Jochen Kellner via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
And that's due to an error I made when trying to fix KRA. This is
an
excerpt from "getcert list":
Request ID '20210210143948':
status: MONITORING
ca-error: Server at
"http://freeipa1.example.org:8080/ca/ee/ca/profileSubmit" replied: Policy Set
Not Found
...
That's from the ca error log:
2021-11-14 15:09:58 [http-nio-8080-exec-15] INFO: EnrollProfile: Creating ernrollment
request 139960063
2021-11-14 15:09:58 [http-nio-8080-exec-15] SEVERE: CertProcessor: no profile policy set
found
2021-11-14 15:09:58 [http-nio-8080-exec-15] SEVERE: ProfileSubmitServlet: error in
processing request: Policy Set Not Found
Policy Set Not Found
After some more debugging and thinking and tinkering:
The CA Profile caStorageCert was broken in LDAP. I remove the entry, ran
ipa-server-upgrade which reloaded the profile from disk and finally the
certificate has been refreshed.
Now ipa-healthcheck is without errors on my CA renewal master. So I'm
now working on the replicas.
Jochen
--
This space is intentionally left blank.