FreeIPA-users October 2018

freeipa-users@lists.fedorahosted.org

66 participants
92 discussions

ipa-ca-install failure with very few info
by Andrey Bondarenko 01 Oct '18

01 Oct '18

Hello, I have IPA cluster with several nodes and I have a problem installing there another replica with CA enabled. If I want to add CA role to one of the nodes: [root@ipa01:~] ipa-ca-install -w SECRET Directory Manager (existing master) password: Run connection check to master Connection check OK Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/25]: creating certificate server db [2/25]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 953 seconds elapsed Update succeeded [3/25]: creating installation admin user [4/25]: configuring certificate server instance ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /mnt/tmp/tmpXXXXXX' returned non-zero exit status 1 ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information: ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. CA configuration failed. In the log file, the only error I see is WARNING: The 'pki_ssl_server_nickname' in [CA] has been deprecated. Use 'pki_sslserver_nickname' instead. WARNING: The 'pki_ssl_server_subject_dn' in [CA] has been deprecated. Use 'pki_sslserver_subject_dn' instead. ERROR: Unable to access security domain: 503 Server Error: Service Unavailable Where should I dig? -- With best regards, Andrey Bondarenkomail:me@andreybondarenko.comhttps://andreybondarenko.com skype:andrey.bondarenko phone, Telegram, WhatsApp, etc:+420-773-591-443 7758 40AC 88CC 96C9 0C9A 9EE4 3B72 547B 7538 D41B

2 2

Can't install CA from replica file - Failed to import EncryptedPrivateKeyInfo to token
by H. Frenzel 01 Oct '18

01 Oct '18

Hi, I tried to install a CA to the 2nd master a replicafile which was created on the 1st master (with self-signed CA), with fails with: ipa : DEBUG stderr=TokenException: Failed to import EncryptedPrivateKeyInfo to token: (-8152) The key does not support the requested operation. What could be wrong here? - Please find the detailed debug log of ipa-ca-install as attachment. Thx & b/r H.

3 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2018