Sigbjorn Lie wrote:
On 20/02/14 21:38, Rob Crittenden wrote:
I am surprised too. I dumped the PKI CA certificate from /etc/pki/nssdb
before and after I updated it into text files, and diff'ed them. No
differences was reported.
I can't think of a reason it would be using the sqlite database at
all. You don't have NSS_DEFAULT_DB_TYPE set somewhere do you? I'd find
it hard to believe that this would be set EVERYWHERE.
If we want to brute force things, trying strace against a client that
isn't working to confirm that it is trying to open cert9 might give us
a data point at least.
I have NSS_DEFAULT_DB_TYPE set to "sql".
Oh, ok, that's why then. You're telling NSS to use sqlite databases and
we only configure the older database style so the client isn't finding
its CA cert.
So you can either not set that or migrate all the client databases. I'm
a little surprised the servers aren't blowing up on you too.
rob
_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users
