7:39 p.m.
Hi John, thanks for the feedback.
I used this URL as help to disable self tests.
https://www.dogtagpki.org/wiki/Offline_System_Certificate_Renewal#Manual_...
Many of "pki-server" command options are not present for me, since pki-server
version is 10.3, I believe the doc applies for 10.5.
But I was able to disable self test and PKI is responsive now.
After system time is back, I use 'getcert resubmit' to renew a cert and seeing
this certmonger errors
Basically is some :
"ACIError: Insufficient access: Invalid credentials"
[journalctl messages]
------------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call
last):#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit",
line 511, in <module>#012 sys.exit(main())#012 File
"/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main#012 if ca.is_renewal_master():#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1188,
in is_renewal_master#012 self.ldap_connect()#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177, in
ldap_connect#012 conn.do_bind(self.dm_password, autobind=self.autobind)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind#012 self.do_sasl_gssapi_bind(timeout=timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind#012 self.__bind_with_wait(self.gssapi_bind, timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650, in
__bind_with_wait#012 bind_func(*args, **kwargs)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind#012 '', auth_tokens, server_controls, client_controls)#012 File
"/usr/lib64/python2.7/contextlib.py", line 35, in __exit__#012
self.gen.throw(type, value, traceback)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler#012 raise errors.ACIError(info="%s %s" % (info,
desc))#012ACIError: Insufficient access: Invalid credentials
[syslog messages]
------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit[9333]: Traceback (most recent
call last):
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 511, in
<module>
sys.exit(main())
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main if ca.is_renewal_master():
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1188, in is_renewal_master
self.ldap_connect()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177,
in ldap_connect
conn.do_bind(self.dm_password, autobind=self.autobind)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind
self.do_sasl_gssapi_bind(timeout=timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind
self.__bind_with_wait(self.gssapi_bind, timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650, in
__bind_with_wait
bind_func(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind
'', auth_tokens, server_controls, client_controls)
File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler
raise errors.ACIError(info="%s %s" % (info, desc))
ACIError: Insufficient access: Invalid credentials
Aug 10 01:04:34 ca-ldap01 certmonger[8834]: 2018-08-10 01:04:34 [8834] Internal error
Is there any URL that's relevant for pki 10.3
thanks in advance, Zarko
________________________________
From: John Magne <jmagne(a)redhat.com>
Sent: Wednesday, November 14, 2018 6:16 PM
To: Z D
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi:
YOu can try to temporarily disable the self tests for you ca, until
the new certs are resolved.
Look in the CS.cfg file for the ca in question and there is a big section
controlling the self tests. Just experiment with commenting out the tests and see if that
gets you past the hurdle..
<https://www.redhat.com/mailman/listinfo/pki-users>
12:40 p.m.
New subject: expired pki-server 10.3.3 certificates
Hi Zarko,
May be this documentation might help?
https://www.dogtagpki.org/wiki/System_Certificate_Renewal
It has instructions for 10.3 or earlier. Let us know if that helped!
Regards,Dinesh
On Sun, 2018-11-18 at 01:39 +0000, Z D wrote:
Hi John, thanks for the feedback.
I used this URL as help to disable self tests.
https://www.dogtagpki.org/wiki/Offline_System_Certificate_Renewal#Manual_...
Many of "pki-server" command options are not present for me, since
pki-server version is 10.3, I believe the doc applies for 10.5.
But I was able to disable self test and PKI is responsive now.
After system time is back, I use 'getcert resubmit' to renew a cert
and seeing this certmonger errors
Basically is some :
"ACIError: Insufficient access: Invalid credentials"
[journalctl messages]
------------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit: Traceback
(most recent call last):#012 File "/usr/libexec/certmonger/dogtag-
ipa-ca-renew-agent-submit", line 511, in <module>#012
sys.exit(main())#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-
renew-agent-submit",
line 497, in main#012 if ca.is_renewal_master():#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 1188, in is_renewal_master#012 self.ldap_connect()#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 177, in ldap_connect#012 conn.do_bind(self.dm_password,
autobind=self.autobind)#012 File "/usr/lib/python2.7/site-
packages/ipapython/ipaldap.py", line 1690, in do_bind#012
self.do_sasl_gssapi_bind(timeout=timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py",
line 1668, in do_sasl_gssapi_bind#012
self.__bind_with_wait(self.gssapi_bind, timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650,
in __bind_with_wait#012 bind_func(*args, **kwargs)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py",
line 1108, in gssapi_bind#012 '', auth_tokens, server_controls,
client_controls)#012 File "/usr/lib64/python2.7/contextlib.py", line
35, in __exit__#012 self.gen.throw(type, value, traceback)#012
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py",
line 973, in error_handler#012 raise errors.ACIError(info="%s %s"
% (info, desc))#012ACIError: Insufficient access: Invalid
credentials
[syslog messages]
------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit[9333]:
Traceback (most recent call last):
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line
511, in <module>
sys.exit(main())
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line
497, in main if ca.is_renewal_master():
File "/usr/lib/python2.7/site-
packages/ipaserver/install/cainstance.py", line 1188, in
is_renewal_master
self.ldap_connect()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py",
line 177, in ldap_connect
conn.do_bind(self.dm_password, autobind=self.autobind)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
1690, in do_bind
self.do_sasl_gssapi_bind(timeout=timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
1668, in do_sasl_gssapi_bind
self.__bind_with_wait(self.gssapi_bind, timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
1650, in __bind_with_wait
bind_func(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
1108, in gssapi_bind
'', auth_tokens, server_controls, client_controls)
File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
973, in error_handler
raise errors.ACIError(info="%s %s" % (info, desc))
ACIError: Insufficient access: Invalid credentials
Aug 10 01:04:34 ca-ldap01 certmonger[8834]: 2018-08-10 01:04:34
[8834] Internal error
Is there any URL that's relevant for pki 10.3
thanks in advance, Zarko
From: John Magne <jmagne(a)redhat.com>
Sent: Wednesday, November 14, 2018 6:16 PM
To: Z D
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi:
YOu can try to temporarily disable the self tests for you ca, until
the new certs are resolved.
