yrro
commented
2 years ago I wonder if this could be caused by the same thing that caused me to bump into https://github.com/dogtagpki/pki/issues/3877, i.e. the KRA related certificates in /var/lib/pki/pki-tomcat/conf/kra/CS.cfg don't match the certs stored in /etc/pki/pki-tomcat/alias.
Digging further into what's going on it looks like the certs from that NSS DB do match what I find in the directory under cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=example,dc=com.
So I tried to find out what is supposed to be updating /var/lib/pki/pki-tomcat/conf/kra/CS.cfg and... I can only see that path referred to (as ipaplatform.paths.paths.KRA_CS_CFG_PATH) by only a couple of files:
ipaplatform/base/paths.py: KRA_CS_CFG_PATH = "/var/lib/pki/pki-tomcat/conf/kra/CS.cfg"
ipaserver/install/ipa_cert_fix.py: paths.KRA_CS_CFG_PATH),
ipaserver/install/ipa_cert_fix.py: paths.KRA_CS_CFG_PATH),
ipaserver/install/ipa_cert_fix.py: paths.KRA_CS_CFG_PATH),
ipaserver/install/krainstance.py: config=paths.KRA_CS_CFG_PATH,
ipaserver/install/server/upgrade.py: paths.KRA_CS_CFG_PATH,I don't see any of those paths/modules referred to by /usr/libexec/ipa/certmonger/renew_ca_cert which is set as the post-save command for the KRA certificates:
+ sudo getcert list -n 'auditSigningCert cert-pki-kra'
Number of certificates and requests being tracked: 12.
Request ID '20210518174639':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-kra',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM
subject: CN=KRA Audit,O=IPA.EXAMPLE.COM
expires: 2023-03-31 21:42:08 UTC
key usage: digitalSignature,nonRepudiation
profile: caAuditSigningCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-kra"
track: yes
auto-renew: yes
+ sudo getcert list -n 'storageCert cert-pki-kra'
Number of certificates and requests being tracked: 12.
Request ID '20210518174641':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='storageCert cert-pki-kra',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='storageCert cert-pki-kra',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM
subject: CN=KRA Storage Certificate,O=IPA.EXAMPLE.COM
expires: 2023-03-31 21:42:23 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-clientAuth
profile: caStorageCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "storageCert cert-pki-kra"
track: yes
auto-renew: yes
+ sudo getcert list -n 'transportCert cert-pki-kra'
Number of certificates and requests being tracked: 12.
Request ID '20210518174640':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='transportCert cert-pki-kra',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='transportCert cert-pki-kra',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM
subject: CN=KRA Transport Certificate,O=IPA.EXAMPLE.COM
expires: 2023-03-31 21:42:06 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-clientAuth
profile: caTransportCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "transportCert cert-pki-kra"
track: yes
auto-renew: yesBit confused now...
flo-renaud
With
pki-server-10.11.2-2.module+el8.5.0+12735+8eb38ccc.noarch, i'm seeing:I get exactly the same when I run the test on
ipa3as well. Those are the only two ipa servers I have at the moment.The following is logged when the healthcheck is run:
This is similar to #212 but in that issue there is a different message printed to stderr before the results are printed to stdout.
cc @rcritten