[Freeipa-users] Re: External & Letsencrypt Certificate | Failed on IPA update.

Florence Blanc-Renaud via FreeIPA-users Mon, 16 Mar 2020 03:13:21 -0700

On 3/15/20 10:27 PM, Faraz Younus via FreeIPA-users wrote:

I'll try to add this suggested config and restart ipactl
But as per you it should not have been the case to install client onmaster why is that ?

Hi,

when ipa-server-install is run to setup a node as an IPA master, theinstaller also automatically configures the client part of IPA.

The procedure which I'm following I'm setting master server with setupca self signed then after that I'm replacing self signed with externalcertificate, is this the right way?

Your wording is slightly confusing... Do you mean that you setup IPAwith an embedded CA, that is self-signed?

Then replace httpd and dirsrv certificates with other certificates?

IPA can be configured in multiple ways:

- without any CA. In this case you need to provide server certificatesfor LDAP, HTTP and (optional) Pkinit. The certificate chain is ExternalCA > LDAP HTTP and Pkinit certs.This is achieved with ipa-server-install --dirsrv-cert-file ..--http-cert-file .. --pkinit-cert-file .. --dirsrv-pin-file ..--http-pin-file .. --pkinit-pin-file

- with an embedded CA, that is self-signed. This CA will create theserver certificates for LDAP, HTTP and Pkinit. The cert chain is IPA CA> LDAP HTTP and Pkinit certs.

This is achieved with ipa-server-install.

- with an embdedded CA, that is signed by an external CA. The chain willbe external CA > IPA CA > LDAP, HTTP and Pkinit server certificates.This is achieved by a 2-step installation withipa-server-install --external-ca >> provides a CSR that needs to besigned by the external CA. The external CA will provide in return a CA cert

ipa-server-install --external-cert-file <CA signed by the external CA>

So if your goal is to have Let's encrypt sign your HTTP and LDAPcertificates, and you don't need IPA CA, you can directly use the firstprocedure.


Hope this clarifies,
flo

On Mon, Mar 16, 2020, 2:18 AM Rob Crittenden <rcrit...@redhat.com<mailto:rcrit...@redhat.com>> wrote:


    Faraz Younus via FreeIPA-users wrote:
     > no I did not modify the file , this is from ipa master server, i also
     > installed ipa client on master bcoz i was getting sssd no cache
     > credentials error, when i install client on master it fixed that
    error,
     > now I'm getting ldap error after that sssd error

    It should not have been possible to run ipa-client-install on a master.
    I don't know what you did to force it, or what the full consequences may
    be, but I'd try adding the things that Flo suggested to
    /etc/ipa/default.conf and restarting httpd to see if it helps.

    ldap_uri = ldapi://%2fvar%2frun%2fslapd-FIXEDANDMOBILE-COM.socket
    ra_plugin = dogtag
    dogtag_version = 10
    mode = production

    rob

     >
     > On Fri, Mar 13, 2020, 7:17 PM Florence Blanc-Renaud
    <f...@redhat.com <mailto:f...@redhat.com>
     > <mailto:f...@redhat.com <mailto:f...@redhat.com>>> wrote:
     >
     >     On 3/13/20 8:43 AM, Faraz Younus via FreeIPA-users wrote:
     >     > cat /etc/ipa/default.conf
     >     >
     >     > #File modified by ipa-client-install
     >     >
     >     >
     >     > [global]
     >     >
     >     > basedn = dc=fixedandmobile,dc=com
     >     >
     >     > realm = FIXEDANDMOBILE.COM <http://FIXEDANDMOBILE.COM>
    <http://FIXEDANDMOBILE.COM>
     >     <http://FIXEDANDMOBILE.COM>
     >     >
     >     > domain = fixedandmobile.com <http://fixedandmobile.com>
    <http://fixedandmobile.com>
     >     <http://fixedandmobile.com>
     >     >
     >     > server = sg.fixedandmobile.com
    <http://sg.fixedandmobile.com> <http://sg.fixedandmobile.com>
     >     <http://sg.fixedandmobile.com>
     >     >
     >     > host = sg.fixedandmobile.com <http://sg.fixedandmobile.com>
    <http://sg.fixedandmobile.com>
     >     <http://sg.fixedandmobile.com>
     >     >
     >     > xmlrpc_uri = https://sg.fixedandmobile.com/ipa/xml
     >     >
     >     > enable_ra = True
     >
     >     Hi,
     >
     >     looks like you are trying to run "ipactl status" on a FreeIPA
    client,
     >     because on a server I would expect the file to also contain:
     >
     >     ldap_uri = ldapi://%2Fvar%2Frun%2Fslapd-FIXEDANDMOBILE-COM.socket
     >     mode = production
     >     ra_plugin = dogtag
     >     dogtag_version = 10
     >
     >     But on a client, the host and server values would be different.
     >     Did you manually modify the file?
     >
     >     flo
     >     >
     >     >
     >     > On Fri, Mar 13, 2020 at 12:02 PM Florence Blanc-Renaud
     >     <f...@redhat.com <mailto:f...@redhat.com>
    <mailto:f...@redhat.com <mailto:f...@redhat.com>>
     >     > <mailto:f...@redhat.com <mailto:f...@redhat.com>
    <mailto:f...@redhat.com <mailto:f...@redhat.com>>>> wrote:
     >     >
     >     >     On 3/13/20 6:42 AM, Faraz Younus via FreeIPA-users wrote:
     >     >      > I can have the update on below LDAP error ?
     >     >
     >     >     What is the content of the /etc/ipa/default.conf file?
     >     Especially, is
     >     >     there a value for "ldap_uri" and does it start with
    "ldap_uri =
     >     >     ldapi://..." ?
     >     >
     >     >     flo
     >     >      >
     >     >      > On Wed, Mar 11, 2020 at 6:34 PM Faraz Younus
     >     <fara...@gmail.com <mailto:fara...@gmail.com>
    <mailto:fara...@gmail.com <mailto:fara...@gmail.com>>
     >     >     <mailto:fara...@gmail.com <mailto:fara...@gmail.com>
    <mailto:fara...@gmail.com <mailto:fara...@gmail.com>>>
     >     >      > <mailto:fara...@gmail.com <mailto:fara...@gmail.com>
    <mailto:fara...@gmail.com <mailto:fara...@gmail.com>>
     >     <mailto:fara...@gmail.com <mailto:fara...@gmail.com>
    <mailto:fara...@gmail.com <mailto:fara...@gmail.com>>>>> wrote:
     >     >      >
     >     >      >     I have added freeipa users list as well to this
    thread
     >     >      >
     >     >      >     On Wed, Mar 11, 2020 at 6:31 PM Rob Crittenden
     >     >     <rcrit...@redhat.com <mailto:rcrit...@redhat.com>
    <mailto:rcrit...@redhat.com <mailto:rcrit...@redhat.com>>
     >     <mailto:rcrit...@redhat.com <mailto:rcrit...@redhat.com>
    <mailto:rcrit...@redhat.com <mailto:rcrit...@redhat.com>>>
     >     >      >     <mailto:rcrit...@redhat.com
    <mailto:rcrit...@redhat.com>
     >     <mailto:rcrit...@redhat.com <mailto:rcrit...@redhat.com>>
    <mailto:rcrit...@redhat.com <mailto:rcrit...@redhat.com>
     >     <mailto:rcrit...@redhat.com <mailto:rcrit...@redhat.com>>>>>
    wrote:
     >     >      >
     >     >      >         Faraz Younus wrote:
     >     >      >          > Thanks pasted the text instead of
    screenshots.
     >     >      >
     >     >      >         This will work. Can you post this to the
     >     freeipa-users list?
     >     >      >
     >     >      >         rob
     >     >      >
     >     >      >          >
     >     >      >          > First failed then successful but after
    that LDAP
     >     broken.
     >     >      >          >
     >     >      >          > palib.install.certmonger: DEBUG: certmonger
     >     request is
     >     >     in state
     >     >      >          > dbus.String(u'CA_UNREACHABLE',
    variant_level=1)
     >     >      >          >
     >     >      >          > ipapython.admintool: DEBUG:   File
     >     >      >          >
     >     "/usr/lib/python2.7/site-packages/ipapython/admintool.py",
     >     >      >         line 178, in
     >     >      >          > execute
     >     >      >          >
     >     >      >          >     return_value = self.run()
     >     >      >          >
     >     >      >          >   File
     >     >      >          >
     >     >      >
     >     >

> "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py",

     >     >      >          > line 62, in run
     >     >      >          >
     >     >      >          >     run_with_args(api)
     >     >      >          >
     >     >      >          >   File
     >     >      >          >
     >     >      >
     >     >

> "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py",

     >     >      >          > line 112, in run_with_args
     >     >      >          >
     >     >      >          >     update_server(certs)
     >     >      >          >
     >     >      >          >   File
     >     >      >          >
     >     >      >
     >     >

> "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_certupdate.py",

     >     >      >          > line 192, in update_server
     >     >      >          >
     >     >      >          >     "please check the request manually" %
     >     request_id)
     >     >      >          >
     >     >      >          >
     >     >      >          > ipapython.admintool: DEBUG: The
    ipa-certupdate
     >     command
     >     >     failed,
     >     >      >          > exception: ScriptError: Error resubmitting
     >     certmonger
     >     >     request
     >     >      >          > '20200311065837', please check the
    request manually
     >     >      >          >
     >     >      >          > ipapython.admintool: ERROR: Error
    resubmitting
     >     >     certmonger request
     >     >      >          > '20200311065837', please check the
    request manually
     >     >      >          >
     >     >      >          > ipapython.admintool: ERROR: The
    ipa-certupdate
     >     command
     >     >     failed.
     >     >      >          >
     >     >      >          > [root@sg ansible]# kinit admin
     >     >      >          >
     >     >      >          > Password for ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>
     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>>
     >     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>
     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>>>
     >     >      >         <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>
     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>>
     >     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>
     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>>>>
     >     >      >         <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>
     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>>
     >     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>
     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>>>
     >     >      >         <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>
     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>>
     >     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>
     >     <mailto:ad...@fixedandmobile.com
    <mailto:ad...@fixedandmobile.com>>>>>:
     >     >      >          >
     >     >      >          >
     >     >      >          > [root@sg ansible]# klist -kt /etc/krb5.keytab
     >     >      >          >
     >     >      >          > Keytab name: FILE:/etc/krb5.keytab
     >     >      >          >
     >     >      >          > KVNO Timestamp         Principal
     >     >      >          >
     >     >      >          > ---- -----------------
     >     >      >          >
     >     --------------------------------------------------------
     >     >      >          >
     >     >      >          >    3 03/11/20 07:15:51

> > > host/sg.fixedandmobile....@fixedandmobile.com

    <mailto:sg.fixedandmobile....@fixedandmobile.com>
     >     <mailto:sg.fixedandmobile....@fixedandmobile.com
    <mailto:sg.fixedandmobile....@fixedandmobile.com>>
     >     >     <mailto:sg.fixedandmobile....@fixedandmobile.com
    <mailto:sg.fixedandmobile....@fixedandmobile.com>
     >     <mailto:sg.fixedandmobile....@fixedandmobile.com
    <mailto:sg.fixedandmobile....@fixedandmobile.com>>>