Look in the CS.cfg file for the ca in question and there is a big
section
controlling the self tests. Just experiment with commenting out the
tests and see if that
gets you past the hurdle..
_______________________________________________Pki-users mailing
listPki-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-users
12:15 a.m.
New subject: expired pki-server 10.3.3 certificates
Thanks Dinesh, I was able to submit request using caManualRenewal.xml file, but I need
clarity about approval.
I believe default CA admin can be used as CA agent. So password I use for "-c"
is the one I have in files like
/root/.dogtag/pki-tomcat/ca/password.conf and
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
NSS database is located in /etc/pki/pki-tomcat/alias, is this the one I should use for
"-d" ?
The command:
pki -d /etc/pki/pki-tomcat/alias -n admin -c <password> ca-cert-request-review 7
--action approve
give the output:
IncorrectPasswordException: Incorrect client security database password.
________________________________
From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com>
Sent: Sunday, November 18, 2018 10:40:01 AM
To: Z D; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi Zarko,
May be this documentation might help?
https://www.dogtagpki.org/wiki/System_Certificate_Renewal
It has instructions for 10.3 or earlier. Let us know if that helped!
Regards,
Dinesh
On Sun, 2018-11-18 at 01:39 +0000, Z D wrote:
Hi John, thanks for the feedback.
I used this URL as help to disable self tests.
https://www.dogtagpki.org/wiki/Offline_System_Certificate_Renewal#Manual_...
Many of "pki-server" command options are not present for me, since pki-server
version is 10.3, I believe the doc applies for 10.5.
But I was able to disable self test and PKI is responsive now.
After system time is back, I use 'getcert resubmit' to renew a cert and seeing
this certmonger errors
Basically is some :
"ACIError: Insufficient access: Invalid credentials"
[journalctl messages]
------------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call
last):#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit",
line 511, in <module>#012 sys.exit(main())#012 File
"/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main#012 if ca.is_renewal_master():#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1188,
in is_renewal_master#012 self.ldap_connect()#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177, in
ldap_connect#012 conn.do_bind(self.dm_password, autobind=self.autobind)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind#012 self.do_sasl_gssapi_bind(timeout=timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind#012 self.__bind_with_wait(self.gssapi_bind, timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650, in
__bind_with_wait#012 bind_func(*args, **kwargs)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind#012 '', auth_tokens, server_controls, client_controls)#012 File
"/usr/lib64/python2.7/contextlib.py", line 35, in __exit__#012
self.gen.throw(type, value, traceback)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler#012 raise errors.ACIError(info="%s %s" % (info,
desc))#012ACIError: Insufficient access: Invalid credentials
[syslog messages]
------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit[9333]: Traceback (most recent
call last):
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 511, in
<module>
sys.exit(main())
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main if ca.is_renewal_master():
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1188, in is_renewal_master
self.ldap_connect()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177,
in ldap_connect
conn.do_bind(self.dm_password, autobind=self.autobind)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind
self.do_sasl_gssapi_bind(timeout=timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind
self.__bind_with_wait(self.gssapi_bind, timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650, in
__bind_with_wait
bind_func(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind
'', auth_tokens, server_controls, client_controls)
File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler
raise errors.ACIError(info="%s %s" % (info, desc))
ACIError: Insufficient access: Invalid credentials
Aug 10 01:04:34 ca-ldap01 certmonger[8834]: 2018-08-10 01:04:34 [8834] Internal error
Is there any URL that's relevant for pki 10.3
thanks in advance, Zarko
________________________________
From: John Magne <jmagne(a)redhat.com>
Sent: Wednesday, November 14, 2018 6:16 PM
To: Z D
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi:
YOu can try to temporarily disable the self tests for you ca, until
the new certs are resolved.
Look in the CS.cfg file for the ca in question and there is a big section
controlling the self tests. Just experiment with commenting out the tests and see if that
gets you past the hurdle..
<https://www.redhat.com/mailman/listinfo/pki-users>
_______________________________________________
Pki-users mailing list
Pki-users@redhat.com<mailto:Pki-users@redhat.com>
https://www.redhat.com/mailman/listinfo/pki-users
9:01 a.m.
New subject: expired pki-server 10.3.3 certificates
Z D,
No. The "approve" operation you are trying to achieve is an action from
admin. So, you need to change this to the following:
`pki -d <client nss db location> -c <client nss db pass> -n <admin cert
nickname> ca-cert-request-review 7 --action approve`
-d = either /root/.dogtagpki/pki-tomcat/ca/alias OR
/root/.dogtagpki/nssdb-c = The password for the nssdb that you point in
-d-n = the nickname of the cert in the nssdb that you point in -d. Do a
`certutil -L -d /root/.dogtagpki/pki-tomcat/ca/alias` to give you a
list of certs available in the nssdb.
NOTE:1. You need to have a valid client admin cert to approve the
request2. This client admin cert must be available in ldap server
Reference:https://www.dogtagpki.org/wiki/PKI_Client_CLI
Regards,Dinesh
On Mon, 2018-11-19 at 06:15 +0000, Z D wrote:
Thanks Dinesh, I was able to submit request using
caManualRenewal.xml file, but I need clarity about approval.
I believe default CA admin can be used as CA agent. So password I use
for "-c" is the one I have in files like
/root/.dogtag/pki-tomcat/ca/password.conf and
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
NSS database is located in /etc/pki/pki-tomcat/alias, is this the one
I should use for "-d" ?
The command:
pki -d /etc/pki/pki-tomcat/alias -n admin -c <password> ca-cert-
request-review 7 --action approve
give the output:
IncorrectPasswordException: Incorrect client security database
password.
From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com>
Sent: Sunday, November 18, 2018 10:40:01 AM
To: Z D; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
<!--
p
{margin-top:0;
margin-bottom:0}
-->
Hi Zarko,
May be this documentation might help?
https://www.dogtagpki.org/wiki/System_Certificate_Renewal
It has instructions for 10.3 or earlier. Let us know if that helped!
