running ipa-healthcheck --failures-only on newly installed ipa-server lists ERROR for IPACertfileExpirationCheck #342
Comments
|
Can you provide the output of |
|
[root@s1biok20idmp01 ~]# ipa-healthcheck --source ipahealthcheck.ipa.certs --check IPACertfileExpirationCheck --verbose --debug stderr= stderr= stderr= stderr= stderr= stderr= stderr= stderr= stderr= stderr= response body (decoded): b'{\n "Response" : {\n "State" : "1",\n "Type" : "CA",\n "Status" : "running",\n "Version" : "11.5.0-SNAPSHOT"\n }\n}' stderr= stderr= stderr= stderr= stderr= stderr= stderr= stderr= stderr= |
|
Hi, the output is really strange because and |
|
rpm -qa nss-tools nss-tools-3.90.0-3.el9_2.x86_64 : Tools for the Network Security Services |
|
I think this is the behavior when asking for a certificate that isn't on the provided token name, in this case NSS Certificate DB Are you in FIPS mode? Can you provide the output of: modutil -list -dbdir sql:/etc/pki/pki-tomcat/alias |
|
update-crypto-policies --show |
|
fips-mode-setup --check |
|
Let me send it tomorrow. I have left my work area. Let me have all the commands I need to run to provide more information for the troubleshooting. |
|
Another question. Was IPA installed while the server as in FIPS mode or was it put into FIPS mode some time after installation completed? One way to tell is to look for "has FIPS mode enabled on this operating system." in /var/log/ipaserver-install.log |
|
modutil -list -dbdir sql:/etc/pki/pki-tomcat/alias Listing of PKCS #11 Modules
fips-mode-setup --check
|
|
Any keys generated prior to putting a system into FIPS mode are not compliant. What ipa-healthcheck is running into, and you'll probably see this when the certificates go to renew, is that certmonger thinks the keys are on the token "NSS Certificate DB" which is the non-FIPS NSS token. So I think that renewal will fail. My recommendation would be to disable FIPS on this system. If FIPS is required then you'd unfortunately need to re-install IPA from scratch. Sorry to be the bearer of bad news. I'll try to create a check to test for this condition and provide a more useful message. |
|
Is enabling the FIPS required for AD integration? Do you have a procedure for smoothly integrating the IDM into Microsoft AD? |
|
FIPS is not required for AD. For setup information I'd refer you to the IdM documentation on docs.redhat.com. |
|
Related upstream freeIPA ticket https://pagure.io/freeipa/issue/7423 |
|
I saw the ticket. Can you also add a warning and not allow enabling the FIPS if IPA is already installed? It should give a warning or will not allow it. |
|
Not allowing FIPS to be enabled is something outside of our control. What we may also do, in addition to any new healthcheck test I add, is to prevent IPA from starting if it detects this situation. That decision is not finalized. |
|
Thank you. |
I'm getting a list of unable to find certificate.
ERROR: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20240828072907: Request id 20240828072907: Unable to retrieve cert 'auditSigningCert cert-pki-ca' from '/etc/pki/pki-tomcat/alias': Unable to find certificate
ERROR: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20240828072908: Request id 20240828072908: Unable to retrieve cert 'ocspSigningCert cert-pki-ca' from '/etc/pki/pki-tomcat/alias': Unable to find certificate
ERROR: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20240828072909: Request id 20240828072909: Unable to retrieve cert 'subsystemCert cert-pki-ca' from '/etc/pki/pki-tomcat/alias': Unable to find certificate
ERROR: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20240828072910: Request id 20240828072910: Unable to retrieve cert 'caSigningCert cert-pki-ca' from '/etc/pki/pki-tomcat/alias': Unable to find certificate
ERROR: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20240828072911: Request id 20240828072911: Unable to retrieve cert 'Server-Cert cert-pki-ca' from '/etc/pki/pki-tomcat/alias': Unable to find certificate
ERROR: ipahealthcheck.ipa.certs.IPACertfileExpirationCheck.20240828072913: Request id 20240828072913: Unable to retrieve cert 'Server-Cert' from '/etc/dirsrv/slapd-IDM-SEMAT-GOV-SA': Unable to find certificate
Running 'getcert list' all certificates show with status MONITORING,
The text was updated successfully, but these errors were encountered: