From manuel.gugliucci at scaiitec.it Mon Feb 8 10:59:46 2021 Content-Type: multipart/mixed; boundary="===============7800438118481319740==" MIME-Version: 1.0 From: Manuel Gugliucci To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] IPA certs expired, pki-tomcatd fails to start Date: Mon, 08 Feb 2021 10:59:36 +0000 Message-ID: <20210208105936.31782.85508@mailman01.iad2.fedoraproject.org> --===============7800438118481319740== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello, I'm running a freeipa server over a cloudera cluster, on 2020-12-31 all the= certs expired and did not renew by itself. After I set the system date before the expiration date, I tried ipa-cacert-= renew but returns an error saying that ca cert are not managed by certmonge= r so I did a getcert resubmit for every cert. Almos all went on "Monitoring" state, except for one that says "NEED_CSR_GE= N_PIN". If I try to do 'ipactl start', it starts to first upgrade IPA and fails bec= ause of the pki-tomcat service: ``` 2019-12-31T19:12:01Z DEBUG response body 'Apache Tomcat/= 7.0.76 - Error report

HTTP Status 500 - Sub= system unavailable


type Ex= ception report

message Subsystem unavailable

d= escription The server encountered an internal error that prevented i= t from fulfilling this requ est.

exception

javax.ws.rs.ServiceUnavailableExcepti=
on: Subsystem unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurit=
yConstraints(ProxyRealm.java:145)\n\torg.apache.catalina.authenticator.Auth=
enticatorBase.invoke(AuthenticatorBase.java:492)\n\torg.apache.catalina.val=
ves.ErrorReportValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catali=
na.valves.AccessLogValve.invoke(AccessLogValve.java:962)\n\torg.apache.cata=
lina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)\n\torg.apache.=
coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:=
1091)\n\torg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.proce=
ss(AbstractProtocol.java:637)\n\torg.apache.tomcat.util.net.JIoEndpoint$Soc=
ketProcessor.run(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolEx=
ecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concurrent.Thre=
adPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.tomcat=
.util.threads.TaskThrea
 d$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.=
java:748)\n

note The full stack trace of the root cau= se is available in the Apache Tomcat/7.0.76 logs.


Apache Tomcat/7.0.76

' 2019-12-31T19:12:01Z DEBUG The CA status is: check interrupted due to error= : Retrieving CA status failed with status 500 2019-12-31T19:12:01Z DEBUG Waiting for CA to start... ``` I also looked for the previous threads listed on this forum, but none of th= em provided a solution --===============7800438118481319740==--