On Tue, May 28, 2019 at 04:37:25PM -0000, Khurrum Maqb via FreeIPA-users wrote:
> Thanks!
>
> So on the IPA server that is listed in the client's /etc/ipa/default file I
> ran:
>
> # openssl verify -verbose -CAfile /var/lib/ipa-client/pki/kdc-ca-bundle.pem
> /var/kerberos/krb5kdc/kdc.crt
> /var/kerberos/krb5kdc/kdc.crt: O = DOMAIN.COM, CN = ipa-server.do.ma.in
> error 18 at 0 depth lookup:self signed certificate
> OK
This should not be self-signed but signed by the IPA CA to make
Smartcard authentication and PKINIT work.
What is the output of
ipa pkinit-status
and
ipa-pkinit-manage status
on the servers?
bye,
Sumit
>
> Is that the command that you had in mind? It looks like it's OK.
>
> Also as Florence Blanc-Renaud suggested, I ran the `ipa-advise
> config-server-for-smart-card-auth > config.sh` command and ran it on all the
> IPA servers with the third-party external CA certs, and they ran
> successfully. Thanks Florence! I did not see any change after that. The only
> thing I hadn't done was change the Server-Cert permissions. The kinit command
> still fails with the DH verification error on the client even though the
> ticket is issued.
>
> I also added a CNAME for the OCSP server listed in the cert and pointed it to
> a real working IPA server instead of a retired one.
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