Regards,
Dinesh
On Sun, 2018-11-18 at 01:39 +0000, Z D wrote:
>
> Hi John, thanks for the feedback.
>
>
>
>
>
> I used this URL as help to disable self tests.
>
>
>
>
https://www.dogtagpki.org/wiki/Offline_System_Certificate_Renewal#Manual_...
>
>
>
> Many of "pki-server" command options are not present for me, since
> pki-server version is 10.3, I believe the doc applies for 10.5.
>
>
>
>
> But I was able to disable self test and PKI is responsive now.
>
>
>
> After system time is back, I use 'getcert resubmit' to renew a cert
> and seeing this certmonger errors
>
>
>
>
>
> Basically is some :
>
>
>
> "ACIError: Insufficient access: Invalid credentials"
>
>
>
>
>
> [journalctl messages]
>
>
>
> ------------------------------
>
>
>
> Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit:
> Traceback (most recent call last):#012 File
> "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line
> 511, in <module>#012 sys.exit(main())#012 File
> "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit",
> line 497, in main#012 if ca.is_renewal_master():#012 File
> "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
> line 1188, in is_renewal_master#012 self.ldap_connect()#012
> File "/usr/lib/python2.7/site-
> packages/ipaserver/install/service.py",
> line 177, in ldap_connect#012 conn.do_bind(self.dm_password,
> autobind=self.autobind)#012 File "/usr/lib/python2.7/site-
> packages/ipapython/ipaldap.py", line 1690, in do_bind#012
> self.do_sasl_gssapi_bind(timeout=timeout)#012 File
> "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py",
> line 1668, in do_sasl_gssapi_bind#012
> self.__bind_with_wait(self.gssapi_bind, timeout)#012 File
> "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650,
> in __bind_with_wait#012 bind_func(*args, **kwargs)#012 File
> "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py",
> line 1108, in gssapi_bind#012 '', auth_tokens, server_controls,
> client_controls)#012 File "/usr/lib64/python2.7/contextlib.py",
> line 35, in __exit__#012 self.gen.throw(type, value,
> traceback)#012 File "/usr/lib/python2.7/site-
> packages/ipapython/ipaldap.py",
> line 973, in error_handler#012 raise errors.ACIError(info="%s
> %s" % (info, desc))#012ACIError: Insufficient access: Invalid
> credentials
>
>
>
>
>
>
>
>
>
>
> [syslog messages]
>
> ------------------------
>
>
>
> Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit[9333]:
> Traceback (most recent call last):
>
> File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit",
> line 511, in <module>
>
> sys.exit(main())
>
> File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit",
> line 497, in main if ca.is_renewal_master():
>
> File "/usr/lib/python2.7/site-
> packages/ipaserver/install/cainstance.py", line 1188, in
> is_renewal_master
>
> self.ldap_connect()
>
> File "/usr/lib/python2.7/site-
> packages/ipaserver/install/service.py", line 177, in ldap_connect
>
> conn.do_bind(self.dm_password, autobind=self.autobind)
>
> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
> 1690, in do_bind
>
> self.do_sasl_gssapi_bind(timeout=timeout)
>
> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
> 1668, in do_sasl_gssapi_bind
>
> self.__bind_with_wait(self.gssapi_bind, timeout)
>
> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
> 1650, in __bind_with_wait
>
> bind_func(*args, **kwargs)
>
> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
> 1108, in gssapi_bind
>
> '', auth_tokens, server_controls, client_controls)
>
> File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__
>
> self.gen.throw(type, value, traceback)
>
> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line
> 973, in error_handler
>
> raise errors.ACIError(info="%s %s" % (info, desc))
>
> ACIError: Insufficient access: Invalid credentials
>
> Aug 10 01:04:34 ca-ldap01 certmonger[8834]: 2018-08-10 01:04:34
> [8834] Internal error
>
>
>
>
> Is there any URL that's relevant for pki 10.3
>
>
>
>
>
> thanks in advance, Zarko
>
>
>
>
>
>
>
>
>
> From: John Magne <jmagne(a)redhat.com>
>
> Sent: Wednesday, November 14, 2018 6:16 PM
>
> To: Z D
>
> Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
>
>
>
> Hi:
>
>
>
> YOu can try to temporarily disable the self tests for you ca, until
>
> the new certs are resolved.
>
>
>
> Look in the CS.cfg file for the ca in question and there is a big
> section
>
> controlling the self tests. Just experiment with commenting out the
> tests and see if that
>
>
> gets you past the hurdle..
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> Pki-users mailing list
> Pki-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/pki-users
12:17 a.m.
New subject: expired pki-server 10.3.3 certificates
Hi Dinesh, unfortunately this is what's happening now. Let's please recap.
[1] The list of certs, and expire date, so I go back in time when all certs are valid.
# getcert list | egrep "certificate|expire"
Number of certificates and requests being tracked: 6.
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:38 UTC
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:35 UTC
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:36 UTC
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2036-08-24 20:49:35 UTC
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
expires: 2020-07-21 17:18:06 UTC
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
expires: 2018-08-14 20:50:00 UTC
[2] this is my date
# date
Sun Aug 5 01:08:49 PDT 2018
[3] maybe to renew this cert first, s/n is 7.
# certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial
Serial Number: 7 (0x7)
[4] enrollment template is saved
# pki ca-cert-request-profile-show caManualRenewal --output caManualRenewal.xml
-------------------------------------------------
Enrollment Template for Profile "caManualRenewal"
-------------------------------------------------
--------------------------------------------------------------------
Saved enrollment template for caManualRenewal to caManualRenewal.xml
--------------------------------------------------------------------
[5] adding s/n 7
# vi caManualRenewal.xml
[6] Submit cert request, it's pending
# pki ca-cert-request-submit caManualRenewal.xml
-----------------------------
Submitted certificate request
-----------------------------
Request ID: 89990160
Type: renewal
Request Status: pending
Operation Result: success
[7] This fails with message "BadRequestException: Request Not In Pending
State", as per [6] it should be in pending state
# pki -v -d /etc/httpd/alias -c e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d -n ipaCert
ca-cert-request-review 7 --action approve
PKI options: -v -d /etc/httpd/alias -c e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d
PKI command: ipaCert -n ipaCert ca-cert-request-review 7 --action approve
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -Djava.ext.dirs=/usr/share/pki/lib
-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties
com.netscape.cmstools.cli.MainCLI -d /etc/httpd/alias -c
e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d --verbose -n ipaCert ca-cert-request-review 7
--action approve
Server URI: http://ca-ldap04.realm.com:8080
Client security database: /etc/httpd/alias
Message format: null
Command: ca-cert-request-review 7 --action approve
Initializing client security database
Logging into security token
Module: ca
HTTP request: GET /ca/rest/account/login HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.realm.com:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Location: https://ca-ldap04.realm.com:8443/ca/rest/account/login
Content-Length: 0
Date: Sun, 05 Aug 2018 08:11:15 GMT
HTTP redirect: https://ca-ldap04.realm.com:8443/ca/rest/account/login
Client certificate: ipaCert
HTTP request: GET /ca/rest/account/login HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.realm.com:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Server certificate: CN=ca-ldap04.realm.com,O=realm.com
HTTP response: HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Set-Cookie: JSESSIONID=01E9ED9A2E8548423871C4E1149F64DD; Path=/ca/; Secure; HttpOnly
Content-Type: application/xml
Content-Length: 205
Date: Sun, 05 Aug 2018 08:11:15 GMT
Account:
- User ID: ipara
- Full Name: ipara
- Email: null
- Roles: [Certificate Manager Agents, Registration Manager Agents]
Module: cert
Module: request-review
HTTP request: GET /ca/rest/agent/certrequests/7 HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.realm.com:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Location: https://ca-ldap04.realm.com:8443/ca/rest/agent/certrequests/7
Content-Length: 0
Date: Sun, 05 Aug 2018 08:11:15 GMT
HTTP redirect: https://ca-ldap04.realm.com:8443/ca/rest/agent/certrequests/7
Client certificate: ipaCert
HTTP request: GET /ca/rest/agent/certrequests/7 HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.realm.com:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Cookie: JSESSIONID=01E9ED9A2E8548423871C4E1149F64DD
Cookie2: $Version=1
HTTP response: HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Sun, 05 Aug 2018 08:11:15 GMT
HTTP request: POST /ca/rest/agent/certrequests/7/approve HTTP/1.1
Content-Type: application/xml
Accept-Encoding: gzip, deflate
Accept: application/xml
Content-Length: 15703
Host: ca-ldap04.realm.com:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Location: https://ca-ldap04.realm.com:8443/ca/rest/agent/certrequests/7/approve
Content-Length: 0
Date: Sun, 05 Aug 2018 08:11:15 GMT
HTTP redirect: https://ca-ldap04.realm.com:8443/ca/rest/agent/certrequests/7/approve
Client certificate: ipaCert
HTTP request: POST /ca/rest/agent/certrequests/7/approve HTTP/1.1
Content-Type: application/xml
Accept-Encoding: gzip, deflate
Accept: application/xml
Content-Length: 15703
Host: ca-ldap04.realm.com:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Cookie: JSESSIONID=01E9ED9A2E8548423871C4E1149F64DD
Cookie2: $Version=1
HTTP response: HTTP/1.1 400 Bad Request
Server: Apache-Coyote/1.1
Content-Type: application/xml
Content-Length: 228
Date: Sun, 05 Aug 2018 08:11:15 GMT
Connection: close
com.netscape.certsrv.base.BadRequestException: Request Not In Pending State
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at
com.netscape.certsrv.client.PKIConnection.handleErrorResponse(PKIConnection.java:450)
at com.netscape.certsrv.client.PKIConnection.getEntity(PKIConnection.java:418)
at com.netscape.certsrv.client.PKIClient.getEntity(PKIClient.java:114)
at com.netscape.certsrv.cert.CertClient.approveRequest(CertClient.java:117)
at
com.netscape.cmstools.cert.CertRequestReviewCLI.execute(CertRequestReviewCLI.java:162)
at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
at com.netscape.cmstools.cert.CertCLI.execute(CertCLI.java:91)
at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:57)
at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:562)
at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:574)
ERROR: Command '[u'/usr/lib/jvm/jre-1.8.0-openjdk/bin/java',
u'-Djava.ext.dirs=/usr/share/pki/lib',
u'-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties',
'com.netscape.cmstools.cli.MainCLI', '-d', '/etc/httpd/alias',
'-c', 'e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d', '--verbose',
'-n', 'ipaCert', 'ca-cert-request-review', '7',
'--action', 'approve']' returned non-zero exit status 255
________________________________
From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com>
Sent: Monday, November 19, 2018 7:01:30 AM
To: Z D; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Z D,
No. The "approve" operation you are trying to achieve is an action from admin.
So, you need to change this to the following:
`pki -d <client nss db location> -c <client nss db pass> -n <admin cert
nickname> ca-cert-request-review 7 --action approve`
-d = either /root/.dogtagpki/pki-tomcat/ca/alias OR /root/.dogtagpki/nssdb
-c = The password for the nssdb that you point in -d
-n = the nickname of the cert in the nssdb that you point in -d. Do a `certutil -L -d
/root/.dogtagpki/pki-tomcat/ca/alias` to give you a list of certs available in the nssdb.
NOTE:
1. You need to have a valid client admin cert to approve the request
2. This client admin cert must be available in ldap server
Reference:
https://www.dogtagpki.org/wiki/PKI_Client_CLI
Regards,
Dinesh
On Mon, 2018-11-19 at 06:15 +0000, Z D wrote:
Thanks Dinesh, I was able to submit request using caManualRenewal.xml file, but I need
clarity about approval.
