Can't import certificate after eDir 8.8.2 upgrade

Question

Folks,
I've trawled through most of the posts where this has been in issue,
but I can't seem to get Tomcat to import the updated LDAP keystore
certificate.
Over the weekend I upgraded my NetWare 6.5 servers to eDirectory
8.8sp2. The upgrade went smooth, and generally, everything is working
fine *except* Tomcat. I get the following errors when my GroupWise
server boots:
192.168.0.4LDAP connectivity not found on ldap://localhost:636
LDAP connectivity not found on ldap://192.168.0.4:636
Please load NLDAP and then manually execute command:
sys:/tomcat/4/bin/startup
Please load NLDAP and then manually execute command:
sys:/tomcat/4/bin/startup
-config sys:/adminsrv/conf/admin_tomcat.xml java: Class
com.novell.application.tomcat.util.tccheck.LDAPVer ifier exited succe
ssfully java: Class
com.novell.application.tomcat.util.tccheck.LDAPVer ifier exited
successfully
OK, so I try to run TCKEYGEN, the certificate will export, but Tomcat
can't seem to import it:
Error importing certificate to keystore: sys:\adminsrv\conf\.keystore
com.novell.ecb.CommandException: Connection refused at
com.novell.ecb.security.RetrieveHostCertificates.r etrieveHostCertific
ates(Unknown Source) at
com.novell.ecb.security.RetrieveHostCertificates.e xecute(Unknown Sour
ce) at
com.novell.application.tomcat.util.EDirectoryInteg rator.retrieveAllHo
stCertificates(EDirectoryIntegrator.java:698) at
com.novell.application.tomcat.util.EDirectoryInteg rator.performKeysto
reWork(EDirectoryIntegrator.java:649) at
com.novell.application.tomcat.util.EDirectoryInteg rator.integrate(EDi
rectoryIntegrator.java:386) at
com.novell.application.tomcat.util.EDirectoryInteg rator.main(EDirecto
ryIntegrator.java:117) java: Class
com.novell.application.tomcat.util.EDirectoryInteg rator exited
successfully -----------------
I've run PKIDIAG, exported a new copy of the trusted root certificate,
place the IP address of the server into TCKEYGEN.NCF and
sys:\tomcat\4\conf\server.xml to replace 'localhost', bounced the
server several times, and just can't get the certificate to update.
Anyone have a suggestion? Thanks!
Bill Valaski
Director of IT
CDS Associates, Inc.
Cincinnati, OH USA
www.cds-assoc.com

Answer 1

Hmmm, looks like an error with the LDAP Group not performing a dynamic
update .....
07:05:21 9ED6E1C0 LDAP: Dynamically upgrading LDAP Group object...
07:05:21 9ED6E1C0 LDAP: LDAP Group attribute 'LDAP Allow Clear Text
Password' not found, installing new default
07:05:21 9ED6E1C0 LDAP: LDAP Group attribute 'ldapAttributeList' not
found, creating default attribute map
07:05:21 9ED6E1C0 LDAP: Failed to clear attribute 'ldapAttributeList'
in UpdateMapList, ignoring non-fatal err = no such value (-602)
07:05:21 9ED6E1C0 LDAP: Failed to create map list with 73 values in
UpdateMapList, err = no such value (-602)
07:05:21 9ED6E1C0 LDAP: Failed to create attribute map in
UpgradeExistingLDAPGroup, err = no such value (-602)
07:05:21 9ED6E1C0 LDAP: UpgradeExistingLDAPGroup failed in
UpgradeLDAPGroupObject, err = no such value (-602)
07:05:21 9ED6E1C0 LDAP: Could not complete dynamic upgrade, err = no
such value (-602)
07:05:21 9ED6E1C0 LDAP: Could not validate Group in ReadConfigFromDS,
err = no such value (-602)
07:05:21 9ED6E1C0 LDAP: Could not update server configuration, err =
no such value (-602)
OK, this gives me a little more to try and trace through the TIDs.
Thanks!
Bill
On Tue, 29 Jul 2008 21:19:45 GMT, "Marcel Cox"
<[email protected]> wrote:
>Bill Valaski wrote:
>
>>192.168.0.4LDAP connectivity not found on ldap://localhost:636
>
>Your problem is not that tomcat doesn't have the right certificate but
>rather that NLDAP is not even listing on the secure LDAP port.
>To debug this, you might try the following:
>
>unload nldap
>set dstrace=on
>set dstrace=-all
>set dstrace=+ldap
>load nldap
>
>Now switch to the dstrce screen and see if you have any errors.