Hi all,
So, I have been working on creating certificates for services on a solid installation of FreeIPA on a machine we have.
I did everything that this blog stated to do...
https://blog.christophersmart.com/2014/08/24/creating-certs-and-keys-for-ser...
But now when I enter the command, sudo ipa-getcert list.
The status is CA_UNCONFIGURED, ca-error is "Error setting up ccache for "host" service on client using default keytab: Preauthentication failed.", stuck is yes.
I checked the krb5.keytab it's set to -rw------- and root:root.
I'm not sure what else I can do to address the problem. Any help would be appreciated.
Thanks!
Scott Reed via FreeIPA-users wrote:
Hi all,
So, I have been working on creating certificates for services on a solid installation of FreeIPA on a machine we have.
I did everything that this blog stated to do...
https://blog.christophersmart.com/2014/08/24/creating-certs-and-keys-for-ser...
But now when I enter the command, sudo ipa-getcert list.
The status is CA_UNCONFIGURED, ca-error is "Error setting up ccache for "host" service on client using default keytab: Preauthentication failed.", stuck is yes.
I checked the krb5.keytab it's set to -rw------- and root:root.
I'm not sure what else I can do to address the problem. Any help would be appreciated.
Is this an enrolled IPA client?
If so, what version of IPA is this, on what distribution and what commands have you run?
Does the keytab work? # kinit -kt /etc/krb5.keytab
rob
This was done on the server. Should it be done on the client machine? But yes, the target machine is an enrolled server.
The version is 4.6.5 API_VERSION 2.231
It's on a Centos machine.
The sudo kinit -kt /etc/krb5.keytab command returns, "Preauthentication failed while getting initial credentials"
Found the answer to my own problem. Yay me!
Certmonger is not running by default on a FreeIPA installation.
Start it with the following command:
sudo systemctl enable --now certmonger
Also, to answer my previous question about where to run the commands. The answer is to run them on the machine that is going to use the certificate and keys. Certmonger will communicate to the server to keep things synchronized.
Scott Reed via FreeIPA-users wrote:
Found the answer to my own problem. Yay me!
Certmonger is not running by default on a FreeIPA installation.
Start it with the following command:
sudo systemctl enable --now certmonger
certmonger is enabled by default on IPA systems. I don't know how it would become disabled.
rob
freeipa-users@lists.fedorahosted.org
-
Rob Crittenden -
Scott Reed