Jochen Kellner via FreeIPA-users wrote:
Jochen Kellner via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org>
writes:
> And that's due to an error I made when trying to fix KRA. This is an
> excerpt from "getcert list":
>
> Request ID '20210210143948':
> status: MONITORING
> ca-error: Server at
"http://freeipa1.example.org:8080/ca/ee/ca/profileSubmit" replied: Policy Set
Not Found
...
> That's from the ca error log:
>
> 2021-11-14 15:09:58 [http-nio-8080-exec-15] INFO: EnrollProfile: Creating ernrollment
request 139960063
> 2021-11-14 15:09:58 [http-nio-8080-exec-15] SEVERE: CertProcessor: no profile policy
set found
> 2021-11-14 15:09:58 [http-nio-8080-exec-15] SEVERE: ProfileSubmitServlet: error in
processing request: Policy Set Not Found
> Policy Set Not Found
After some more debugging and thinking and tinkering:
The CA Profile caStorageCert was broken in LDAP. I remove the entry, ran
ipa-server-upgrade which reloaded the profile from disk and finally the
certificate has been refreshed.
Now ipa-healthcheck is without errors on my CA renewal master. So I'm
now working on the replicas.
I guess I'm glad you have things working again but its confusing how you
got it from working, to not working, to working again.
rob