrusted). Please check that they are all trusted.
Maybe it's better to delete all new CA certs from databases and repeat adding with right order? How can I delete those certs? I suppose via certutil, but from what directories and databases should I do that? I tried something like that: certutil -D -d /etc/httdp/alias -n "Nickname" but after ipa-certupdate they show up again.
That is expected as ipa-certupdate retrieves the certs from LDAP and installs them in the /etc/httpd/alias NSS database.
By the way, how can I include my private key to ipa-server-certinstall? Is it just # ipa-server-certinstall -w comodo.crt comodo.key ?
Also, if I'm trying to install file with only main domain cert (with out chain), command resulting in error:
# ipa-server-certinstall -w comodo_base.crt comodo.key Directory Manager password:
Enter private key unlock password:
The full certificate chain is not present in comodo_base.crt, comodo.key The ipa-server-certinstall command failed.
You can supply multiple files to ipa-server-certinstall, containing the cert, the key, and the cert chain. For instance ipa-server-certinstall -w server.cert server.key cachain.cert where server.cert contains only the cert, server.key only the key, and cachain.cert contains the root, inter1 and inter2 certs.
Flo
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
On 11/30/2017 10:30 AM, Andrew Radygin via FreeIPA-users wrote:
Hi,
no need to start over with a different nickname if the certificates are already in LDAP. "ipa-cacert-manage install" adds them in the LDAP server below cn=certificates,cn=ipa,cn=etc,$BASEDN, so I would start by checking if they are all present there: ldapsearch -h localhost -p 389 -D cn=directory\ manager -W -b cn=certificates,cn=ipa,cn=etc,$BASEDN (replace BASEDN with your deployment's basedn that can be found in /etc/ipa/default.conf)
The entries will also contain an attribute ipakeytrust (either trusted or distrusted). Please check that they are all trusted.
All CA's in ldap directory have 'ipaKeyTrust: trusted'.
That is expected as ipa-certupdate retrieves the certs from LDAP and installs them in the /etc/httpd/alias NSS database.
You can supply multiple files to ipa-server-certinstall, containing the cert, the key, and the cert chain. For instance ipa-server-certinstall -w server.cert server.key cachain.cert where server.cert contains only the cert, server.key only the key, and cachain.cert contains the root, inter1 and inter2 certs.
Got it!
Wow, I found what I missed. One of the certs from chain isn't adding with forllowing error:
# ipa-cacert-manage -p 2xHKp17zQpdG -n Comodointer2 -t C,, install comodo_inter2.crt Installing CA certificate, please wait Failed to install the certificate: subject public key info mismatch The ipa-cacert-manage command failed.
Probably this is root cause of the problem, but it's not clear for me how to resolve it. From https://www.freeipa.org/page/Troubleshooting I found description of the error:
Subject public key info mismatch The new CA certificate issued by the external CA uses a different public / private key pair than the old CA certificate.
But nothing about how to fix it...
Flo
Does anybody have any clue about what I have to do with it? Florence? Should I delete self-sign SSL from ipa-server CA completely? As I understood - there is some conflict between new CA and old, am I right?
2017-11-30 14:33 GMT+03:00 Andrew Radygin via FreeIPA-users < freeipa-users@lists.fedorahosted.org>:
On 11/30/2017 10:30 AM, Andrew Radygin via FreeIPA-users wrote:
Hi,
no need to start over with a different nickname if the certificates are already in LDAP. "ipa-cacert-manage install" adds them in the LDAP server below cn=certificates,cn=ipa,cn=etc,$BASEDN, so I would start by checking if they are all present there: ldapsearch -h localhost -p 389 -D cn=directory\ manager -W -b cn=certificates,cn=ipa,cn=etc,$BASEDN (replace BASEDN with your deployment's basedn that can be found in /etc/ipa/default.conf)
The entries will also contain an attribute ipakeytrust (either trusted or distrusted). Please check that they are all trusted.
All CA's in ldap directory have 'ipaKeyTrust: trusted'.
That is expected as ipa-certupdate retrieves the certs from LDAP and installs them in the /etc/httpd/alias NSS database.
You can supply multiple files to ipa-server-certinstall, containing the cert, the key, and the cert chain. For instance ipa-server-certinstall -w server.cert server.key cachain.cert where server.cert contains only the cert, server.key only the key, and cachain.cert contains the root, inter1 and inter2 certs.
Got it!
Wow, I found what I missed. One of the certs from chain isn't adding with forllowing error:
# ipa-cacert-manage -p 2xHKp17zQpdG -n Comodointer2 -t C,, install comodo_inter2.crt Installing CA certificate, please wait Failed to install the certificate: subject public key info mismatch The ipa-cacert-manage command failed.
Probably this is root cause of the problem, but it's not clear for me how to resolve it. From https://www.freeipa.org/page/Troubleshooting I found description of the error:
Subject public key info mismatch The new CA certificate issued by the external CA uses a different public / private key pair than the old CA certificate.
But nothing about how to fix it...
Flo
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
On 12/01/2017 09:29 AM, Andrew Radygin via FreeIPA-users wrote:
Does anybody have any clue about what I have to do with it? Florence? Should I delete self-sign SSL from ipa-server CA completely? As I understood - there is some conflict between new CA and old, am I right?
Hi,
can you check if there are other certificates with the same subject name "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA" in the ldap tree (below cn=certificates,cn=ipa,cn=etc,$BASEDN), or in /etc/httpd/alias? The error seems to indicate that there is already a cert with this name but that is using a different key.
If it is the case, you can remove it with ldapdelete then certutil -D and retry to run ipa-cacert-manage install.
Flo
2017-11-30 14:33 GMT+03:00 Andrew Radygin via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org>:
> On 11/30/2017 10:30 AM, Andrew Radygin via FreeIPA-users wrote: > > Hi, > > no need to start over with a different nickname if the certificates are > already in LDAP. "ipa-cacert-manage install" adds them in the LDAP > server below cn=certificates,cn=ipa,cn=etc,$BASEDN, so I would start by > checking if they are all present there: > ldapsearch -h localhost -p 389 -D cn=directory\ manager -W -b > cn=certificates,cn=ipa,cn=etc,$BASEDN > (replace BASEDN with your deployment's basedn that can be found in > /etc/ipa/default.conf) > > The entries will also contain an attribute ipakeytrust (either trusted > or distrusted). Please check that they are all trusted. All CA's in ldap directory have 'ipaKeyTrust: trusted'. > That is expected as ipa-certupdate > retrieves the certs from LDAP and > installs them in the /etc/httpd/alias NSS database. > > You can supply multiple files to ipa-server-certinstall, containing the > cert, the key, and the cert chain. For instance > ipa-server-certinstall -w server.cert server.key cachain.cert > where server.cert contains only the cert, server.key only the key, and > cachain.cert contains the root, inter1 and inter2 certs. Got it! Wow, I found what I missed. One of the certs from chain isn't adding with forllowing error: # ipa-cacert-manage -p 2xHKp17zQpdG -n Comodointer2 -t C,, install comodo_inter2.crt Installing CA certificate, please wait Failed to install the certificate: subject public key info mismatch The ipa-cacert-manage command failed. Probably this is root cause of the problem, but it's not clear for me how to resolve it. From https://www.freeipa.org/page/Troubleshooting <https://www.freeipa.org/page/Troubleshooting> I found description of the error: Subject public key info mismatch The new CA certificate issued by the external CA uses a different public / private key pair than the old CA certificate. But nothing about how to fix it... > Flo _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org>-- Best regards, Andrew.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Wow, Flo!!! You were right, there was such cert with another key. Done that in such way: ldapdelete "cn=Comodo3,cn=certificates,cn=ipa,cn=etc,dc=domain,dc=net" /usr/bin/certutil -d /etc/ipa/nssdb -D -n Comodo3 /usr/bin/certutil -d /etc/httpd/alias/ -D -n Comodo3 ipa-cacert-manager install comodo_inter2.crt ipa-server-certinstall -w comodo_base.crt comodo.key comodo_ca.crt systemctl restart httpd
Thank you, really-really thank you! :)
2017-12-01 11:40 GMT+03:00 Florence Blanc-Renaud flo@redhat.com:
On 12/01/2017 09:29 AM, Andrew Radygin via FreeIPA-users wrote:
Does anybody have any clue about what I have to do with it? Florence? Should I delete self-sign SSL from ipa-server CA completely? As I understood - there is some conflict between new CA and old, am I right?
Hi,
can you check if there are other certificates with the same subject name "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA" in the ldap tree (below cn=certificates,cn=ipa,cn=etc,$BASEDN), or in /etc/httpd/alias? The error seems to indicate that there is already a cert with this name but that is using a different key.
If it is the case, you can remove it with ldapdelete then certutil -D and retry to run ipa-cacert-manage install.
Flo
2017-11-30 14:33 GMT+03:00 Andrew Radygin via FreeIPA-users <
freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fe dorahosted.org>:
> On 11/30/2017 10:30 AM, Andrew Radygin via FreeIPA-users wrote: > > Hi, > > no need to start over with a different nickname if the certificatesare > already in LDAP. "ipa-cacert-manage install" adds them in the LDAP > server below cn=certificates,cn=ipa,cn=etc,$BASEDN, so I would start by > checking if they are all present there: > ldapsearch -h localhost -p 389 -D cn=directory\ manager -W -b > cn=certificates,cn=ipa,cn=etc,$BASEDN > (replace BASEDN with your deployment's basedn that can be found in > /etc/ipa/default.conf) > > The entries will also contain an attribute ipakeytrust (either trusted > or distrusted). Please check that they are all trusted.
