On Wed, Jun 9, 2021, at 2:32 PM, Rob Crittenden wrote:
> Bret Wortman via FreeIPA-users wrote:
>> Looks like we're missing an LDAP connection port?
>>
>> [09/Jun/2021:10:02:54][localhost-startStop-1]: LdapBoundConnFactory: init
>> Property internaldb.ldapconn.port missing value
>>
>> Full debug log is at
https://gist.github.com/wortmanb/7782c5c0c4318c2aec17f2eea589b567
>>
>>
>
> That error is expected (and ignored).
>
> It looks like the failure is here:
>
> [09/Jun/2021:10:02:56][http-bio-8443-exec-3]: ConfigurationUtils: GET
>
https://ipa1.our.net:443/ca/admin/ca/getCertChain
> javax.ws.rs.ProcessingException: Unable to invoke request
> ...
> Caused by: java.io.IOException: SocketException cannot write on socket
>
> So I suppose make sure that communication works but given this is the
> standard https port it seems like it should just work. Look on
>
ipa1.our.net to see if it got a connection at all, or if it logged some
> error.
Nothing in the logs on
ipa1.our.net (httpd/error_log or httpd/access_log), so I tried
this after the failure:
[root@ipa2c7 ~]# curl -XGET
https://ipa1.our.net:443/ca/admin/ca/getCertChain --cacert
/etc/ipa/ca.crt
and got:
<?xml version="1.0" encoding="UTF-8"
standalone="no"?><XMLResponse><Status>0</Status><ChainBase64>MIIDwg
[..snip..] </ChainBase64></XMLResponse>
So the server is responding and the client can get the correct response, at least a few
seconds later, it can. I did note that without the --cacert on the curl, I did get an
error back but with it, I got an answer.
So you've run ipa-replica-prepare <host> and then ship that file to
<host> right?
At some point we started re-generating the CA certs file
(/root/cacert.p12) during preparation. Did we do this in F21? I have no
idea.
Can you use pk12util to look at the contents of that file? The password
is the initial DM password. Look for expirations, things like that.
# pk12util -l /root/cacert.p12
You can generate a new one but it requires putting passwords into files
temporarily.
If you need to generate a new one make a backup of the current, put the
passwords in files per below and run this:
# PKCS12Export -d /etc/pki/pki-tomcat/alias/ -p /tmp/nssdbpwd -w
/tmp/pk12pwd -o /root/cacert.p12
The NSS db password is in /etc/pki/pki-tomcat/password.conf the value
internal.
Otherwise I'm not sure what would generate the socket error except a
real network issue. Can you run wireshark on the new server during the
install to see what is happening?
rob