Re: [Freeipa-users] certmonger question

2014-11-12 Thread Natxo Asenjo
hi, On Tue, Nov 11, 2014 at 7:14 PM, Nalin Dahyabhai na...@redhat.com wrote: On Tue, Nov 11, 2014 at 11:13:12AM -0500, Nalin Dahyabhai wrote: Since you mention that this seems to be specific to 32-bit boxes, I think I need to switch to that one to try to sort out what's happening here, since

Re: [Freeipa-users] certmonger question

2014-11-11 Thread Martin Kosek
On 11/11/2014 08:48 AM, Natxo Asenjo wrote: Hi Nalin, On Mon, Nov 10, 2014 at 5:19 PM, Nalin Dahyabhai na...@redhat.com wrote: On Mon, Nov 10, 2014 at 04:17:49PM +0100, Natxo Asenjo wrote: How can I debug this? First thing would be to run the daemon with additional logging - I usually use

Re: [Freeipa-users] certmonger question

2014-11-11 Thread Natxo Asenjo
hi Nali, On Tue, Nov 11, 2014 at 12:57 PM, Martin Kosek mko...@redhat.com wrote: So if the lurking double encoded certificate is in LDAP, and thus Apache DS shows is invalid (it shows as OK in my RHEL-7.0 server), maybe the easiest way to fix it would be to: - Open your Apache DS - Back up

Re: [Freeipa-users] certmonger question

2014-11-11 Thread Martin Kosek
On 11/11/2014 01:28 PM, Natxo Asenjo wrote: hi Nali, On Tue, Nov 11, 2014 at 12:57 PM, Martin Kosek mko...@redhat.com wrote: So if the lurking double encoded certificate is in LDAP, and thus Apache DS shows is invalid (it shows as OK in my RHEL-7.0 server), maybe the easiest way to fix it

Re: [Freeipa-users] certmonger question

2014-11-11 Thread Natxo Asenjo
hi, On Tue, Nov 11, 2014 at 2:13 PM, Martin Kosek mko...@redhat.com wrote: I meant IPA server running on RHEL/CentOS 6.5 or older... This is the one that can regenerate CAcert entry without double encoding. ok. So I removed the cacert object and ran ipa-ldap-updater --upgrade --ldapi (it

Re: [Freeipa-users] certmonger question

2014-11-11 Thread Martin Kosek
On 11/11/2014 02:47 PM, Natxo Asenjo wrote: hi, On Tue, Nov 11, 2014 at 2:13 PM, Martin Kosek mko...@redhat.com wrote: I meant IPA server running on RHEL/CentOS 6.5 or older... This is the one that can regenerate CAcert entry without double encoding. ok. So I removed the cacert

Re: [Freeipa-users] certmonger question

2014-11-11 Thread Natxo Asenjo
hi, This seems to happen only in 32bits vm's. At least in my limited testing, 2 out 2 32bits hosts running 6.5 after upgrading have this problem. A amd64 host is ok. $ rpm -qa | grep certmonger certmonger-0.75.13-1.el6.x86_64 $ rpm -qa | grep certmonger certmonger-0.75.13-1.el6.i686 --

Re: [Freeipa-users] certmonger question

2014-11-11 Thread Nalin Dahyabhai
On Tue, Nov 11, 2014 at 08:48:18AM +0100, Natxo Asenjo wrote: 2014-11-11 08:34:33 [11677] Certificate Local Signing Authority valid for 31473668s. 2014-11-11 08:34:33 [11677] Running result is 1481416576. 2014-11-11 08:34:33 [11677] Final result is 1481416576. Okay, that's weird. The result

Re: [Freeipa-users] certmonger question

2014-11-11 Thread Nalin Dahyabhai
On Tue, Nov 11, 2014 at 11:13:12AM -0500, Nalin Dahyabhai wrote: Since you mention that this seems to be specific to 32-bit boxes, I think I need to switch to that one to try to sort out what's happening here, since I'm on a 64-bit box. Okay, found it, and as 64-bit cleanliness sometimes is,

[Freeipa-users] certmonger question

2014-11-10 Thread Natxo Asenjo
hi, is this the right list to post certmonger questions? Here I see only a developer's list without too much activity: https://fedorahosted.org/certmonger/ My question is simple. After upgrading a vm running centos 6.5 to 6.6 I am seeing this error on reboot in messages: Nov 10 15:51:31

Re: [Freeipa-users] certmonger question

2014-11-10 Thread Nalin Dahyabhai
On Mon, Nov 10, 2014 at 04:17:49PM +0100, Natxo Asenjo wrote: Nov 10 15:51:31 apachetest03 certmonger: Decoding error on

Re: [Freeipa-users] certmonger question

2014-11-10 Thread Natxo Asenjo
Hi Nalin, On Mon, Nov 10, 2014 at 5:19 PM, Nalin Dahyabhai na...@redhat.com wrote: On Mon, Nov 10, 2014 at 04:17:49PM +0100, Natxo Asenjo wrote: How can I debug this? First thing would be to run the daemon with additional logging - I usually use '-d3' to watch what's going on while the