freeipa

#9235 IPA Replica server retrieving two certificates from the IPA master server , ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/bin/certutil -d dbm:/etc/httpd/alias -A -n Server-Cert -t ,, -a -f /etc/httpd/alias/pwdfile.txt' returned non-zero exit status 255
Closed: worksforme by frenaud. Opened by manideepsai.

Closed: worksforme
Reopen Issue

Master server: aaa01
Replica server1: dir01 (currently installing replica server )
Replica server2: dirus02 (which is a replica server previously that has been removed from replication)

As noticed while installing ipa replica server, replica server retrieving two certificates from the master server, and saving it in /etc/ipa/ca.crt in this process at the stage Configuring the web interface (httpd) we got the below error i.e.

ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/bin/certutil -d dbm:/etc/httpd/alias -A -n Server-Cert -t ,, -a -f /etc/httpd/alias/pwdfile.txt' returned non-zero exit status 255

===============================================

While installing Replica /var/log/ipaclient-install.log

2022-08-15T13:52:08Z DEBUG stderr=
2022-08-15T13:52:08Z DEBUG trying to retrieve CA cert via LDAP from aaa01.ipa.example.com
2022-08-15T13:52:09Z DEBUG retrieving schema for SchemaCache url=ldap://aaa01.ipa.example.com:389 conn=
2022-08-15T13:52:11Z INFO Successfully retrieved CA cert

Subject:     CN=Certificate Authority,O=IPA.EXAMPLE.COM
Issuer:      CN=Certificate Authority,O=IPA.EXAMPLE.COM
Valid From:  2018-04-12 14:15:30
Valid Until: 2038-04-12 14:15:30
Subject:     CN=dirus02.ipa.example.com,O=IPA.EXAMPLE.COM
Issuer:      CN=Certificate Authority,O=IPA.EXAMPLE.COM
Valid From:  2019-01-21 11:54:13
Valid Until: 2021-01-21 11:54:13

2022-08-15T13:52:11Z DEBUG Starting external process
2022-08-15T13:52:11Z DEBUG args=/usr/sbin/ipa-join -s aaa01.ipa.example.com -b dc=ipa,dc=onmobile,dc=com -h dirpav01-tfln-mdr1-omes.ipa.example.com
2022-08-15T13:52:15Z DEBUG Process finished, return code=0
2022-08-15T13:52:15Z DEBUG stdout=
2022-08-15T13:52:15Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab
Certificate subject base is: O=IPA.EXAMPLE.COM

2022-08-15T13:52:15Z INFO Enrolled in IPA realm IPA.EXAMPLE.COM
2022-08-15T13:52:15Z DEBUG Starting external process
2022-08-15T13:52:15Z DEBUG args=/usr/bin/kdestroy
2022-08-15T13:52:15Z DEBUG Process finished, return code=0
2022-08-15T13:52:15Z DEBUG stdout=

==================================

While installing replica /var/log/ipareplica-install.log

2022-08-15T15:07:11Z DEBUG [14/22]: importing CA certificates from LDAP
2022-08-15T15:07:11Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'
2022-08-15T15:07:11Z DEBUG Starting external process
2022-08-15T15:07:11Z DEBUG args=/usr/bin/certutil -d dbm:/etc/httpd/alias -A -n IPA.ONMOBILE.COM IPA CA -t CT,C,C -a -f /etc/httpd/alias/pwdfile.txt
2022-08-15T15:07:11Z DEBUG Process finished, return code=0
2022-08-15T15:07:11Z DEBUG stdout=
2022-08-15T15:07:11Z DEBUG stderr=
2022-08-15T15:07:11Z DEBUG Starting external process
2022-08-15T15:07:11Z DEBUG args=/usr/bin/certutil -d dbm:/etc/httpd/alias -A -n Server-Cert -t ,, -a -f /etc/httpd/alias/pwdfile.txt
2022-08-15T15:07:12Z DEBUG Process finished, return code=255
2022-08-15T15:07:12Z DEBUG stdout=
2022-08-15T15:07:12Z DEBUG stderr=certutil: could not add certificate to token or database: SEC_ERROR_ADDING_CERT: Error adding certificate to database.

2022-08-15T15:07:12Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 567, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 557, in run_step

Observation in Master server(aaa01) ldap database :

[root@aaa01~]# ldapsearch -D 'cn=directory manager' -w XXXXXXXXX | grep "ipaCertSubject"
ipaCertSubject: CN=Certificate Authority,O=IPA.EXAMPLE.COM
ipaCertSubject: CN=dirus02.ipa.example.com,O=IPA.EXAMPLE.COM
[root@aaa01~]#

====================
We could see this certificate "CN=dirus02.ipa.example.com,O=IPA.EXAMPLE.COM" in IPA master server GUI as well we have revoked it too , but still it retrieves the same and installation got fails everytime

=================

In ideal case while installing replica it has to retrieve only one certificate i.e. CN=Certificate Authority,O=IPA.EXAMPLE.COM but this case it retrieves

Please let us know if any more details required and let us know how can we fix this issue, without impact on whole setup

ipaCertIssuerSerial

ipaCertIssuerSerial: CN=Certificate Authority,O=IPA.ONMOBILE.COM;1
ipaCertIssuerSerial: CN=Certificate Authority,O=IPA.ONMOBILE.COM;32

Hi @manideepsai
from the logs it looks like the cert CN=dirus02.ipa.example.com,O=IPA.EXAMPLE.COM has been added as a CA cert.
Can you check the output of ipa-cacert-manage list on your server aaa01? If the output also contains this certificate, you need to remove it (it is a server certificate, not a CA certificate) using `ipa-cacert-manage delete ", then run ipa-certupdate on all the servers/clients, and retry the replica installation.

Please note that this issue tracker is used to log defects, and in order to request help from the community I would recommend using the mailing list freeipa-users@lists.fedorahosted.org instead.

Hi @frenaud

Thanks for the reply

Here is the output , there are two options available with ipa-cacert-manage i.e. renew and install

[root@aaa01~]# ipa-cacert-manage list
Usage: ipa-cacert-manage renew [options]
ipa-cacert-manage install [options] CERTFILE

ipa-cacert-manage: error: unknown command "list"
The ipa-cacert-manage command failed.
[root@aaa01~]#
[root@aaa01~]#
[root@aaa01~]# cat /etc/redhat-release
CentOS Linux release 7.4.1708 (Core)
[root@aaa01~]#
[root@aaa01~]# ipa --version
VERSION: 4.5.0, API_VERSION: 2.228

Hi @manideepsai
The ipa-cacert-manage list and del options were introduced in a more recent version (IPA 4.8.5 for del and 4.7.2 for list). You can perform the equivalent operations manually:
- find the CA certificates (replace dc=ipa,dc=example,dc=com with your base DN):

ldapsearch -D "cn=directory manager" -W -b cn=certificates,cn=ipa,cn=etc,dc=ipa,dc=example,dc=com "(&(objectClass=ipaCertificate)(objectClass=pkiCA))"

This command will return multiple LDAP entries, one for each CA certificate. If you find the entry for the certificate CN=dirus02.ipa.example.com,O=IPA.EXAMPLE.COM (that is not a CA but a server certificate), note the DN and then delete the entry with

ldapdelete -D cn=directory manager" -W <dn to delete>

When this step is done, you will need to run ipa-certupdate on all the IPA servers/clients. Then you can retry the replica installation on dirus02.ipa.example.com

Closing this issue, this is discussed in freeipa-users mailing list: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/YJ7KLYTF4XJXZVIYYIRFJYGKAO26UE37/

Metadata Update from @frenaud:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.