Troubleshooting Quick-Start Guide

When you have a certificate problem, start here!

🚨 Emergency? Jump to Chapter 33!

If production is down, go immediately to Chapter 33: Emergency Procedures

📋 The 7-Step Method (Chapter 27)

1. Identify: RHEL version, OpenSSL, crypto-policy
2. Verify: Expiry, hostname, key match, algorithm
3. Trust: CA validation, chain, intermediates
4. Config: Service files, paths, permissions
5. System: Crypto-policy, FIPS, SELinux, firewall
6. Test: Live connections, curl, openssl s_client
7. Logs: Service logs, journal, SELinux audit

Full methodology: Chapter 27

⚡ Quick Diagnostics

First 60 Seconds

# What RHEL version?
cat /etc/redhat-release

# Certificate expired?
openssl x509 -in /etc/pki/tls/certs/server.crt -noout -checkend 0

# Service running?
systemctl status httpd

# Recent errors?
journalctl -xe | grep -i cert | tail -20

# Crypto-policy? (RHEL 8+)
update-crypto-policies --show

🔍 Common Problems

Certificate Expired

# Check
openssl x509 -in cert.crt -noout -dates

# Fix
sudo getcert resubmit -f cert.crt  # If using certmonger tracking
# Or renew manually, or use Chapter 33 emergency procedures

Trust Chain Broken

# Check
openssl verify cert.crt

# Fix
sudo cp ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Permission Denied

# Check
ls -l /etc/pki/tls/private/server.key

# Fix
sudo chmod 600 /etc/pki/tls/private/server.key
sudo chown root:root /etc/pki/tls/private/server.key

Hostname Mismatch

# Check
openssl x509 -in cert.crt -noout -ext subjectAltName

# Fix
# Reissue certificate with correct SANs

No Shared Cipher (RHEL 8+)

# Check
update-crypto-policies --show

# Temporary fix
sudo update-crypto-policies --set LEGACY
sudo systemctl restart httpd

# Proper fix: Update client to support TLS 1.2+

SHA-1 Rejected (RHEL 9+)

# Check
openssl x509 -in cert.crt -noout -text | grep "Signature Algorithm"

# Fix
# Must reissue with SHA-256+ (no workaround)

📖 Where to Look

⚙️ Service-Specific Commands

# Apache
apachectl configtest
tail -f /var/log/httpd/ssl_error_log

# NGINX
nginx -t
tail -f /var/log/nginx/error.log

# Postfix
postfix check
tail -f /var/log/maillog | grep TLS

# OpenLDAP
slapcat -b "cn=config" | grep TLS
# Note: Keys must be owned by ldap:ldap!

# PostgreSQL
sudo -u postgres psql -c "SHOW ssl;"
# Note: Keys must be owned by postgres:postgres!

# certmonger
getcert list
journalctl -u certmonger -f

🎯 Quick Reference

Most Common Issues:

1. Certificate expired → Renew
2. Missing CA → Add to trust store
3. Wrong permissions → chmod 600
4. Cert/key mismatch → Regenerate CSR
5. Hostname mismatch → Reissue with SANs
6. TLS version → Check crypto-policy
7. SELinux denying → restorecon
8. certmonger CA_UNREACHABLE → Check IPA/Kerberos

Emergency: Chapter 33

Methodology: Chapter 27