2017-07-31T18:23:47Z DEBUG /usr/sbin/ipa-ca-install was invoked with options: {'external_cert_files': None, 'skip_schema_check': False, 'external_ca_type': None, 'unattended': False, 'no_host_dns': False, 'ca_signing_algorithm': None, 'debug': False, 'external_ca': False, 'skip_conncheck': False},/var/lib/ipa/replica-info-ipa1.neonova.net.gpg 2017-07-31T18:23:47Z DEBUG IPA version 4.4.0-14.el7.centos.7 2017-07-31T18:23:47Z DEBUG importing all plugin modules in ipaserver.plugins... 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.aci 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.automember 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.automount 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.baseldap 2017-07-31T18:23:47Z DEBUG ipaserver.plugins.baseldap is not a valid plugin module 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.baseuser 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.batch 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.ca 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.caacl 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.cert 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.certprofile 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.config 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.delegation 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.dns 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.dnsserver 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.dogtag 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.domainlevel 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.group 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.hbac 2017-07-31T18:23:47Z DEBUG ipaserver.plugins.hbac is not a valid plugin module 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.hbacrule 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.hbacsvc 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.hbacsvcgroup 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.hbactest 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.host 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.hostgroup 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.idrange 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.idviews 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.internal 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.join 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.krbtpolicy 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.ldap2 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.location 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.migration 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.misc 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.netgroup 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.otp 2017-07-31T18:23:47Z DEBUG ipaserver.plugins.otp is not a valid plugin module 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.otpconfig 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.otptoken 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.passwd 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.permission 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.ping 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.pkinit 2017-07-31T18:23:47Z DEBUG ipaserver.plugins.pkinit is not a valid plugin module 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.privilege 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.pwpolicy 2017-07-31T18:23:47Z DEBUG Starting external process 2017-07-31T18:23:47Z DEBUG args=klist -V 2017-07-31T18:23:47Z DEBUG Process finished, return code=0 2017-07-31T18:23:47Z DEBUG stdout=Kerberos 5 version 1.14.1 2017-07-31T18:23:47Z DEBUG stderr= 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.rabase 2017-07-31T18:23:47Z DEBUG ipaserver.plugins.rabase is not a valid plugin module 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.radiusproxy 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.realmdomains 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.role 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.schema 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.selfservice 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.selinuxusermap 