On Wed, Jun 9, 2021, at 2:32 PM, Rob Crittenden wrote:
> Bret Wortman via FreeIPA-users wrote:
>> Looks like we're missing an LDAP connection port?
>> [09/Jun/2021:10:02:54][localhost-startStop-1]: LdapBoundConnFactory: init
>> Property internaldb.ldapconn.port missing value
>> Full debug log is at
> That error is expected (and ignored).
> It looks like the failure is here:
> [09/Jun/2021:10:02:56][http-bio-8443-exec-3]: ConfigurationUtils: GET
> javax.ws.rs.ProcessingException: Unable to invoke request
> Caused by: java.io.IOException: SocketException cannot write on socket
> So I suppose make sure that communication works but given this is the
> standard https port it seems like it should just work. Look on
to see if it got a connection at all, or if it logged some
Nothing in the logs on ipa1.our.net
(httpd/error_log or httpd/access_log), so I tried
this after the failure:
[root@ipa2c7 ~]# curl -XGET https://ipa1.our.net:443/ca/admin/ca/getCertChain
<?xml version="1.0" encoding="UTF-8"
So the server is responding and the client can get the correct response, at least a few
seconds later, it can. I did note that without the --cacert on the curl, I did get an
error back but with it, I got an answer.
So you've run ipa-replica-prepare <host> and then ship that file to
At some point we started re-generating the CA certs file
(/root/cacert.p12) during preparation. Did we do this in F21? I have no
Can you use pk12util to look at the contents of that file? The password
is the initial DM password. Look for expirations, things like that.
# pk12util -l /root/cacert.p12
You can generate a new one but it requires putting passwords into files
If you need to generate a new one make a backup of the current, put the
passwords in files per below and run this:
# PKCS12Export -d /etc/pki/pki-tomcat/alias/ -p /tmp/nssdbpwd -w
/tmp/pk12pwd -o /root/cacert.p12
The NSS db password is in /etc/pki/pki-tomcat/password.conf the value
Otherwise I'm not sure what would generate the socket error except a
real network issue. Can you run wireshark on the new server during the
install to see what is happening?