I believe default CA admin can be used as CA agent. So password I use for "-c"
is the one I have in files like
/root/.dogtag/pki-tomcat/ca/password.conf and
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
NSS database is located in /etc/pki/pki-tomcat/alias, is this the one I should use for
"-d" ?
The command:
pki -d /etc/pki/pki-tomcat/alias -n admin -c <password> ca-cert-request-review 7
--action approve
give the output:
IncorrectPasswordException: Incorrect client security database password.
________________________________
From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com>
Sent: Sunday, November 18, 2018 10:40:01 AM
To: Z D; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi Zarko,
May be this documentation might help?
https://www.dogtagpki.org/wiki/System_Certificate_Renewal
It has instructions for 10.3 or earlier. Let us know if that helped!
Regards,
Dinesh
On Sun, 2018-11-18 at 01:39 +0000, Z D wrote:
Hi John, thanks for the feedback.
I used this URL as help to disable self tests.
https://www.dogtagpki.org/wiki/Offline_System_Certificate_Renewal#Manual_...
Many of "pki-server" command options are not present for me, since pki-server
version is 10.3, I believe the doc applies for 10.5.
But I was able to disable self test and PKI is responsive now.
After system time is back, I use 'getcert resubmit' to renew a cert and seeing
this certmonger errors
Basically is some :
"ACIError: Insufficient access: Invalid credentials"
[journalctl messages]
------------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call
last):#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit",
line 511, in <module>#012 sys.exit(main())#012 File
"/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main#012 if ca.is_renewal_master():#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1188,
in is_renewal_master#012 self.ldap_connect()#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177, in
ldap_connect#012 conn.do_bind(self.dm_password, autobind=self.autobind)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind#012 self.do_sasl_gssapi_bind(timeout=timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind#012 self.__bind_with_wait(self.gssapi_bind, timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650, in
__bind_with_wait#012 bind_func(*args, **kwargs)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind#012 '', auth_tokens, server_controls, client_controls)#012 File
"/usr/lib64/python2.7/contextlib.py", line 35, in __exit__#012
self.gen.throw(type, value, traceback)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler#012 raise errors.ACIError(info="%s %s" % (info,
desc))#012ACIError: Insufficient access: Invalid credentials
[syslog messages]
------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit[9333]: Traceback (most recent
call last):
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 511, in
<module>
sys.exit(main())
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main if ca.is_renewal_master():
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1188, in is_renewal_master
self.ldap_connect()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177,
in ldap_connect
conn.do_bind(self.dm_password, autobind=self.autobind)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind
self.do_sasl_gssapi_bind(timeout=timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind
self.__bind_with_wait(self.gssapi_bind, timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650, in
__bind_with_wait
bind_func(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind
'', auth_tokens, server_controls, client_controls)
File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler
raise errors.ACIError(info="%s %s" % (info, desc))
ACIError: Insufficient access: Invalid credentials
Aug 10 01:04:34 ca-ldap01 certmonger[8834]: 2018-08-10 01:04:34 [8834] Internal error
Is there any URL that's relevant for pki 10.3
thanks in advance, Zarko
________________________________
From: John Magne <jmagne(a)redhat.com>
Sent: Wednesday, November 14, 2018 6:16 PM
To: Z D
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi:
YOu can try to temporarily disable the self tests for you ca, until
the new certs are resolved.
Look in the CS.cfg file for the ca in question and there is a big section
controlling the self tests. Just experiment with commenting out the tests and see if that
gets you past the hurdle..
<https://www.redhat.com/mailman/listinfo/pki-users>
_______________________________________________
Pki-users mailing list
Pki-users@redhat.com<mailto:Pki-users@redhat.com>
https://www.redhat.com/mailman/listinfo/pki-users
10:29 p.m.
New subject: expired pki-server 10.3.3 certificates
And if i repeat the process from previous post, but with current time, the step [7] exits
with different message "IOException: SocketException cannot write on socket"
# pki -v -d /etc/httpd/alias -c e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d -n ipaCert
ca-cert-request-review 7 --action approve
PKI options: -v -d /etc/httpd/alias -c e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d
PKI command: ipaCert -n ipaCert ca-cert-request-review 7 --action approve
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -Djava.ext.dirs=/usr/share/pki/lib
-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties
com.netscape.cmstools.cli.MainCLI -d /etc/httpd/alias -c
e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d --verbose -n ipaCert ca-cert-request-review 7
--action approve
Server URI: http://ca-ldap04.domain.com:8080
Client security database: /etc/httpd/alias
Message format: null
Command: ca-cert-request-review 7 --action approve
Initializing client security database
Logging into security token
Module: ca
HTTP request: GET /ca/rest/account/login HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.domain.com:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Location: https://ca-ldap04.domain.com:8443/ca/rest/account/login
Content-Length: 0
Date: Sat, 24 Nov 2018 04:25:33 GMT
HTTP redirect: https://ca-ldap04.domain.com:8443/ca/rest/account/login
Client certificate: ipaCert
HTTP request: GET /ca/rest/account/login HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.domain.com:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Server certificate: CN=ca-ldap04.domain.com,O=domain.com
java.io.IOException: SocketException cannot write on socket
at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1099)
at org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:56)
at
org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(AbstractSessionOutputBuffer.java:147)
at
org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSessionOutputBuffer.java:154)
at
org.apache.http.impl.AbstractHttpClientConnection.doFlush(AbstractHttpClientConnection.java:278)
at
org.apache.http.impl.AbstractHttpClientConnection.flush(AbstractHttpClientConnection.java:283)
at
org.apache.http.impl.conn.ManagedClientConnectionImpl.flush(ManagedClientConnectionImpl.java:175)
at
org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:260)
at
org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:125)
at
org.apache.http.impl.client.DefaultRequestDirector.tryExecute(DefaultRequestDirector.java:715)
at
org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:520)
at
org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
at
org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:805)
at
org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invoke(ApacheHttpClient4Engine.java:283)
at
org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:407)
at
org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
at
org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
at com.sun.proxy.$Proxy23.login(Unknown Source)
at com.netscape.certsrv.account.AccountClient.login(AccountClient.java:45)
at com.netscape.certsrv.client.SubsystemClient.login(SubsystemClient.java:49)
at com.netscape.cmstools.cli.CACLI.login(CACLI.java:58)
at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:54)
at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:562)
at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:574)
ERROR: Command '[u'/usr/lib/jvm/jre-1.8.0-openjdk/bin/java',
u'-Djava.ext.dirs=/usr/share/pki/lib',
u'-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties',
'com.netscape.cmstools.cli.MainCLI', '-d', '/etc/httpd/alias',
'-c', 'e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d', '--verbose',
'-n', 'ipaCert', 'ca-cert-request-review', '7',
'--action', 'approve']' returned non-zero exit status 255
________________________________
From: pki-users-bounces(a)redhat.com <pki-users-bounces(a)redhat.com> on behalf of Z D
<zarko(a)etcfstab.com>
Sent: Wednesday, November 21, 2018 10:17:20 PM
To: Dinesh Prasanth Moluguwan Krishnamoorthy; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi Dinesh, unfortunately this is what's happening now. Let's please recap.
