I was tailing several logs in /var/log/pki/pki-tomcat/ca/ (debug,
system, and transactions) and though the replica installation failed again at the same
point, this is what I got from the logs throughout the installation process:
This doesn't seem to show any errors. Reading the pki logs can be
problematic as it often charges on after an error is encountered so
subsequent errors are basically red herrings but I don't see anything
wrong here at all, or I'm missing something.
The IPA installer calls pki-spawn <bunch of options> so not much comes
back to us. It's a black box. Can you provide the whole debug log,
out-of-band is fine too. I'd also suggest looking at the debug log on
the existing CA as it may be part of the communication as well.
rob
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
SecurityDomainResource.getDomainInfo()
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: mapping:
default
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: required
auth methods: [*]
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: anonymous
access allowed
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor:
SecurityDomainResource.getDomainInfo()
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: No ACL mapping.
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
SecurityDomainResource.getDomainInfo()
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
content-type: null
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor: accept:
[application/json]
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor: response
format: application/json
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: according to ccMode, authorization
for servlet: securitydomain is LDAP based, not XML {1}, use default authz mgr: {2}.
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapBoundConnFactory: init
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapBoundConnFactory:doCloning
true
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapAuthInfo: init()
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapAuthInfo: init begins
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapAuthInfo: init ends
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: init: before makeConnection
errorIfDown is false
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: makeConnection: errorIfDown false
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapJssSSLSocket set client auth
cert nicknamesubsystemCert cert-pki-ca
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SSL handshake happened
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: Established LDAP connection with
SSL client auth to ipa1.our.net:636
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: initializing with mininum 3 and
maximum 15 connections to host
ipa1.our.net port 636, secure connection, true,
authentication type 2
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: increasing minimum connections by
3
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: new total available connections 3
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: new number of connections 3
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected: true
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is connected true
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: name:
IPA
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: subtype:
CA
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
cn=ipa1.our.net:443,cn=CAList,ou=Security Domain,o=ipaca
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
objectClass: top
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
host:
ipa1.our.net
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
SecurePort: 443
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
SecureAgentPort: 443
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
SecureAdminPort: 443
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
SecureEEClientAuthPort: 443
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
UnSecurePort: 80
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
Clone: FALSE
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
SubsystemName: CA
ipa1.our.net 8443
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: - cn:
ipa1.our.net:443
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: -
DomainManager: TRUE
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: subtype:
OCSP
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: subtype:
KRA
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: subtype:
RA
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: subtype:
TKS
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor: subtype:
TPS
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: Releasing ldap connection
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now 3
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: Authentication: UID=admin
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected: true
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is connected true
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapAnonConnFactory::getConn
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapAnonConnFactory.getConn(): num
avail conns now 2
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now 3
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SSL handshake happened
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now 2
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected: true
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is connected true
[08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now 3
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected: true
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is connected true
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now 3
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected: true
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is connected true
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now 3
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
AccountResource.login()
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: mapping:
account
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: required
auth methods: [passwdUserDBAuthMgr, certUserDBAuthMgr]
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
authentication manager: passwdUserDBAuthMgr
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: access
granted
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor:
AccountResource.login()
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: mapping:
account.login
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: principal: admin
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: ACL:
certServer.ca.account,login
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: checkACLS(): ACLEntry expressions=
user="anybody"
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: evaluating expressions:
user="anybody"
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: evaluated expression:
user="anybody" to be true
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: DirAclAuthz: authorization passed
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: access granted
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
AccountResource.login()
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
content-type: null
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor: accept:
[application/json]
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor: response
format: application/json
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
AccountResource.logout()
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: mapping:
account
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: required
auth methods: [passwdUserDBAuthMgr, certUserDBAuthMgr]
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
authentication manager: passwdUserDBAuthMgr
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor: access
granted
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor:
AccountResource.logout()
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: mapping:
account.logout
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: principal: admin
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: ACL:
certServer.ca.account,logout
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: checkACLS(): ACLEntry expressions=
user="anybody"
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: evaluating expressions:
user="anybody"
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: evaluated expression:
user="anybody" to be true
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: DirAclAuthz: authorization passed
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: access granted
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
AccountResource.logout()
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
content-type: null
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor: accept:
[application/json]
[08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor: response
format: application/json
It again failed at this point:
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/30]: configuring certificate server instance
ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: Command
'/usr/sbin/pkispawn -s CA -f /tmp/tmph2SUT4' returned non-zero exit status 1
ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following
files/directories for more information:
ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR CA configuration failed.
ipapython.admintool: ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
Is there another way to transfer or duplicate the CA? We are ultimately planning to shut
this box down due to its age, and currently it is the only CA, but it seems to be trying
to hang on to its job security... ;-)