2017-07-31T18:23:47Z DEBUG importing plugin module ipaserver.plugins.server 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.serverrole 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.serverroles 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.service 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.servicedelegation 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.session 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.stageuser 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.sudo 2017-07-31T18:23:48Z DEBUG ipaserver.plugins.sudo is not a valid plugin module 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.sudocmd 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.sudocmdgroup 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.sudorule 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.topology 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.trust 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.user 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.vault 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.virtual 2017-07-31T18:23:48Z DEBUG ipaserver.plugins.virtual is not a valid plugin module 2017-07-31T18:23:48Z DEBUG importing plugin module ipaserver.plugins.xmlserver 2017-07-31T18:23:50Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-NEONOVA-NET.socket from SchemaCache 2017-07-31T18:23:50Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-NEONOVA-NET.socket conn= 2017-07-31T18:23:50Z DEBUG KRB5CCNAME set to None 2017-07-31T18:23:50Z DEBUG Failed to find default ccache: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639053): No Kerberos credentials available (default cache: KEYRING:persistent:0) 2017-07-31T18:24:01Z DEBUG Initializing principal admin@NEONOVA.NET using password 2017-07-31T18:24:01Z DEBUG Starting external process 2017-07-31T18:24:01Z DEBUG args=/usr/bin/kinit admin@NEONOVA.NET -c /tmp/tmpEzQKOF 2017-07-31T18:24:02Z DEBUG Process finished, return code=0 2017-07-31T18:24:02Z DEBUG stdout=Password for admin@NEONOVA.NET: 2017-07-31T18:24:02Z DEBUG stderr= 2017-07-31T18:24:10Z DEBUG Starting external process 2017-07-31T18:24:10Z DEBUG args=/usr/bin/gpg-agent --batch --homedir /tmp/tmpLODCpwipa/ipa-2oixm3/.gnupg --daemon /usr/bin/gpg --batch --homedir /tmp/tmpLODCpwipa/ipa-2oixm3/.gnupg --passphrase-fd 0 --yes --no-tty -o /tmp/tmpLODCpwipa/files.tar -d /var/lib/ipa/replica-info-ipa1.neonova.net.gpg 2017-07-31T18:24:10Z DEBUG Process finished, return code=0 2017-07-31T18:24:10Z DEBUG Starting external process 2017-07-31T18:24:10Z DEBUG args=tar xf /tmp/tmpLODCpwipa/files.tar -C /tmp/tmpLODCpwipa 2017-07-31T18:24:10Z DEBUG Process finished, return code=0 2017-07-31T18:24:10Z DEBUG stdout= 2017-07-31T18:24:10Z DEBUG stderr= 2017-07-31T18:24:10Z DEBUG Installing replica file with version 40400 (0 means no version in prepared file). 2017-07-31T18:24:10Z DEBUG Check if ipa1.neonova.net is a primary hostname for localhost 2017-07-31T18:24:10Z DEBUG Primary hostname for localhost: ipa1.neonova.net 2017-07-31T18:24:10Z DEBUG Search DNS for ipa1.neonova.net 2017-07-31T18:24:10Z DEBUG Check if ipa1.neonova.net is not a CNAME 2017-07-31T18:24:10Z DEBUG Check reverse address of 137.118.22.105 2017-07-31T18:24:10Z DEBUG Found reverse name: ipa1.neonova.net 2017-07-31T18:24:10Z DEBUG Created connection context.ldap2_60716432 2017-07-31T18:24:10Z DEBUG Starting external process 2017-07-31T18:24:10Z DEBUG args=/usr/sbin/ipa-replica-conncheck --master ipa0.neonova.net --auto-master-check --realm NEONOVA.NET --hostname ipa1.neonova.net --password XXXXXXXX --ca-cert-file /tmp/tmpLODCpwipa/realm_info/ca.crt 2017-07-31T18:24:29Z DEBUG Process finished, return code=0 2017-07-31T18:24:29Z DEBUG stdout=Check connection from replica to remote master 'ipa0.neonova.net': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos Kpasswd: TCP (464): OK HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK The following list of ports use UDP protocol and would need to be checked manually: Kerberos KDC: UDP (88): SKIPPED Kerberos Kpasswd: UDP (464): SKIPPED Connection from replica to master is OK. Start listening on required ports for remote master check Get credentials to log in to remote master Check RPC connection to remote master Execute check on remote master Check connection from master to remote replica 'ipa1.neonova.net': Directory Service: Unsecure port (389): OK Directory Service: Secure port (636): OK Kerberos KDC: TCP (88): OK Kerberos KDC: UDP (88): WARNING Kerberos Kpasswd: TCP (464): OK Kerberos Kpasswd: UDP (464): WARNING HTTP Server: Unsecure port (80): OK HTTP Server: Secure port (443): OK The following UDP ports could not be verified as open: 88, 464 This can happen if they are already bound to an application and ipa-replica-conncheck cannot attach own UDP responder. Connection from master to replica is OK. 2017-07-31T18:24:29Z DEBUG stderr= 2017-07-31T18:24:29Z DEBUG Installing CA Replica from master with a merged database 2017-07-31T18:24:29Z DEBUG Destroyed connection context.ldap2_60716432 2017-07-31T18:24:29Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-31T18:24:29Z DEBUG Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds 2017-07-31T18:24:29Z DEBUG [1/25]: creating certificate server user 2017-07-31T18:24:29Z DEBUG group pkiuser exists 2017-07-31T18:24:29Z DEBUG user pkiuser exists 2017-07-31T18:24:29Z DEBUG duration: 0 seconds 2017-07-31T18:24:29Z DEBUG [2/25]: configuring certificate server instance 2017-07-31T18:24:29Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-31T18:24:29Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2017-07-31T18:24:29Z DEBUG Contents of pkispawn configuration file (/tmp/tmpsfcdDm): [CA] pki_security_domain_name = IPA pki_enable_proxy = True pki_restart_configured_instance = False pki_backup_keys = True pki_backup_password = XXXXXXXX pki_profiles_in_ldap = True pki_default_ocsp_uri = http://ipa-ca.neonova.net/ca/ocsp pki_client_database_dir = /tmp/tmp-8toOVr pki_client_database_password = XXXXXXXX pki_client_database_purge = False pki_client_pkcs12_password = XXXXXXXX pki_admin_name = admin pki_admin_uid = admin pki_admin_email = root@localhost pki_admin_password = XXXXXXXX pki_admin_nickname = ipa-ca-agent pki_admin_subject_dn = cn=ipa-ca-agent,O=NEONOVA.NET pki_client_admin_cert_p12 = /root/ca-agent.p12 pki_ds_ldap_port = 389 pki_ds_password = XXXXXXXX pki_ds_base_dn = o=ipaca pki_ds_database = ipaca pki_subsystem_subject_dn = cn=CA Subsystem,O=NEONOVA.NET pki_ocsp_signing_subject_dn = cn=OCSP Subsystem,O=NEONOVA.NET pki_ssl_server_subject_dn = cn=ipa1.neonova.net,O=NEONOVA.NET pki_audit_signing_subject_dn = cn=CA Audit,O=NEONOVA.NET pki_ca_signing_subject_dn = cn=Certificate Authority,O=NEONOVA.NET pki_subsystem_nickname = subsystemCert cert-pki-ca pki_ocsp_signing_nickname = ocspSigningCert cert-pki-ca pki_ssl_server_nickname = Server-Cert cert-pki-ca pki_audit_signing_nickname = auditSigningCert cert-pki-ca pki_ca_signing_nickname = caSigningCert cert-pki-ca pki_ca_signing_key_algorithm = SHA256withRSA pki_security_domain_hostname = ipa0.neonova.net pki_security_domain_https_port = 443 pki_security_domain_user = admin pki_security_domain_password = XXXXXXXX pki_clone = True pki_clone_pkcs12_path = /tmp/ca.p12 pki_clone_pkcs12_password = XXXXXXXX pki_clone_replication_security = TLS pki_clone_replication_master_port = 389 pki_clone_replication_clone_port = 389 pki_clone_replicate_schema = False pki_clone_uri = https://ipa0.neonova.net:443 2017-07-31T18:24:29Z DEBUG Starting external process 2017-07-31T18:24:29Z DEBUG args=/usr/sbin/pkispawn -s CA -f /tmp/tmpsfcdDm 2017-07-31T18:26:05Z DEBUG Process finished, return code=1 2017-07-31T18:26:05Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20170731142429.log Loading deployment configuration from /tmp/tmpsfcdDm. Installing CA into /var/lib/pki/pki-tomcat. Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg. Importing certificates from /tmp/ca.p12: --------------- 7 entries found --------------- Certificate ID: e95ae395e2dde6b9a7acded85cf986a045abcd66 Serial Number: 0x3 Nickname: Server-Cert cert-pki-ca Subject DN: CN=ipa0.neonova.net,O=NEONOVA.NET Issuer DN: CN=Certificate Authority,O=NEONOVA.NET Trust Flags: u,u,u Has Key: true Certificate ID: d984f5c4989e33a867db42b0cb3507d052ffa2ac Serial Number: 0x1 Nickname: caSigningCert cert-pki-ca Subject DN: CN=Certificate Authority,O=NEONOVA.NET Issuer DN: CN=Certificate Authority,O=NEONOVA.NET Trust Flags: CTu,Cu,Cu Has Key: true Certificate ID: 707b706a81dc3ca46cc5d41b4a43136640572bce Serial Number: 0x5 Nickname: auditSigningCert cert-pki-ca Subject DN: CN=CA Audit,O=NEONOVA.NET Issuer DN: CN=Certificate Authority,O=NEONOVA.NET Trust Flags: u,u,Pu Has Key: true Certificate ID: 47beabc922eae80e78783462a79f45c254fde68b Serial Number: 0x0 Nickname: gdroot-g2 Subject DN: CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US Issuer DN: CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US Trust Flags: C,, Has Key: false Certificate ID: f1a2a7809987c83f4ec235e8afca722822119df Serial Number: 0x2 Nickname: ocspSigningCert cert-pki-ca Subject DN: CN=OCSP Subsystem,O=NEONOVA.NET Issuer DN: CN=Certificate Authority,O=NEONOVA.NET Trust Flags: u,u,u Has Key: true Certificate ID: 6f488148f52f50ec60b2910253f53cb246377ff Serial Number: 0x4 Nickname: subsystemCert cert-pki-ca Subject DN: CN=CA Subsystem,O=NEONOVA.NET Issuer DN: CN=Certificate Authority,O=NEONOVA.NET Trust Flags: u,u,u Has Key: true Certificate ID: 27ac9369faf25207bb2627cefaccbe4ef9c319b8 Serial Number: 0x7 Nickname: gdbundle-g2 Subject DN: CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US Issuer DN: CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US Trust Flags: C,, Has Key: false --------------- Import complete --------------- Imported certificates in /etc/pki/pki-tomcat/alias: Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI gdroot-g2 C,, Server-Cert cert-pki-ca u,u,u caSigningCert cert-pki-ca CTu,Cu,Cu auditSigningCert cert-pki-ca u,u,Pu gdbundle-g2 C,, ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u Installation failed: Please check the CA logs in /var/log/pki/pki-tomcat/ca. 2017-07-31T18:26:05Z DEBUG stderr=certutil: Could not find cert: gdroot-g2 : PR_FILE_NOT_FOUND_ERROR: File not found certutil: Could not find cert: gdbundle-g2 : PR_FILE_NOT_FOUND_ERROR: File not found 2017-07-31T18:26:05Z CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpsfcdDm' returned non-zero exit status 1 2017-07-31T18:26:05Z CRITICAL See the installation logs and the following files/directories for more information: 2017-07-31T18:26:05Z CRITICAL /var/log/pki/pki-tomcat 2017-07-31T18:26:05Z DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 586, in __spawn_instance DogtagInstance.spawn_instance(self, cfg_file) File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 181, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 420, in handle_setup_error raise RuntimeError("%s configuration failed." % self.subsystem) RuntimeError: CA configuration failed. 2017-07-31T18:26:05Z DEBUG [error] RuntimeError: CA configuration failed. 2017-07-31T18:26:05Z DEBUG File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 752, in run_script return_value = main_function() File "/usr/sbin/ipa-ca-install", line 302, in main install(safe_options, options, filename) File "/usr/sbin/ipa-ca-install", line 242, in install install_replica(safe_options, options, filename) File "/usr/sbin/ipa-ca-install", line 204, in install_replica ca.install(True, config, options) File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 118, in install install_step_0(standalone, replica_config, options) File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 140, in install_step_0 ra_p12=getattr(options, 'ra_p12', None)) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1558, in install_replica_ca subject_base=config.subject_base) File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 437, in configure_instance self.start_creation(runtime=210) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 449, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 439, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 586, in __spawn_instance DogtagInstance.spawn_instance(self, cfg_file) File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 181, in spawn_instance self.handle_setup_error(e) File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 420, in handle_setup_error raise RuntimeError("%s configuration failed." % self.subsystem) 2017-07-31T18:26:05Z DEBUG The ipa-ca-install command failed, exception: RuntimeError: CA configuration failed.