{"action":"opened","issue":{"url":"https://api.github.com/repos/freeipa/freeipa-letsencrypt/issues/1","repository_url":"https://api.github.com/repos/freeipa/freeipa-letsencrypt","labels_url":"https://api.github.com/repos/freeipa/freeipa-letsencrypt/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/freeipa/freeipa-letsencrypt/issues/1/comments","events_url":"https://api.github.com/repos/freeipa/freeipa-letsencrypt/issues/1/events","html_url":"https://github.com/freeipa/freeipa-letsencrypt/issues/1","id":184786797,"number":1,"title":"Not working with docker image","user":{"login":"JoyceBabu","id":502942,"avatar_url":"https://avatars.githubusercontent.com/u/502942?v=3","gravatar_id":"","url":"https://api.github.com/users/JoyceBabu","html_url":"https://github.com/JoyceBabu","followers_url":"https://api.github.com/users/JoyceBabu/followers","following_url":"https://api.github.com/users/JoyceBabu/following{/other_user}","gists_url":"https://api.github.com/users/JoyceBabu/gists{/gist_id}","starred_url":"https://api.github.com/users/JoyceBabu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JoyceBabu/subscriptions","organizations_url":"https://api.github.com/users/JoyceBabu/orgs","repos_url":"https://api.github.com/users/JoyceBabu/repos","events_url":"https://api.github.com/users/JoyceBabu/events{/privacy}","received_events_url":"https://api.github.com/users/JoyceBabu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-24T09:09:57Z","updated_at":"2016-10-24T09:09:57Z","closed_at":null,"body":"I have FreeIPA docker container based on `adelton/freeipa-server`. When I run the `setup-le.sh` script, I am getting SEC_ERROR_UNKNOWN_ISSUER error.\r\n\r\n> [root@freeipa ipa-le]# ipa-cacert-manage install /root/ipa-le/ca/LetsEncryptAuthorityX3.pem -n letsencryptx3 -t C,,\r\n> Installing CA certificate, please wait\r\n> Not a valid CA certificate: (SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is not recognized. (visit http://www.freeipa.org/page/Troubleshooting for troubleshooting guide)\r\n> The ipa-cacert-manage command failed.\r\n> [root@freeipa ipa-le]# ipa-cacert-manage install /root/ipa-le/ca/LetsEncryptAuthorityX3.pem -n letsencryptx3 -t C,,\r\n> Installing CA certificate, please wait\r\n> Not a valid CA certificate: (SEC_ERROR_UNKNOWN_ISSUER) Peer's Certificate issuer is not recognized. (visit http://www.freeipa.org/page/Troubleshooting for troubleshooting guide)\r\n> The ipa-cacert-manage command failed.\r\n\r\nAccording to LetsEncrypt Chain of Trust, `LetsEncryptAuthorityX3` is not cross signed by `ISGRoot X1`.\r\n\r\n![image](https://letsencrypt.org/certs/isrg-keys.png)\r\n\r\nSo I tried installing the `(IdentTrust) DST Root CA X3`. Now I am getting SEC_ERROR_UNTRUSTED_ISSUER error.\r\n\r\n```\r\n[root@freeipa ipa-le]# ipa-cacert-manage install /root/ipa-le/ca/DSTRootCAX3.pem -n DSTRootCAX3 -t ,,\r\nInstalling CA certificate, please wait\r\nCA certificate successfully installed\r\nThe ipa-cacert-manage command was successful\r\n[root@freeipa ipa-le]# ipa-cacert-manage install /root/ipa-le/ca/LetsEncryptAuthorityX3.pem -n letsencryptx3 -t C,,\r\nInstalling CA certificate, please wait\r\nNot a valid CA certificate: (SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user. (visit http://www.freeipa.org/page/Troubleshooting for troubleshooting guide)\r\nThe ipa-cacert-manage command failed.\r\n```\r\n\r\n"}}
{"actor":{"display_login":"JoyceBabu"}}