[1] The list of certs, and expire date, so I go back in time when all certs are valid.
# getcert list | egrep "certificate|expire"
Number of certificates and requests being tracked: 6.
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:38 UTC
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:35 UTC
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2018-08-14 20:49:36 UTC
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB'
expires: 2036-08-24 20:49:35 UTC
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert
cert-pki-ca',token='NSS Certificate DB'
expires: 2020-07-21 17:18:06 UTC
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='ipaCert',token='NSS
Certificate DB'
expires: 2018-08-14 20:50:00 UTC
[2] this is my date
# date
Sun Aug 5 01:08:49 PDT 2018
[3] maybe to renew this cert first, s/n is 7.
# certutil -L -d /etc/httpd/alias -n ipaCert | grep Serial
Serial Number: 7 (0x7)
[4] enrollment template is saved
# pki ca-cert-request-profile-show caManualRenewal --output caManualRenewal.xml
-------------------------------------------------
Enrollment Template for Profile "caManualRenewal"
-------------------------------------------------
--------------------------------------------------------------------
Saved enrollment template for caManualRenewal to caManualRenewal.xml
--------------------------------------------------------------------
[5] adding s/n 7
# vi caManualRenewal.xml
[6] Submit cert request, it's pending
# pki ca-cert-request-submit caManualRenewal.xml
-----------------------------
Submitted certificate request
-----------------------------
Request ID: 89990160
Type: renewal
Request Status: pending
Operation Result: success
[7] This fails with message "BadRequestException: Request Not In Pending
State", as per [6] it should be in pending state
# pki -v -d /etc/httpd/alias -c e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d -n ipaCert
ca-cert-request-review 7 --action approve
PKI options: -v -d /etc/httpd/alias -c e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d
PKI command: ipaCert -n ipaCert ca-cert-request-review 7 --action approve
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -Djava.ext.dirs=/usr/share/pki/lib
-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties
com.netscape.cmstools.cli.MainCLI -d /etc/httpd/alias -c
e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d --verbose -n ipaCert ca-cert-request-review 7
--action approve
Server URI: http://ca-ldap04.realm.com:8080
Client security database: /etc/httpd/alias
Message format: null
Command: ca-cert-request-review 7 --action approve
Initializing client security database
Logging into security token
Module: ca
HTTP request: GET /ca/rest/account/login HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.realm.com:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Location: https://ca-ldap04.realm.com:8443/ca/rest/account/login
Content-Length: 0
Date: Sun, 05 Aug 2018 08:11:15 GMT
HTTP redirect: https://ca-ldap04.realm.com:8443/ca/rest/account/login
Client certificate: ipaCert
HTTP request: GET /ca/rest/account/login HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.realm.com:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Server certificate: CN=ca-ldap04.realm.com,O=realm.com
HTTP response: HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Set-Cookie: JSESSIONID=01E9ED9A2E8548423871C4E1149F64DD; Path=/ca/; Secure; HttpOnly
Content-Type: application/xml
Content-Length: 205
Date: Sun, 05 Aug 2018 08:11:15 GMT
Account:
- User ID: ipara
- Full Name: ipara
- Email: null
- Roles: [Certificate Manager Agents, Registration Manager Agents]
Module: cert
Module: request-review
HTTP request: GET /ca/rest/agent/certrequests/7 HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.realm.com:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Location: https://ca-ldap04.realm.com:8443/ca/rest/agent/certrequests/7
Content-Length: 0
Date: Sun, 05 Aug 2018 08:11:15 GMT
HTTP redirect: https://ca-ldap04.realm.com:8443/ca/rest/agent/certrequests/7
Client certificate: ipaCert
HTTP request: GET /ca/rest/agent/certrequests/7 HTTP/1.1
Accept-Encoding: gzip, deflate
Accept: application/xml
Host: ca-ldap04.realm.com:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Cookie: JSESSIONID=01E9ED9A2E8548423871C4E1149F64DD
Cookie2: $Version=1
HTTP response: HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Wed, 31 Dec 1969 16:00:00 PST
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Sun, 05 Aug 2018 08:11:15 GMT
HTTP request: POST /ca/rest/agent/certrequests/7/approve HTTP/1.1
Content-Type: application/xml
Accept-Encoding: gzip, deflate
Accept: application/xml
Content-Length: 15703
Host: ca-ldap04.realm.com:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Location: https://ca-ldap04.realm.com:8443/ca/rest/agent/certrequests/7/approve
Content-Length: 0
Date: Sun, 05 Aug 2018 08:11:15 GMT
HTTP redirect: https://ca-ldap04.realm.com:8443/ca/rest/agent/certrequests/7/approve
Client certificate: ipaCert
HTTP request: POST /ca/rest/agent/certrequests/7/approve HTTP/1.1
Content-Type: application/xml
Accept-Encoding: gzip, deflate
Accept: application/xml
Content-Length: 15703
Host: ca-ldap04.realm.com:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Cookie: JSESSIONID=01E9ED9A2E8548423871C4E1149F64DD
Cookie2: $Version=1
HTTP response: HTTP/1.1 400 Bad Request
Server: Apache-Coyote/1.1
Content-Type: application/xml
Content-Length: 228
Date: Sun, 05 Aug 2018 08:11:15 GMT
Connection: close
com.netscape.certsrv.base.BadRequestException: Request Not In Pending State
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at
com.netscape.certsrv.client.PKIConnection.handleErrorResponse(PKIConnection.java:450)
at com.netscape.certsrv.client.PKIConnection.getEntity(PKIConnection.java:418)
at com.netscape.certsrv.client.PKIClient.getEntity(PKIClient.java:114)
at com.netscape.certsrv.cert.CertClient.approveRequest(CertClient.java:117)
at
com.netscape.cmstools.cert.CertRequestReviewCLI.execute(CertRequestReviewCLI.java:162)
at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
at com.netscape.cmstools.cert.CertCLI.execute(CertCLI.java:91)
at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:57)
at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:562)
at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:574)
ERROR: Command '[u'/usr/lib/jvm/jre-1.8.0-openjdk/bin/java',
u'-Djava.ext.dirs=/usr/share/pki/lib',
u'-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties',
'com.netscape.cmstools.cli.MainCLI', '-d', '/etc/httpd/alias',
'-c', 'e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d', '--verbose',
'-n', 'ipaCert', 'ca-cert-request-review', '7',
'--action', 'approve']' returned non-zero exit status 255
________________________________
From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com>
Sent: Monday, November 19, 2018 7:01:30 AM
To: Z D; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Z D,
No. The "approve" operation you are trying to achieve is an action from admin.
