Bug 741458

The host-disable is trying to revoke the host certificate.

From the command line I would assume this also fails:

$ ipa cert-show <serial #>

This does a client authenticated HTTPS request to /ca/agent/ca/displayBySerial

You may want to check /var/log/pki-ca/debug to see if there are any errors logged there when this fails.

Does the nickname ipaCert exist when you do:

# certutil -L -d /etc/httpd/alias

Was this a fresh install of 2.1.1 or an upgrade from earlier version?

# ipa cert-show 268369923
ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)

There are no entries in /var/log/pki-ca/debug at the time I attempt to run ipa cert-show or ipa host-disable.

#  certutil -L -d /etc/httpd/alias

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Server-Cert                                                  u,u,u
IX.TEST.COM IPA CA                                           CT,C,C
ipaCert                                                      u,u,u
Signing-Cert                                                 u,u,u

Version 2.0 was installed fresh on F15, then upgraded to 2.1.1 later.

Does this help?

These are the apache log lines that correspond to # ipa host-disable <hostname, and # ipa cert-show <serialno>. I have no config files in my /etc/httpd/conf.d/ directory that contains any reference to the /ca directory. Also /var/www/html/ca does not exist.

I notice that the freeipa-server-2.1.1-1.fc15.x86_64 rpm lists a file /etc/httpd/conf.d/ipa-pki-proxy.conf. However this file does not exist on any of my 3 IPA servers.

Should that file contain an alias and proxy rules for /ca/ ?


error_log:
[Tue Sep 27 21:44:01 2011] [error] ipa: INFO: admin.COM: ping(): SUCCESS
[Tue Sep 27 21:44:02 2011] [error] ipa: INFO: sslget 'https://ipasrv01.ix.TEST.com:443/ca/agent/ca/displayBySerial'
[Tue Sep 27 21:44:02 2011] [error] [client 192.168.210.20] File does not exist: /var/www/html/ca
[Tue Sep 27 21:44:02 2011] [error] ipa: INFO: admin.COM: host_disable(u'bck01.ix.TEST.com'): CertificateOperationError
[Tue Sep 27 21:44:08 2011] [error] ipa: INFO: admin.COM: ping(): SUCCESS
[Tue Sep 27 21:44:09 2011] [error] ipa: INFO: sslget 'https://ipasrv01.ix.TEST.com:443/ca/agent/ca/displayBySerial'
[Tue Sep 27 21:44:09 2011] [error] [client 192.168.210.20] File does not exist: /var/www/html/ca
[Tue Sep 27 21:44:09 2011] [error] ipa: INFO: admin.COM: cert_show(u'268369923'): CertificateOperationError

access_log:
192.168.210.20 - admin.COM [27/Sep/2011:21:44:00 +0200] "POST /ipa/xml HTTP/1.1" 200 259
192.168.210.20 - - [27/Sep/2011:21:44:02 +0200] "POST /ca/agent/ca/displayBySerial HTTP/1.1" 404 314
192.168.210.20 - admin.COM [27/Sep/2011:21:44:01 +0200] "POST /ipa/xml HTTP/1.1" 200 360
192.168.210.20 - admin.COM [27/Sep/2011:21:44:07 +0200] "POST /ipa/xml HTTP/1.1" 200 259
192.168.210.20 - - [27/Sep/2011:21:44:09 +0200] "POST /ca/agent/ca/displayBySerial HTTP/1.1" 404 314
192.168.210.20 - admin.COM [27/Sep/2011:21:44:08 +0200] "POST /ipa/xml HTTP/1.1" 200 360

This was experienced once in QE after an update, I believe it was around the time that this for fixed ...
https://bugzilla.redhat.com/show_bug.cgi?id=726526

The patch mentioned in that bug seem to be applied in the version running on my IPA servers.

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/1889

From upstream ticket ::

There are three files that need to be addressed.

On the tomcat side, the files are in the Tomcat instance managed by IPA in /var/lib/pki-ca. The first is

/var/lib/pki-ca/conf/server.xml

It needs the addition:

+ <Connector port="9447" protocol="AJP/1.3" redirectPort="9444" />

You can place it around line 281, above the comment for the line <Engine name="Catalina" defaultHost="localhost">

Second is: /var/lib/pki-ca/webapps/ca/WEB-INF/web.xml

For each of the filter entries it needs the code addition below:

    <init-param>

        <param-name>proxy_port</param-name> <param-value>443</param-value>

    </init-param>

+ <init-param> + <param-name>proxy_port</param-name> + <param-value>443</param-value> + </init-param>

    <init-param>

        <param-name>active</param-name> <param-value>true</param-value>

    </init-param>

    </filter>

The third change is creating a symlink to /etc/pki-ca/proxy.conf in the directory /etc/httpd/conf.d


Additional change required:

/var/lib/pki-ca/conf/CS.cfg

http.port=8080 https.port=8443

Fixed upstream:

master:
f3ca0618c27df93e9a8836bead7d881301240945
12cc78caf6654e1e4b00d19b2ad55c7db7883edb
ae65c0193271b70929f8d011f2a1aa5dff99f426

ipa-2-1: 
8cfddc3a0fc2f59ae57b6fb601c552b91fec480b
f30924decd4fd43d41bf747dedbd72100373b7a5