Chat now with support
Chat with Support

Safeguard Authentication Services 5.1 - Administration Guide

Privileged Access Suite for Unix Introducing One Identity Safeguard Authentication Services Unix administration and configuration Identity management Migrating from NIS Managing access control Managing local file permissions Certificate Autoenrollment [[[Missing Linked File System.LinkedTitle]]] Managing Unix hosts with Group Policy
Safeguard Authentication Services Group Policy
Group Policy Concepts Unix policies One Identity policies
Display specifiers Troubleshooting Glossary

Troubleshooting Certificate Autoenrollment

To help you troubleshoot Certificate Autoenrollment, One Identity recommends the following resolutions to some of the common errors, and methods for finding and correcting configuration problems.

Certificate Autoenrollment process exited with an error

As mentioned in the Certificate Autoenrollment on UNIX and Linux section, some important Certification Autoenrollment commands, such as vascert pulse, will NOT work until the necessary platform-specific functionality has been implemented in certstore-DEV.sh. For more information on modifying certstore-DEV.sh and a simple example script, see the Examples and further explanation for modifying certstore-DEV.sh on Linux and Unix (284711) KB article.

Until the certstore-DEV.sh script is modified, the following issues will happen when running vascert pulse:

<VASCERT PULSE COMMAND>

$ vascert pulse

vascert: One Identity Certificate Autoenrollment version 1.1.0.750

Copyright 2017 Quest Software Inc. ALL RIGHTS RESERVED. 

 

Processing enrollment policy: dc1.domain.com

Process exited with an error (Exit value: 1), command was: [/var/opt/quest/vascert/script/certstore.sh, export-machine-certs, /tmp/6353628018779558796pk12, mdzDFXBD7znDYDO8B]

</VASCERT PULSE COMMAND> 

The output shows which script vascert ran and the parameters passed to the script. As previously mentioned, certstore.sh calls (on all platforms other than macOS) certstore-DEV.sh. In the example above, certstore.sh calls into certstore-DEV.sh's exportMachineCerts function. By default, that function only returns a 1 indicating an error as shown here:

exportMachineCerts()

{

   echo "=== UNIMPLEMENTED exportMachineCerts'()' ==="

   exit 1

}

See the Examples and further explanation for modifying certstore-DEV.sh on Linux and Unix (284711) KB article for a deeper understanding of that function, expected parameters, and an example for using that function. As long as that function returns '1', autoenrollment will cease at this point and vascert will not enroll for a new certificate. Because this is the first step of many, see the KB article for other functions that need to be modified and examples on how to do so.

Enable full debug logging

You can enable full debug logging for all Certificate Autoenrollment components using the vascert command line utility.

macOS: If debug logging is configured, Group Policy extensions, the vascert tool, and launchd write log files in /Library/Preferences/com.quest.X509Enrollment/log for machine enrollment and ~/Library/Preferences/com.quest.X509Enrollment/log for user enrollment. You can enable debug logging for all of these components.

UNIX/Linux: If debug logging is configured, the vascert tool writes files in /var/opt/quest/vascert/.com.quest.X509Enrollment/log for machine enrollment and ~/.com.quest.X509Enrollment/log for user enrollment. You can enable debug logging for all of these components.

To enable debug logging

  1. As root, run the following command to configure debug logging for all users:

    /opt/quest/bin/vascert configure debug

  2. To configure debug logging for a specific user, log in as that user and run the same command.

    NOTE: Enabling debug logging causes the vascert command to write debug messages to a file in addition to stdout. Even after you enable debug logging, you must set the debug level using the -d command line option when running vascert commands manually.

  3. When you are finished debugging, run the following command as root to turn off debug logging for all users. One Identity recommends that you turn off debug logging to improve performance and conserve disk space.

    /opt/quest/bin/vascert unconfigure debug

  4. To turn off debug logging for a specific user, log in as that user and run the same command.

Pulse Certificate Autoenrollment processing

Use the vascert command line utility to manually perform Certificate Autoenrollment.

To perform Certificate Autoenrollment processing manually

  1. Decide whether you want to pulse Certificate Autoenrollment for the machine or a specific user.
  2. To pulse Certificate Autoenrollment for the machine, run the following command as root (or using sudo):

    /opt/quest/bin/vascert pulse

    NOTE: macOS: To pulse certificate enrollment for the machine, you must run the command with root privileges. This is mostly useful for troubleshooting. In some cases (such as when logging in by means of SSH), this will not result in successful certificate enrollment because the System.keychain cannot export existing private keys required for certificate renewal processing. If you just want to run Certificate Autoenrollment processing for the machine and you are not interested in the output, use vascert trigger instead.

  3. To pulse Certificate Autoenrollment for a specific user, log in as that user and run the following command:

    /opt/quest/bin/vascert pulse

    NOTE: macOS: Use the GUI to log in as the user. This ensures that the user's keychain is unlocked so that enrolled certificates can be exported and imported. Logging in by other means, such as SSH, is generally not sufficient and may lead to errors when the certstore-mac.sh script invokes the /usr/bin/security tool.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating