Bug 813382

Summary:	Document how to start services with expired certificates
Product:	Red Hat Enterprise Linux 6	Reporter:	Dmitri Pal <dpal>
Component:	doc-Identity_Management_Guide	Assignee:	Deon Ballard <dlackey>
Status:	CLOSED CURRENTRELEASE	QA Contact:	ecs-bugs
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.3	CC:	jgalipea, jskeoch, kchamart, mkosek
Target Milestone:	rc	Keywords:	Documentation
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-26 15:02:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dmitri Pal 2012-04-17 15:39:02 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2631

We should document how to start the basic IPA services when the SSL certificates have expired so one can run in a degraded mode while the underlying problems are resolved.

In mod_nss set EnforceValidCerts to no and restart httpd

In 389-ds set nsslapd-validate-cert to warn in dse.ldif

Doing these should allow all Apache, Kerberos, named and 389-ds-base to come up so at least users can log in. Client services (e.g. sudo) that require SSL will still fail due to the expired server certificates.

Comment 1 Deon Ballard 2012-04-17 16:51:43 UTC

Link (part of a section for troubleshooting servers/replicas):
http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/troubleshooting-servers-and-replicas.html#expired-certs

Comment 6 Deon Ballard 2012-06-22 21:44:59 UTC

Nice catch, Kashyap. The fix is in GA:
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/troubleshooting-servers-and-replicas.html#expired-certs

Comment 7 John Skeoch 2012-06-25 23:24:42 UTC

Verified the fix of comment#5 in:

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/troubleshooting-servers-and-replicas.html#expired-certs

Red_Hat_Enterprise_Linux-Identity_Management_Guide-6-en-US-2.2.0-0.9

---

Change the mod_nss configuration for the Apache server to not enforce valid certificates, in the NSSEnforceValidCerts parameter. If this parameter is not already in the file, then add it.
Set the value to off.

[root@ipaserver ~]# vim /etc/httpd/conf.d/nss.conf

NSSEnforceValidCerts off