Hi,
I'm having issues with adding CA role to some of replicas in the cluster. Error which
I receive is>
2019-02-20T02:18:26Z DEBUG The ipa-ca-install command failed, exception: HTTPError: 406
Client Error: Failed to validate message: Verification failed for all
signatures["Failed: [InvalidJWSSignature('Verification failed
{InvalidSignature()}',)]"]
This one happens just after the connection check to the master.
Part of ipareplica-ca-install.log>
Connection from master to replica is OK.
2019-02-20T02:18:24Z INFO Custodia client for '<CustodiaModes.CA_PEER:
'Custodia CA peer'>' with promotion yes.
2019-02-20T02:18:24Z INFO Custodia uses master.example.com' as master peer.
2019-02-20T02:18:24Z DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2019-02-20T02:18:24Z DEBUG Loading Index file from
'/var/lib/ipa/sysrestore/sysrestore.index'
2019-02-20T02:18:24Z INFO Waiting up to 300 seconds to see our keys appear on host
ldap://master.example.com
2019-02-20T02:18:25Z DEBUG Starting external process
2019-02-20T02:18:25Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpIvaee8 -N -f
/tmp/tmpIvaee8/pwdfile.txt -f /tmp/tmpIvaee8/pwdfile.txt
2019-02-20T02:18:25Z DEBUG Process finished, return code=0
2019-02-20T02:18:25Z DEBUG stdout=
2019-02-20T02:18:25Z DEBUG stderr=
2019-02-20T02:18:25Z INFO Starting new HTTPS connection (1):
master.example.com
2019-02-20T02:18:26Z DEBUG "GET
/ipa/keys/ca/caSigningCert%20cert-pki-ca?type=kem&value=ey...ls HTTP/1.1" 406
None
2019-02-20T02:18:26Z DEBUG File
"/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 1008,
in run_script
return_value = main_function()
File "/sbin/ipa-ca-install", line 338, in main
promote(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 306, in promote
install_replica(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 231, in install_replica
ca.install(True, config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 223, in
install
install_step_0(standalone, replica_config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 262, in
install_step_0
replica_config.dirman_password)
File "/usr/lib/python2.7/site-packages/ipaserver/install/custodiainstance.py",
line 316, in get_ca_keys
self._get_keys(cacerts_file, cacerts_pwd, data)
File "/usr/lib/python2.7/site-packages/ipaserver/install/custodiainstance.py",
line 280, in _get_keys
value = cli.fetch_key(os.path.join(prefix, nickname), False)
File "/usr/lib/python2.7/site-packages/ipaserver/secrets/client.py", line 105,
in fetch_key
r.raise_for_status()
File "/usr/lib/python2.7/site-packages/requests/models.py", line 834, in
raise_for_status
raise HTTPError(http_error_msg, response=self)
2019-02-20T02:18:26Z DEBUG The ipa-ca-install command failed, exception: HTTPError: 406
Client Error: Failed to validate message: Verification failed for all
signatures["Failed: [InvalidJWSSignature('Verification failed
{InvalidSignature()}',)]"]
(END)
FreeIPA version is ipa-server-4.6.4-10.el7.centos.2.x86_64, running on CentOS 7.6.1810.
I'm not sure how to proceed with debugging this issue.
What's odd, we have >10 replicas in our cluster, across the globe, and this fails
on around half of them. Half went fine, without any issues.
Any help would be highly appreciated!
FYI, the way how the cluster was made>
Master was built, then on each replica machines first ipa-client-install was ran, then
ipa-replica-install, and after some time ipa-ca-install was ran. At first, CA role was
only on master node, it wasn't replicated to other nodes, which I'm trying to fix
now.
Best regards,
Tomislav Dukaric