FreeIPA - Need help with Expired Certificate #11921

New issue

Closed

opened 2024-05-15 17:39:14 +00:00 by lostboy786 · 3 comments

lostboy786 commented

2024-05-15 17:39:14 +00:00

Hello!

I have inherited a FreeIPA server, and upon checking the certificate list with getcert list, it shows that the certificate is already expired. Does anyone know how to renew it? And coz of this issue, I am not able to enroll any any clients. Any help would be appreciated.

Request ID '20160825909273':
status: CA_UNREACHABLE
ca-error: Server at https://test.domain.com/ipa/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https://test.domain.com:443/ca/eeca/ca/profileSubmitSSLClient': (SSL_ERROR_EXPIRED_CERT_ALERT) SSL peer rejected your certificate as expired.).
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-TEST-DOMAIN-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-TEST-DOMAINCOM/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-TEST-DOMAIN-COM',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=TEST-DOMAIN-COM
subject: CN=test.domain.com,O=TEST.DOMAIN.COM
expires: 2023-12-18 15:52:08 UTC
principal name: ldap/test.domain.com@TEST.DOMAIN.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv TEST.DOMAIN.COM
track: yes
auto-renew: yes

Hello! I have inherited a FreeIPA server, and upon checking the certificate list with getcert list, it shows that the certificate is already expired. Does anyone know how to renew it? And coz of this issue, I am not able to enroll any any clients. Any help would be appreciated. Request ID '20160825909273': status: CA_UNREACHABLE ca-error: Server at https://test.domain.com/ipa/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https://test.domain.com:443/ca/eeca/ca/profileSubmitSSLClient': (SSL_ERROR_EXPIRED_CERT_ALERT) SSL peer rejected your certificate as expired.). stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-TEST-DOMAIN-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-TEST-DOMAINCOM/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-TEST-DOMAIN-COM',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=TEST-DOMAIN-COM subject: CN=test.domain.com,O=TEST.DOMAIN.COM expires: 2023-12-18 15:52:08 UTC principal name: ldap/test.domain.com@TEST.DOMAIN.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv TEST.DOMAIN.COM track: yes auto-renew: yes

kevin commented

2024-05-15 17:44:28 +00:00

I'm afraid this is not the right place for your question... this is the place about running fedora infrastructure/services... not general support. ;)

I'd suggest the freeipa-users list: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/ or #freeipa on libera.chat irc network

I'm afraid this is not the right place for your question... this is the place about running fedora infrastructure/services... not general support. ;) I'd suggest the freeipa-users list: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/ or #freeipa on libera.chat irc network

kevin commented

2024-05-15 17:44:29 +00:00

Metadata Update from @kevin:

Issue close_status updated to: Will Not/Can Not fix
Issue status updated to: Closed (was: Open)

**Metadata Update from @kevin**: - Issue close_status updated to: Will Not/Can Not fix - Issue status updated to: Closed (was: Open)

lostboy786 commented

2024-05-15 17:46:19 +00:00

Author

Thank you for pointing me in the right direction! I appreciate the guidance and will reach out to the freeipa-users list and check out the #freeipa channel on Libera.Chat for further support. Thanks again!