Thanks for the reply. I tried the workaround but still getting the CA_UNREACHABLE error.
The umask on the master was already at 0022.
Is there a way to check the health of the CA master? Maybe the issue is with the CA and
not with the replica install?
Here is a little more information. The CA master is pci-mgmt-ipa01. the new client to be
promoted is ipa-nyc-pci02.
On the client:
[root@ipa-nyc-pci02 ~]# getcert list
Number of certificates and requests being tracked: 1.
Request ID '20180424223129':
status: CA_UNREACHABLE
ca-error: Server at
https://ipa-nyc-pci02.pci.xxxxxxx.com/ipa/xml failed request,
will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Failed
connect to ipa-nyc-pci02.pci.xxxxxxx.com:443; Connection refused).
stuck: no
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-PCI-xxxxxxx-COM',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-PCI-xxxxxxx-COM/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-PCI-xxxxxxx-COM',nickname='Server-Cert'
CA: IPA
issuer:
subject:
expires: unknown
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv PCI-xxxxxxx-COM
track: yes
auto-renew: yes
On the master:
pki-tomcat is running.
I see a cert_request in /var/log/httpd/error_log.
[Tue Apr 24 22:31:31.490598 2018] [:error] [pid 1133] ipa: INFO: [xmlserver]
host/ipa-nyc-pci02.pci.XXXXXXX.com(a)PCI.XXXXXXX.COM:
cert_request(u'MIID8jCCAtoCAQAwQjEYMBYGA1UEChMPUENJLk1BU0NPUlAuQ09NMSYwJAYDVQQDEx1pc
...
/QLxsLD7VWO7fGuSHpGnUayuTKi1Em9BdPtMNoD75G4SJ',
profile_id=u'caIPAserviceCert',
principal=u'ldap/ipa-nyc-pci02.pci.XXXXXXX.com(a)PCI.XXXXXXX.COM', add=True,
version=u'2.51'): NotFound
I don't see any request in /var/log/pki/pki-tomcat/ca/debug.
Does this indicate a problem with the Dogtag server?
Thanks,
Ross
_______________________________________
From: Ross Infinger
Sent: Tuesday, April 24, 2018 1:39 PM
To: Florence Blanc-Renaud
Subject: RE: [Freeipa-users] replica - install fails with CA issue
Thanks for the reply. I tried the workaround but still getting the CA_UNREACHABLE error.
The umask on the master was already at 0022.
Is there a way to check the health of the CA master? Maybe the issue is with the CA and
not with the replica install?
Thanks,
Ross
From: Florence Blanc-Renaud [flo(a)redhat.com]
Sent: Tuesday, April 24, 2018 1:37 AM
To: FreeIPA users list
Cc: Ross Infinger
Subject: Re: [Freeipa-users] replica - install fails with CA issue
On 04/23/2018 10:37 PM, Ross Infinger via FreeIPA-users wrote:
I'm trying to promote a new client to a replica. I install the
client
first then run ipa-replica-install. The client install goes OK but the
ipa-replica-install command fails with
RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
Seems the client was able to reach the CA so I'm puzzled why the replica
cannot.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Hi,
other users also hit this issue #7193 [1], and the root cause was that
the root's umask on the master was too restrictive. Can you check if
it's your case?
The workaround is to do:
chmod 644 /etc/ipa/ca.crt
chmod 440 /var/lib/ipa/ra-agent.{key|pem}
but the best is to install the master with umask 022.
HTH,
Flo
[1]
https://urldefense.proofpoint.com/v2/url?u=https-3A__pagure.io_freeipa_is...