Lost CAcert.pem

[Moritz_Bunkus]

Hey,

a DC Backup contains a copy of all certificates, in fact, the whole directory tree /etc/univention/ssl should exist on your DC Backup.

That being said, it is possible that the DC Backup will sync the deletion of the file as well.

If you don’t have a copy on your DC Backup anymore, you could look into the procedure to renew the whole certificate chain including the CA certificate. This is is described in the following post:

Renewing the complete SSL certificate chain

Problem: How can a full reneweal of the complete SSL chain be achieved? Solution: To recreate CAkey.pem and demanding certificates, please to the following: Backup the old certificates /etc/univention/ssl/: mv /etc/univention/ssl /etc/univention/ssl_$(date +"%d%m%Y") Create a new SSL-chain and a new certificate for the DC master: apt-get install --reinstall univention-ssl Fix the permissions: chgrp 'DC Backup Hosts' -R /etc/univention/ssl/openssl.cnf /etc/univention/ssl/password /etc/…

This will also regenerate the server certificates which will likely fix your issues with all the services not working (as all of them rely on encrypted connections to the LDAP server in the end).

Last but not least you should really look into setting up daily backups of your servers. I cannot stress how important having complete, recoverable, fresh backup is.

m.