On 2/18/19 8:36 PM, Adrian Villwock via FreeIPA-users wrote:
Hi all,
we try to set up IPA replication between a Master (Version 4.4.0 on CentOS 7.3) and a new
IPA (Version 4.5.1 on CentOS 7.5) on different hosts.
We followed the official documentation by first installing the ipa dependencies, then ipa
server, added the new host by running "ipa-client-install --server=<new-host>
--domain=<existing-domain>". Lastly, we simply ran
"ipa-replica-install" and the process gets stuck on "installing X509
Certificate for PKINIT" and resumes after some minutes:
>> Full PKINIT configuration did not succeed
>> The setup will only install bits essential to the server functionality
>> You can enable PKINIT after the setup completed using
'ipa-pkinit-manage'
>> Done configuring Kerberos KDC (krb5kdc).
Even so, logging into the new IPA all users, groups, services are available. Running
"ipa-pkinit-manage enable" doesn't help the following problem.
Hi,
you are probably hitting issue 7200, where ipa-pkinit-manage enable
reports success although it did not complete.
The workaround is to delete the files
/var/kerberos/krb5kdc/kdc.{key,crt} and re-run ipa-pkinit-manage enable.
At this point, the cert in /var/kerberos/krb5kdc/kdc.crt should be
issued by IPA CA. You can check with
$ openssl x509 -noout -text -in /var/kerberos/krb5kdc/kdc.crt | grep Issuer
and you should see
Issuer: O=<DOMAIN.COM>, CN=Certificate Authority
HTH,
flo
[1]
https://pagure.io/freeipa/issue/7200
---
Problem:
The new IPA instance is reporting issues then running "ipa cert_find":
Certificate operation cannot be completed: Unable to communicate with CMS (Comment not
terminated, line 2, column 1)
The same error can be observed by navigating to the IPA Web UI -> Authentication -
> Certificates: Certificate operation cannot be completed: Unable to communicate with
CMS (Comment not terminated, line 2, column 1)
The /var/log/httpd/error_log report the same issue (on the new IPA only):
[:error] [pid 15679] ipa: ERROR: ra.find(): Unable to communicate with CMS (Comment not
terminated, line 2, column 1)
Running "getcert list" shows no expired certificates...
---
We ran into the same issues when we tried to upgrade the host OS from CentOS 7.3 to 7.5
(which executes the IPA Upgrade script). With that issue we were not able to remove
services from the IPA at all (only adding services, adding/removing users and groups). We
then chose to roll back the VM. But now we need to upgrade the OS version.
---
How can we go from here? We could not find any similar issue ("Comment not
terminated, line 2, column 1") at all.
Kind regards
Adrian
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...