Failed to enroll certificates #864
Comments
|
Hi, First of all, thanks for your interest in adsys, and for giving the certificates policy a try. Here's the documentation page describing how to set this policy up, along with some external URLs pointing to how to set up AD CS, and some debugging tips: https://canonical-adsys.readthedocs-hosted.com/en/latest/explanation/certificates/ I agree this is very finicky to set up. The way it works under the hood is that adsys sends the domain/realm name to Samba which figures out the AD controller to perform a LDAP search on in order to get the list of CA servers ( In your case it looks like the root certificates were properly fetched from NDES, but the CEP and CES servers certificate configuration might not be correct. SSL issues can be easily debugged with curl or openssl: # bad, root certificate absent or misconfigured
> curl -I https://adc.example.com/ADPolicyProvider_CEP_Kerberos/service.svc/CEP
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
# good, no SSL error
> curl -I https://adc.example.com/ADPolicyProvider_CEP_Kerberos/service.svc/CEP
HTTP/2 401
content-length: 1293
content-type: text/html
server: Microsoft-IIS/10.0
www-authenticate: Negotiate
x-powered-by: ASP.NET
date: Wed, 06 Dec 2023 09:42:01 GMTIf the certificate is in I hope this helps! |
|
I'm closing this report due to the lack of response since Gabriel's comment. Do not hesitate to reopen if it is still an issue. |
Is there an existing issue for this?
Describe the issue
Cert enrollment is not working, certificate errors.
Steps to reproduce it
Follow the tutorial for setting up adsys with winbind.
Installing and configuring the roles in AD.
Ubuntu users: System information
ubuntu-bug adsys --save=bug_report.txt
MoTTY X11 proxy: Unsupported authorisation protocol
MoTTY X11 proxy: Unsupported authorisation protocol
(apport-gtk:28587): Gtk-CRITICAL **: 09:21:27.637: _gtk_css_lookup_resolve: assertion '(((extension ({ GTypeInstance __inst = (GTypeInstance) ((provider)); GType __t = ((_gtk_style_provider_private_get_type ())); gboolean __r; if (!__inst) __r = (0); else if (__inst->g_class && __inst->g_class->g_type == __t) __r = (!(0)); else __r = g_type_check_instance_is_a (__inst, __t); __r; }))))' failed
/usr/share/apport/apport-gtk:72: Warning: g_object_set_data_full: assertion 'G_IS_OBJECT (object)' failed
self.widgets.add_from_file(
(apport-gtk:28587): Gtk-ERROR **: 09:21:27.637: Can't create a GtkStyleContext without a display connection
Trace/breakpoint trap (core dumped)
Non Ubuntu users: System information
Environment
Log files
Please redact/remove sensitive information:
The following error messages are shown in cepces.log:
The above repeats after about 5 minutes when it tries the subca server.
Application settings
Please redact/remove sensitive information:
Additional information
getcert list returns 0 but i can see that we have gotten some CA certs downloaded on the server.
in /var/lib/adsys/certs:
'xxx issuing ca.0-3.crt'
in /usr/local/share/ca-certificates/:
'xxx issuing ca.0-3.crt'
'xxx-SUBCA.0-3.crt'
I suspect this is related to a setting in AD telling where the clients might obtain certificates as i would think the client should contact the NDES CEP or CES services and not the CA or SUBCA..I would appreciate any pointers to how we can set this up. If someone has a guide that would be helpfull as im not the one setting up AD services myself.
Double check your logs
The text was updated successfully, but these errors were encountered: