Re: [Pki-users] Invalid Credential / User not found

Ebbe: Thanks for trying out Dogtag. A few tips to help out below. During the wizard when you saw the message "This certificate can’t be verified and will not be imported. The certificate issuer might be unknown or untrusted, the certificate might have expired or been revoked, or the certificate might not have been approved.", you most probably had your agent certificate imported OK. We have a bug for this that we are working on. This message shows up despite an actual successful import. The "preop.pin" you speak of is used in the case that one has not yet completed the installation wizard. Here are few things you can try: 1. If you have already finished the wizard, you should be able to simply proceed to the agent interface URL without any pin, provided you have successfully imported the Admin cert. Simply go to "https://host.example.com:9443" and see if you can proceed using the agent interface. 2. If the nasty error message from above scared you off of actually finishing the configuration wizard, go back and do so. This is done with the URL that gets printed when the instance is installed. It looks something like: http://host.example.com:9080/ca/admin/console/config/login?<preop.pin> 3. If everything is too confused, you can start the process over by using our "pkiremove" tool which removes an existing instance. Try something like, as root: pkiremove -pki_instance_root=/var/lib -pki_instance_name=pki-ca The "pki-ca" at the end is the name of the instance you are trying to remove. The very first instance that is installed when you install the RPM is in fact "pki-ca". From here you can try again by doing the following as root: rpm -ev pki-ca yum install pki-ca This will reinstall your RPM for the CA and create a brand new instance. Note: Make sure you have used "pkiremove" to remove all instances you may have created before trying this. 4. If the above is too confusing, we can hash it out on the "#dogtag-pi" IRC channel. thanks, jack Ebbe Hansen wrote: