From aaron.hicks at nesi.org.nz Thu Aug 2 06:00:08 2018 Content-Type: multipart/mixed; boundary="===============2729632330439568075==" MIME-Version: 1.0 From: Aaron Hicks To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Creating CA replica fails Date: Thu, 02 Aug 2018 17:59:40 +1200 Message-ID: <001801d42a26$052ce860$0f86b920$@nesi.org.nz> In-Reply-To: 20180802053428.GX3736@T470s --===============2729632330439568075== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I'm on my way home but I manage to find this in /var/log/pki/pki-tomcat/ca/debug on the replica (hostnames have been changed to protect the innocent, ipa03 is the master ipa01 is the replica), I'll send the real logs directly to your email when I get a VPN up : [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: SystemConfigService: get configuration entries from master [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange start host=3Dipa03.example.org adminPort=3D443 eePort=3D443 [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange content: {xmlOutput=3D[true], sessionID=3D[21110386709 73117531], type=3D[request]} [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa03.example.org:443/ca/ad min/ca/updateNumberRange [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: content from admin interface =3D

The Certificate System has encountered an unrecoverable error.

Error Message:
java.lang.NullPointerException

Please contact your local administrator for assistance. [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange: Failed to contact master using admin portorg.xml.sax.SAXParseException; lineNumber: 2; columnNumber: 15; Open quote is expected for attribute "BGCOLOR" associated with an element type "BODY". [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange: Attempting to contact master using EE port [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa03.example.org:443/ca/ee/ca/updateNumberRange javax.ws.rs.NotFoundException: HTTP 404 Not Found at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.handleErrorStatus( ClientInvocation.java:181) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(Clie ntInvocation.java:154) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvoc ation.java:444) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.post(Client InvocationBuilder.java:201) at com.netscape.certsrv.client.PKIConnection.post(PKIConnection.java:509) -----Original Message----- From: Fraser Tweedale = Sent: Thursday, 2 August 2018 5:34 PM To: FreeIPA users list Cc: Aaron Hicks Subject: Re: [Freeipa-users] Creating CA replica fails Hi Aaron, Can you please provide the contents of /var/log/pki/pki-ca-spawn.20180802044015.log, and /var/log/pki/pki-tomcat/ca/debug from both the replica (if it exists) and the master. Thanks, Fraser On Thu, Aug 02, 2018 at 05:03:54PM +1200, Aaron Hicks via FreeIPA-users wrote: > Hello the List, > = > = > = > I'm successfully replicating IPA and DNS across two sites, however = > when I try and replicate CA it fails: > = > = > = > [root(a)ipa01 pki]# ipa-ca-install > = > Directory Manager (existing master) password: > = > = > = > Run connection check to master > = > Connection check OK > = > /usr/lib/python2.7/site-packages/urllib3/connection.py:251: SecurityWarning: > Certificate has no `subjectAltName`, falling back to check for a = > `commonName` for now. This feature is being removed by major browsers = > and deprecated by RFC 2818. (See = > https://github.com/shazow/urllib3/issues/497 > for details.) > = > SecurityWarning > = > Configuring certificate server (pki-tomcatd). Estimated time: 3 = > minutes > = > [1/25]: creating certificate server db > = > [2/25]: setting up initial replication > = > Starting replication, please wait until this has completed. > = > Update in progress, 5 seconds elapsed > = > Update succeeded > = > = > = > [3/25]: creating installation admin user > = > [4/25]: configuring certificate server instance > = > ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to = > configure CA > instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W' = > returned non-zero exit status 1 > = > ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the = > installation logs and the following files/directories for more information: > = > ipa.ipaserver.install.cainstance.CAInstance: CRITICAL = > /var/log/pki/pki-tomcat > = > [error] RuntimeError: CA configuration failed. > = > = > = > Your system may be partly configured. > = > Run /usr/sbin/ipa-server-install --uninstall to clean up. > = > = > = > CA configuration failed. > = > = > = > When I check the logs in /var/log/ipareplica-ca-install.log > = > = > = > > = > 2018-08-02T04:40:15Z DEBUG Starting external process > = > 2018-08-02T04:40:15Z DEBUG args=3D/usr/sbin/pkispawn -s CA -f = > /tmp/tmpaJdg1W > = > 2018-08-02T04:45:31Z DEBUG Process finished, return code=3D1 > = > 2018-08-02T04:45:31Z DEBUG stdout=3DLog file: > /var/log/pki/pki-ca-spawn.20180802044015.log > = > Loading deployment configuration from /tmp/tmpaJdg1W. > = > WARNING: The 'pki_ssl_server_nickname' in [CA] has been deprecated. = > Use 'pki_sslserver_nickname' instead. > = > WARNING: The 'pki_ssl_server_subject_dn' in [CA] has been deprecated. = > Use 'pki_sslserver_subject_dn' instead. > = > Installing CA into /var/lib/pki/pki-tomcat. > = > Storing deployment configuration into > /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg. > = > Importing certificates from /tmp/ca.p12: > = > > = > Installation failed: > = > = > = > = > = > Please check the CA logs in q. > = > = > = > 2018-08-02T04:45:31Z DEBUG stderr=3D > = > 2018-08-02T04:45:31Z CRITICAL Failed to configure CA instance: Command = > '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W > = > ' returned non-zero exit status 1 > = > 2018-08-02T04:45:31Z CRITICAL See the installation logs and the = > following files/directories for more information: > = > 2018-08-02T04:45:31Z CRITICAL /var/log/pki/pki-tomcat > = > 2018-08-02T04:45:31Z DEBUG Traceback (most recent call last): > = > File = > "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line = > 504, in start_creation > = > run_step(full_msg, method) > = > File = > "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line = > 494, in run_step > = > method() > = > File = > "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", > line 616, in __spawn_instance > = > self.tmp_agent_pwd) > = > File > "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py" > , line 148, in spawn_instance > = > self.handle_setup_error(e) > = > File > "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py" > , line 386, in handle_setup_error > = > raise RuntimeError("%s configuration failed." % self.subsystem) > = > RuntimeError: CA configuration failed. > = > = > = > 2018-08-02T04:45:31Z DEBUG [error] RuntimeError: CA configuration failed. > = > 2018-08-02T04:45:31Z DEBUG File > "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", = > line 998, > = > in run_script > = > return_value =3D main_function() > = > = > = > File "/sbin/ipa-ca-install", line 309, in main > = > promote(safe_options, options, filename) > = > = > = > File "/sbin/ipa-ca-install", line 277, in promote > = > install_replica(safe_options, options, filename) > = > = > = > File "/sbin/ipa-ca-install", line 207, in install_replica > = > ca.install(True, config, options, custodia=3Dcustodia) > = > = > = > File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", = > line 202, in install > = > install_step_0(standalone, replica_config, options, = > custodia=3Dcustodia) > = > = > = > File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", = > line 279, in install_step_0 > = > use_ldaps=3Dstandalone) > = > = > = > File = > "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", > line 448, in configure_instance > = > self.start_creation(runtime=3Druntime) > = > = > = > File = > "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line = > 504, in start_creation > = > run_step(full_msg, method) > = > = > = > File = > "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line = > 494, in run_step > = > method() > = > = > = > File = > "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", > line 616, in __spawn_instance > = > self.tmp_agent_pwd) > = > = > = > File > "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py" > , line 148, in spawn_instance > = > self.handle_setup_error(e) > = > = > = > File > "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py" > , line 386, in handle_setup_error > = > raise RuntimeError("%s configuration failed." % self.subsystem) > = > = > = > 2018-08-02T04:45:31Z DEBUG The ipa-ca-install command failed, exception: > RuntimeError: CA configuration failed. > = > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to = > freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: = > https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: = > https://lists.fedoraproject.org/archives/list/freeipa-users(a)lists.fedo > rahosted.org/message/QJOK7T4BHOBDRSCX6GH2W6PW2QRUI6ZI/ --===============2729632330439568075==--