Red Hat Bugzilla – Bug 813382
Document how to start services with expired certificates
Last modified: 2012-06-26 11:02:20 EDT
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/2631 We should document how to start the basic IPA services when the SSL certificates have expired so one can run in a degraded mode while the underlying problems are resolved. In mod_nss set EnforceValidCerts to no and restart httpd In 389-ds set nsslapd-validate-cert to warn in dse.ldif Doing these should allow all Apache, Kerberos, named and 389-ds-base to come up so at least users can log in. Client services (e.g. sudo) that require SSL will still fail due to the expired server certificates.
Link (part of a section for troubleshooting servers/replicas): http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/troubleshooting-servers-and-replicas.html#expired-certs
Nice catch, Kashyap. The fix is in GA: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/troubleshooting-servers-and-replicas.html#expired-certs
Verified the fix of comment#5 in: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/troubleshooting-servers-and-replicas.html#expired-certs Red_Hat_Enterprise_Linux-Identity_Management_Guide-6-en-US-2.2.0-0.9 --- Change the mod_nss configuration for the Apache server to not enforce valid certificates, in the NSSEnforceValidCerts parameter. If this parameter is not already in the file, then add it. Set the value to off. [root@ipaserver ~]# vim /etc/httpd/conf.d/nss.conf NSSEnforceValidCerts off