freeipa

#9401 httpd error during login: unable to get local issuer certificate
Closed: wontfix by magenbrot. Opened by magenbrot.

Closed: wontfix
Reopen Issue

Issue

I have a 3 node docker based freeipa setup running with the rocky linux image. Starting from this weekend I can't enter the ui on one node. The other nodes work fine and replication runs.

Steps to Reproduce

Unsure. The setup is pretty basic.

Actual behavior

I open the login interface and enter my credentials. After clicking "Log in" it show the message "Login failed due to an unknown reason".

In the httpd error.log I see the following line:

[Mon Jun 26 14:22:38.278497 2023] [wsgi:error] [pid 1172:tid 1348] [remote 192.168.96.1:36072] ipa: INFO: 401 Unauthorized: HTTPSConnectionPool(host='freeipa1.example.de', port=443): Max retries exceeded with url: /ipa/session/cookie (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))

Expected behavior

successful login

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

[root@freeipa1-int /]# rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.10.1-7.el9_2.x86_64
ipa-client-4.10.1-7.el9_2.x86_64
389-ds-base-2.2.4-3.el9.x86_64
package pki-ca is not installed
krb5-server-1.20.1-9.el9_2.x86_64

Additional info:

I've searched a bit on the internet and found that this could be a django issue (very unsure about that..).
Others suggest running 'ipa-certupdate' or 'ipa-cert-fix', which I tried without success.

I've started the container with this cmdline:

docker run -ti -h freeipa1-int.example.de --name freeipa1 --restart unless-stopped --read-only \
  --add-host freeipa1.example.de:195.201.170.103 --add-host freeipa2.example.de:65.109.114.248 --add-host freeipa3.example.de:94.23.160.183 \
  --add-host freeipa1:195.201.170.103 --add-host freeipa2:65.109.114.248 --add-host freeipa3:94.23.160.183 \
  --add-host freeipa1-int.example.de:192.168.96.1 --add-host freeipa2-int.example.de:192.168.96.2 --add-host freeipa3-int.example.de:192.168.96.3 \
  --add-host freeipa1-int:192.168.96.1 --add-host freeipa2-int:192.168.96.2 --add-host freeipa3-int:192.168.96.3 \
  -v /srv/freeipa/data:/data:Z \
  -e PASSWORD=SqXJ1ygUZbUCEyFUFhJC \
  --sysctl net.ipv6.conf.lo.disable_ipv6=0 \
  --sysctl net.ipv6.conf.eth0.disable_ipv6=0 \
  --sysctl net.ipv6.conf.all.disable_ipv6=0 \
  -p 53:53/udp -p 53:53 -p 81:80 -p 88:88/udp -p 88:88 -p 123:123/udp -p 389:389 -p 444:443 -p 464:464/udp -p 464:464 -p 636:636 -p 7389:7389 -p 9443:9443 -p 9444:9444 -p 9445:9445 \
  freeipa/freeipa-server:rocky-9 ipa-server-install -r IPA.EXAMPLE.DE --domain=ipa.example.de --hostname=freeipa1-int.example.de --netbios-name=IPA --setup-adtrust --ssh-trust-dns --no-dnssec-validation --setup-dns --setup-kra --auto-forwarders --auto-reverse --allow-zone-overlap --no-ntp --unattended

Installation went fine and it was already running a few weeks. I also updated 2 or 3 times to a newer release already.

Another log message in httpd/error.log is (probably unrelated): 

[Mon Jun 26 14:51:56.620061 2023] [wsgi:alert] [pid 38401:tid 38401] (2)No such file or directory: mod_wsgi (pid=38401): Unable to change working directory to home directory '/var/lib/kdcproxy' for uid=288.
[Mon Jun 26 14:51:56.620082 2023] [wsgi:alert] [pid 38401:tid 38401] mod_wsgi (pid=38401): Failure to configure the daemon process correctly and process left in unspecified state. Restarting daemon process after delay.

Does anyone have a clue whats happening here?

best regards
Oli

Docker Version is 24.0.2 running on Debian Buster

Running FreeIPA on a container is tricky, and container configuration should follow a strict set of rules, or everything falls apart.

Take a look at https://github.com/freeipa/freeipa-container. They have some instructions that should be closely followed, with very little margin for customization.

alright, thank you. I think I'll switch to a non-docker installation. I had a few other problems with it, but about this I have no clue.

Metadata Update from @magenbrot:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.