FixIPAcert
If cert-monger won't renew the certificate with an error like:
certmonger: Error setting up ccache for local "host" service using default keytab: Keytab contains no suitable keys for host/phedex.wn.iihe.ac.be@.
Choose solution A or B:
Solution A
1. Set the hostname to the private one:
hostname host.wn.iihe.ac.be
2. Uninstall ipa client:
ipa-client-install --uninstall
3. Set One Time Password (OTP) in freeipa for the host (either use the common one, or one of your choosing)
4. Check that the script /root/ipa_enrollment.sh has the correct OTP on the first command, then execute it:
/root/ipa_enrollment.sh
4. If everything went well, the last output line should be:
MAC verified OK
5. Set back the hostname to the public one
hostname host.iihe.ac.be
Solution B
1.Set the hostname to the private one:
hostname host.wn.iihe.ac.be
2. make sure the file /etc/krb5.conf looks something like:
#File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = WN.IIHE.AC.BE dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = yes [realms] WN.IIHE.AC.BE = { kdc = freeipa.wn.iihe.ac.be:88 master_kdc = freeipa.wn.iihe.ac.be:88 admin_server = freeipa.wn.iihe.ac.be:749 default_domain = wn.iihe.ac.be pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .wn.iihe.ac.be = WN.IIHE.AC.BE wn.iihe.ac.be = WN.IIHE.AC.BE
3. get the list of the current certificates and note the Request ID:
getcert list
4. Issue the renewal command:
getcert resubmit -i REQUEST_ID
5. Extract the certificate:
/etc/cron.weekly/extract_machine_cert_from_nssdb.sh
If this worked, you should get an output like:
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" < 0> rsa ecf952c9e775998f587132d0e0bd3304ac917d9a IPA Machine Certificate - phedex.wn.iihe.ac.be pk12util: PKCS12 EXPORT SUCCESSFUL MAC verified OK
6. Re-set the hostname to the correct one:
hostname host.(wn.)iihe.ac.be