Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem: 'Error initializing SSL/TLS' is seen when we try to do a winsync replication agreement with a tree-root domain having standalone CA installed
Version-Release number of selected component (if applicable):
ipa-server-4.4.0-2.1.el7.x86_64
How reproducible:Always
Steps to Reproduce:
1. Install IPA-server with --setup-dns
2. Disable dnssec validation and restart named-pkcs11.service
3. Add forwardzone for Windows domain to which winsync-agreement is to be setup.
4. Create a tree root domain for an existing forest.
5. Now add 'Active directory Certificate Service' from Server Manager.
6. Under Standalone CA select Root CA
(Note: Enterprise CA is grayed out since there is already one installed in the forest root domain)
7. Copy file /etc/ipa/ca.crt on the AD server as IPAcert.cer
8. Copy IPAcert.cer to Red Hat Directory Password Synchronization directory.
9. certutil -d . -N
10. certutil -d . -A -n "IPA CA" -t CT,, -a -i IPAcert.cer
11. Restart AD
12. Copy the Adcert.cer file in /etc/dirsrv/<instance-name>
13. certutil -d . -A -i ADcert.cer -n "AD Cert" -t "CT,C,C" -a
14. Ensure certificate is seen in 'certutil -d . -L'
15. /etc/openldap/ldap.conf add TLS_CACERTDIR /etc/dirsrv/slapd-<instancename>
16. Try to create replication agreement using the below command.
ipa-replica-manage connect --winsync --passsync=password --cacert=/etc/dirsrv/slapd-TESTRELM.TEST/ADcert.cer win3.test.qa --binddn "cn=Administrator,cn=Users,dc=test,dc=qa" --bindpw ***** -v -p *****
Actual results:
[root@server slapd-TESTRELM-TEST]# ipa-replica-manage connect --winsync --passsync=**** --cacert=/etc/dirsrv/slapd-TESTRELM-TEST/ADcert.cer win3.test.qa --binddn "cn=Administrator,cn=Users,dc=test,dc=qa" --bindpw **** -v -p *****
Added CA certificate /etc/dirsrv/slapd-TESTRELM-TEST/ADcert.cer to certificate database for server.testrelm.test
ipa: INFO: Failed to connect to AD server win3.test.qa
ipa: INFO: The error was: {'info': '00000000: LdapErr: DSID-0C090F78, comment: Error initializing SSL/TLS, data 0, v2580', 'desc': 'Server is unavailable'}
Failed to setup winsync replication
Expected results: The winsync agreement should be setup if its supported.
Additional info:
1. Currently we can establish winsync replication agreement only with forest domain having enterprise root CA.
2. When we try to establish winsync replication agreement with tree root domain in which only Standalone(RootCA/Subordinate CA) is allowed to be created, the winsync agreement doesn't work
3. Was trying to execute the scenario to ensure that we can actually add external trust to tree root domain and then run winsync-migrate.
Note: https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/pass-sync.html has a TIP given:
Install the Microsoft Certificate System in Enterprise Root Mode. Active Directory will then automatically enroll to retrieve its SSL server certificate.
So does this mean we only allow winsync agreement with Enterprise Root CA mode?
ab,
This is what i saw on the console, please have a look.
[root@vm92 ~]# openssl s_client -debug -connect win3.test.qa:636
CONNECTED(00000003)
write to 0x1c3a260 [0x1c7a6d0] (247 bytes => -1 (0xFFFFFFFFFFFFFFFF))
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---
Discussed with Rob, it still seems as incorrect usage. Given that it was probably part of our testing we should examine it again if hit again. Ideally interactively.
Description of problem: 'Error initializing SSL/TLS' is seen when we try to do a winsync replication agreement with a tree-root domain having standalone CA installed Version-Release number of selected component (if applicable): ipa-server-4.4.0-2.1.el7.x86_64 How reproducible:Always Steps to Reproduce: 1. Install IPA-server with --setup-dns 2. Disable dnssec validation and restart named-pkcs11.service 3. Add forwardzone for Windows domain to which winsync-agreement is to be setup. 4. Create a tree root domain for an existing forest. 5. Now add 'Active directory Certificate Service' from Server Manager. 6. Under Standalone CA select Root CA (Note: Enterprise CA is grayed out since there is already one installed in the forest root domain) 7. Copy file /etc/ipa/ca.crt on the AD server as IPAcert.cer 8. Copy IPAcert.cer to Red Hat Directory Password Synchronization directory. 9. certutil -d . -N 10. certutil -d . -A -n "IPA CA" -t CT,, -a -i IPAcert.cer 11. Restart AD 12. Copy the Adcert.cer file in /etc/dirsrv/<instance-name> 13. certutil -d . -A -i ADcert.cer -n "AD Cert" -t "CT,C,C" -a 14. Ensure certificate is seen in 'certutil -d . -L' 15. /etc/openldap/ldap.conf add TLS_CACERTDIR /etc/dirsrv/slapd-<instancename> 16. Try to create replication agreement using the below command. ipa-replica-manage connect --winsync --passsync=password --cacert=/etc/dirsrv/slapd-TESTRELM.TEST/ADcert.cer win3.test.qa --binddn "cn=Administrator,cn=Users,dc=test,dc=qa" --bindpw ***** -v -p ***** Actual results: [root@server slapd-TESTRELM-TEST]# ipa-replica-manage connect --winsync --passsync=**** --cacert=/etc/dirsrv/slapd-TESTRELM-TEST/ADcert.cer win3.test.qa --binddn "cn=Administrator,cn=Users,dc=test,dc=qa" --bindpw **** -v -p ***** Added CA certificate /etc/dirsrv/slapd-TESTRELM-TEST/ADcert.cer to certificate database for server.testrelm.test ipa: INFO: Failed to connect to AD server win3.test.qa ipa: INFO: The error was: {'info': '00000000: LdapErr: DSID-0C090F78, comment: Error initializing SSL/TLS, data 0, v2580', 'desc': 'Server is unavailable'} Failed to setup winsync replication Expected results: The winsync agreement should be setup if its supported. Additional info: 1. Currently we can establish winsync replication agreement only with forest domain having enterprise root CA. 2. When we try to establish winsync replication agreement with tree root domain in which only Standalone(RootCA/Subordinate CA) is allowed to be created, the winsync agreement doesn't work 3. Was trying to execute the scenario to ensure that we can actually add external trust to tree root domain and then run winsync-migrate. Note: https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/pass-sync.html has a TIP given: Install the Microsoft Certificate System in Enterprise Root Mode. Active Directory will then automatically enroll to retrieve its SSL server certificate. So does this mean we only allow winsync agreement with Enterprise Root CA mode?