So, you need to change this to the following:
`pki -d <client nss db location> -c <client nss db pass> -n <admin cert
nickname> ca-cert-request-review 7 --action approve`
-d = either /root/.dogtagpki/pki-tomcat/ca/alias OR /root/.dogtagpki/nssdb
-c = The password for the nssdb that you point in -d
-n = the nickname of the cert in the nssdb that you point in -d. Do a `certutil -L -d
/root/.dogtagpki/pki-tomcat/ca/alias` to give you a list of certs available in the nssdb.
NOTE:
1. You need to have a valid client admin cert to approve the request
2. This client admin cert must be available in ldap server
Reference:
https://www.dogtagpki.org/wiki/PKI_Client_CLI
Regards,
Dinesh
On Mon, 2018-11-19 at 06:15 +0000, Z D wrote:
Thanks Dinesh, I was able to submit request using caManualRenewal.xml file, but I need
clarity about approval.
I believe default CA admin can be used as CA agent. So password I use for "-c"
is the one I have in files like
/root/.dogtag/pki-tomcat/ca/password.conf and
/root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
NSS database is located in /etc/pki/pki-tomcat/alias, is this the one I should use for
"-d" ?
The command:
pki -d /etc/pki/pki-tomcat/alias -n admin -c <password> ca-cert-request-review 7
--action approve
give the output:
IncorrectPasswordException: Incorrect client security database password.
________________________________
From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com>
Sent: Sunday, November 18, 2018 10:40:01 AM
To: Z D; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi Zarko,
May be this documentation might help?
https://www.dogtagpki.org/wiki/System_Certificate_Renewal
It has instructions for 10.3 or earlier. Let us know if that helped!
Regards,
Dinesh
On Sun, 2018-11-18 at 01:39 +0000, Z D wrote:
Hi John, thanks for the feedback.
I used this URL as help to disable self tests.
https://www.dogtagpki.org/wiki/Offline_System_Certificate_Renewal#Manual_...
Many of "pki-server" command options are not present for me, since pki-server
version is 10.3, I believe the doc applies for 10.5.
But I was able to disable self test and PKI is responsive now.
After system time is back, I use 'getcert resubmit' to renew a cert and seeing
this certmonger errors
Basically is some :
"ACIError: Insufficient access: Invalid credentials"
[journalctl messages]
------------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call
last):#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit",
line 511, in <module>#012 sys.exit(main())#012 File
"/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main#012 if ca.is_renewal_master():#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1188,
in is_renewal_master#012 self.ldap_connect()#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177, in
ldap_connect#012 conn.do_bind(self.dm_password, autobind=self.autobind)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind#012 self.do_sasl_gssapi_bind(timeout=timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind#012 self.__bind_with_wait(self.gssapi_bind, timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650, in
__bind_with_wait#012 bind_func(*args, **kwargs)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind#012 '', auth_tokens, server_controls, client_controls)#012 File
"/usr/lib64/python2.7/contextlib.py", line 35, in __exit__#012
self.gen.throw(type, value, traceback)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler#012 raise errors.ACIError(info="%s %s" % (info,
desc))#012ACIError: Insufficient access: Invalid credentials
[syslog messages]
------------------------
Aug 10 01:04:34 ca-ldap01 dogtag-ipa-ca-renew-agent-submit[9333]: Traceback (most recent
call last):
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 511, in
<module>
sys.exit(main())
File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main if ca.is_renewal_master():
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line
1188, in is_renewal_master
self.ldap_connect()
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177,
in ldap_connect
conn.do_bind(self.dm_password, autobind=self.autobind)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind
self.do_sasl_gssapi_bind(timeout=timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind
self.__bind_with_wait(self.gssapi_bind, timeout)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1650, in
__bind_with_wait
bind_func(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind
'', auth_tokens, server_controls, client_controls)
File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler
raise errors.ACIError(info="%s %s" % (info, desc))
ACIError: Insufficient access: Invalid credentials
Aug 10 01:04:34 ca-ldap01 certmonger[8834]: 2018-08-10 01:04:34 [8834] Internal error
Is there any URL that's relevant for pki 10.3
thanks in advance, Zarko
________________________________
From: John Magne <jmagne(a)redhat.com>
Sent: Wednesday, November 14, 2018 6:16 PM
To: Z D
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
Hi:
YOu can try to temporarily disable the self tests for you ca, until
the new certs are resolved.