All CA's in ldap directory have 'ipaKeyTrust: trusted'. > That is expected as ipa-certupdate > retrieves the certs from LDAP and > installs them in the /etc/httpd/alias NSS database. > > You can supply multiple files to ipa-server-certinstall, containingthe > cert, the key, and the cert chain. For instance > ipa-server-certinstall -w server.cert server.key cachain.cert > where server.cert contains only the cert, server.key only the key, and > cachain.cert contains the root, inter1 and inter2 certs.
Got it! Wow, I found what I missed. One of the certs from chain isn't adding with forllowing error: # ipa-cacert-manage -p 2xHKp17zQpdG -n Comodointer2 -t C,, install comodo_inter2.crt Installing CA certificate, please wait Failed to install the certificate: subject public key info mismatch The ipa-cacert-manage command failed. Probably this is root cause of the problem, but it's not clear for me how to resolve it. From https://www.freeipa.org/page/Troubleshooting <https://www.freeipa.org/page/Troubleshooting> I found description of the error: Subject public key info mismatch The new CA certificate issued by the external CA uses a different public / private key pair than the old CA certificate. But nothing about how to fix it... > Flo _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org>-- Best regards, Andrew.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedo rahosted.org
On 12/01/2017 10:22 AM, Andrew Radygin via FreeIPA-users wrote:
Wow, Flo!!! You were right, there was such cert with another key. Done that in such way: ldapdelete "cn=Comodo3,cn=certificates,cn=ipa,cn=etc,dc=domain,dc=net" /usr/bin/certutil -d /etc/ipa/nssdb -D -n Comodo3 /usr/bin/certutil -d /etc/httpd/alias/ -D -n Comodo3 ipa-cacert-manager install comodo_inter2.crt ipa-server-certinstall -w comodo_base.crt comodo.key comodo_ca.crt systemctl restart httpd
Thank you, really-really thank you! :)
Well, thank you for providing confirmation that you managed to fix the issue. It's always nice to be able to close a thread on a positive outcome!
Flo
2017-12-01 11:40 GMT+03:00 Florence Blanc-Renaud <flo@redhat.com mailto:flo@redhat.com>:
On 12/01/2017 09:29 AM, Andrew Radygin via FreeIPA-users wrote: Does anybody have any clue about what I have to do with it? Florence? Should I delete self-sign SSL from ipa-server CA completely? As I understood - there is some conflict between new CA and old, am I right? Hi, can you check if there are other certificates with the same subject name "C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA" in the ldap tree (below cn=certificates,cn=ipa,cn=etc,$BASEDN), or in /etc/httpd/alias? The error seems to indicate that there is already a cert with this name but that is using a different key. If it is the case, you can remove it with ldapdelete then certutil -D and retry to run ipa-cacert-manage install. Flo 2017-11-30 14:33 GMT+03:00 Andrew Radygin via FreeIPA-users <freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> <mailto:freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>>>: > On 11/30/2017 10:30 AM, Andrew Radygin via FreeIPA-users wrote: > > Hi, > > no need to start over with a different nickname if the certificates are > already in LDAP. "ipa-cacert-manage install" adds them in the LDAP > server below cn=certificates,cn=ipa,cn=etc,$BASEDN, so I would start by > checking if they are all present there: > ldapsearch -h localhost -p 389 -D cn=directory\ manager -W -b > cn=certificates,cn=ipa,cn=etc,$BASEDN > (replace BASEDN with your deployment's basedn that can be found in > /etc/ipa/default.conf) > > The entries will also contain an attribute ipakeytrust (either trusted > or distrusted). Please check that they are all trusted. All CA's in ldap directory have 'ipaKeyTrust: trusted'. > That is expected as ipa-certupdate > retrieves the certs from LDAP and > installs them in the /etc/httpd/alias NSS database. > > You can supply multiple files to ipa-server-certinstall, containing the > cert, the key, and the cert chain. For instance > ipa-server-certinstall -w server.cert server.key cachain.cert > where server.cert contains only the cert, server.key only the key, and > cachain.cert contains the root, inter1 and inter2 certs. Got it! Wow, I found what I missed. One of the certs from chain isn't adding with forllowing error: # ipa-cacert-manage -p 2xHKp17zQpdG -n Comodointer2 -t C,, install comodo_inter2.crt Installing CA certificate, please wait Failed to install the certificate: subject public key info mismatch The ipa-cacert-manage command failed. Probably this is root cause of the problem, but it's not clear for me how to resolve it. From https://www.freeipa.org/page/Troubleshooting <https://www.freeipa.org/page/Troubleshooting> <https://www.freeipa.org/page/Troubleshooting <https://www.freeipa.org/page/Troubleshooting>> I found description of the error: Subject public key info mismatch The new CA certificate issued by the external CA uses a different public / private key pair than the old CA certificate. But nothing about how to fix it... > Flo _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> <mailto:freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org> <mailto:freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org>> -- Best regards, Andrew. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org <mailto:freeipa-users-leave@lists.fedorahosted.org>-- Best regards, Andrew.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
freeipa-users@lists.fedorahosted.org
-
Andrew Radygin -
Florence Blanc-Renaud -
randrewg＠gmail.com
-
Rob Crittenden