Brian J. Murrell via FreeIPA-users wrote:
On Mon, 2018-03-26 at 10:30 -0400, Rob Crittenden via FreeIPA-users
wrote:
> Brian J. Murrell via FreeIPA-users wrote:
>> I've been experiencing certmonger taking (too) long to start up and
>> systemd ends up giving up on it:
>>
>> Mar 25 08:47:41 server.interlinx.bc.ca systemd[1]: Starting
>> Certificate monitoring and PKI enrollment...
>> Mar 25 08:49:24 server.interlinx.bc.ca systemd[1]: Unit
>> certmonger.service entered failed state.
>> Mar 25 08:49:24 server.interlinx.bc.ca systemd[1]:
>> certmonger.service failed.
>>
>> The whole startup with debug logging can be see at:
>>
>>
http://brian.interlinx.bc.ca/certmonger-start-failed
>>
>> If anyone has any ideas why it's taking so long, I'd be much
>> obliged.
>
> I can't reach the web server.
Sorry. You got caught up in testing server startup fixes. Hopefully
this doesn't push a limit and require this posting to moderation or
anything like that:
-- Logs begin at Sun 2018-03-25 08:43:44 EDT, end at Sun 2018-03-25 09:16:23 EDT. --
Mar 25 08:47:41 server.interlinx.bc.ca systemd[1]: Starting Certificate monitoring and
PKI enrollment...
Mar 25 08:47:42 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:47:42 [2331]
Starting up.
Mar 25 08:47:42 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:47:42 [2331]
Changing to root directory.
[snip]
Mar 25 08:47:57 server.interlinx.bc.ca certmonger[2331]: 2018-03-25
08:47:57 [2331] Request10('20171205124815') starts in state 'MONITORING'
Mar 25 08:47:57 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:47:57 [2331]
CA1('SelfSign').identify starts (NEED_TO_REFRESH)
Mar 25 08:48:23 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:48:23 [2331]
CA1('SelfSign').certs starts (NEED_TO_REFRESH)
Mar 25 08:48:38 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:48:38 [2331]
CA1('SelfSign').profiles starts (NEED_TO_REFRESH)
Mar 25 08:49:09 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:49:09 [2331]
CA1('SelfSign').default_profile starts (NEED_TO_REFRESH)
Mar 25 08:49:09 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:49:09 [2331]
CA1('SelfSign').enrollment_reqs starts (NEED_TO_REFRESH)
Mar 25 08:49:10 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:49:10 [2331]
CA1('SelfSign').renewal_reqs starts (NEED_TO_REFRESH)
Mar 25 08:49:10 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:49:10 [2331]
CA1('SelfSign').capabilities starts (NEED_TO_REFRESH)
Mar 25 08:49:11 server.interlinx.bc.ca systemd[1]: certmonger.service start operation
timed out. Terminating.
Mar 25 08:49:13 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:49:13 [2331]
CA1('SelfSign').encryption_certs starts (NEED_TO_REFRESH)
Mar 25 08:49:13 server.interlinx.bc.ca certmonger[2331]: 2018-03-25 08:49:13 [2331]
CA2('IPA').identify starts (NEED_TO_REFRESH)
[snip]
Sure looks like the problem is in the selfsign CA. Can you start
certmonger from the command-line in debug mode to see if there is any
indication why?
# certmonger -d 9 -n
rob