Look in the CS.cfg file for the ca in question and there is a big section
controlling the self tests. Just experiment with commenting out the tests and see if that
gets you past the hurdle..
<https://www.redhat.com/mailman/listinfo/pki-users>
_______________________________________________
Pki-users mailing list
Pki-users@redhat.com<mailto:Pki-users@redhat.com>
https://www.redhat.com/mailman/listinfo/pki-users
11:56 a.m.
New subject: expired pki-server 10.3.3 certificates
ZD,
From [6], your request ID is 89990160. But, you are passing request ID
as 7
Regards,Dinesh
On Thu, 2018-11-22 at 06:17 +0000, Z D wrote:
[6] Submit cert request, it's pending
# pki ca-cert-request-submit caManualRenewal.xml
-----------------------------
Submitted certificate request
-----------------------------
Request ID: 89990160
Type: renewal
Request Status: pending
Operation Result: success
[7] This fails with message "BadRequestException: Request Not In
Pending State", as per [6] it should be in pending state
# pki -v -d /etc/httpd/alias -c
e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d -n ipaCert ca-cert-request-
review 7 --action approve
8:09 p.m.
New subject: expired pki-server 10.3.3 certificates
Thanks Dinesh,
I misread that argument for ca-cert-request-review is serial number, but as you said it
has to be request ID. Indeed, I made progress, and can retrieve renewed Cert:
[root@ca-ldap04 tmp]# pki ca-cert-show 0x8fff0090 --output ipacert.crt
------------------------
Certificate "0x8fff0090"
------------------------
Serial Number: 0x8fff0090
Issuer: CN=Certificate Authority,O=DOMAIN.COM
Subject: CN=IPA RA,O=DOMIAN.COM
Status: VALID
Not Before: Fri Aug 10 01:08:19 PDT 2018
Not After: Thu Jul 30 01:08:19 PDT 2020
I also stopped PKI server, removed old cert from NSS database, and installed new one. This
is all for ipaCert. But before I start renewing other ones (audit, ocsp, subsystem), I
have to ask next
[1] how to properly convert cert (.crt file) into one line?
I believe I need this in order to update below lines in CS.cfg file.
ca.audit_signing.cert=...
ca.ocsp_signing.cert=...
ca.subsystem.cert=...
Thanks a lot for your support. Zarko
________________________________
From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com>
Sent: Tuesday, November 27, 2018 9:56 AM
To: Z D; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
ZD,
From [6], your request ID is 89990160. But, you are passing request ID
as 7
Regards,
Dinesh
On Thu, 2018-11-22 at 06:17 +0000, Z D wrote:
[6] Submit cert request, it's pending
# pki ca-cert-request-submit caManualRenewal.xml
-----------------------------
Submitted certificate request
-----------------------------
Request ID: 89990160
Type: renewal
Request Status: pending
Operation Result: success
[7] This fails with message "BadRequestException: Request Not In Pending
State", as per [6] it should be in pending state
# pki -v -d /etc/httpd/alias -c e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d -n ipaCert
ca-cert-request-review 7 --action approve
2:25 p.m.
New subject: expired pki-server 10.3.3 certificates
ZD,
Open the .crt file and delete the newline, header and footer. Now,
update the CS.cfg with this value.
Reference:
https://www.dogtagpki.org/wiki/System_Certificate_Renewal#PKI_10.3_or_ear...
Regards,Dinesh
On Sun, 2018-12-02 at 02:09 +0000, Z D wrote:
Thanks Dinesh,
I misread that argument for ca-cert-request-review is serial number,
but as you said it has to be request ID. Indeed, I made progress,
and
can retrieve renewed Cert:
[root@ca-ldap04 tmp]# pki ca-cert-show 0x8fff0090 --output
ipacert.crt
------------------------
Certificate "0x8fff0090"
------------------------
Serial Number: 0x8fff0090
Issuer: CN=Certificate Authority,O=DOMAIN.COM
Subject: CN=IPA RA,O=DOMIAN.COM
Status: VALID
Not Before: Fri Aug 10 01:08:19 PDT 2018
Not After: Thu Jul 30 01:08:19 PDT 2020
I also stopped PKI server, removed old cert from NSS database, and
installed new one. This is all for ipaCert. But before I start
renewing other ones (audit, ocsp, subsystem), I have to ask next
[1] how to properly convert cert (.crt file) into one line?
I believe I need this in order to update below lines in CS.cfg file.
ca.audit_signing.cert=...
ca.ocsp_signing.cert=...
ca.subsystem.cert=...
Thanks a lot for your support. Zarko
From: Dinesh Prasanth Moluguwan Krishnamoorthy <dmoluguw(a)redhat.com>
Sent: Tuesday, November 27, 2018 9:56 AM
To: Z D; John Magne; pki-users(a)redhat.com
Subject: Re: [Pki-users] expired pki-server 10.3.3 certificates
ZD,
From [6], your request ID is 89990160. But, you are passing request
ID as 7
Regards,
Dinesh
On Thu, 2018-11-22 at 06:17 +0000, Z D wrote:
> [6] Submit cert request, it's pending
>
>
>
>
> # pki ca-cert-request-submit caManualRenewal.xml
>
> -----------------------------
>
> Submitted certificate request
>
> -----------------------------
>
> Request ID: 89990160
>
> Type: renewal
>
> Request Status: pending
>
> Operation Result: success
>
>
>
>
>
> [7] This fails with message "BadRequestException: Request Not In
> Pending State", as per [6] it should be in pending state
>
>
>
>
> # pki -v -d /etc/httpd/alias -c
> e7aae6f3eb9a62a54f2dd18b8d814aa4a579a61d -n ipaCert ca-cert-
> request-review 7 --action approve
1981
days inactive
1997
days old
8 comments
2 participants
participants (2)
-
Dinesh Prasanth Moluguwan Krishnamoorthy -
Z D