IPA proxies requests to the CA through tomcat. Not Found means that the
CA webapp wasn't running in tomcat. You can try restarting pki-tomcatd
and seeing what errors are reported in the logs.
rob
Thanks.
With kind regards.
Jan Gardian
On 04/26/2018 10:57 AM, Jan Gardian via FreeIPA-users wrote:
> Hello,
>
> Permission of cert files at ipa2 and ipa3 are ok. I was installing
> replica under admin user. Master CA should be setup but it still crash
> with CA not found. I was still able to create ipa2 and ipa3 replica
> with old ipa1(ubuntu 16) server without problem.
> Bellow are also error_logs from httpd and certmonger. Any idea what
> else I can check? Our ipa CA is signed by our own CA, could this cause
> some problems?
>
> [root@ipa4 ~]# klist -kt /etc/krb5.keytab
> Keytab name: FILE:/etc/krb5.keytab
> KVNO Timestamp Principal
> ---- -------------------
> ------------------------------------------------------
> 1 04/26/2018 10:21:04 host/ipa4.example.com(a)EXAMPLE.COM
> 1 04/26/2018 10:21:04 host/ipa4.example.com(a)EXAMPLE.COM
> 1 04/26/2018 10:21:04 host/ipa4.example.com(a)EXAMPLE.COM
> 1 04/26/2018 10:21:04 host/ipa4.example.com(a)EXAMPLE.COM
> 1 04/26/2018 10:21:04 host/ipa4.example.com(a)EXAMPLE.COM
> 1 04/26/2018 10:21:04 host/ipa4.example.com(a)EXAMPLE.COM
> [root@ipa4 ~]# kvno host/`hostname`
> host/ipa4.example.com(a)EXAMPLE.COM: kvno = 1
>
> ipa-replica-install --setup-ca fails at the same point:
> Configuring directory server (dirsrv)
> [1/3]: configuring TLS for DS instance
> [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
> Your system may be partly configured.
> Run /usr/sbin/ipa-server-install --uninstall to clean up.
>
> ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):
> ERROR Certificate issuance failed (CA_UNREACHABLE)
> ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall):
> ERROR The ipa-replica-install command failed. See
> /var/log/ipareplica-install.log for more information
>
> Master CA setup to be ipa2:
> [root@ipa2 ~]# grep ca.crl.MasterCRL.enableCRLUpdates
> /etc/pki/pki-tomcat/ca/CS.cfg
> ca.crl.MasterCRL.enableCRLUpdates=true
>
> [root@ipa3 ~]# grep ca.crl.MasterCRL.enableCRLUpdates
> /etc/pki/pki-tomcat/ca/CS.cfg
> ca.crl.MasterCRL.enableCRLUpdates=false
>
> ipa4 certmonger logs:
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: 2018-04-26 10:27:38
> [1713] Certificate submission still ongoing.
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: 2018-04-26 10:27:38
> [1713] Will revisit Request1('20180426082737') on traffic from 15.
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: 2018-04-26 10:27:38
> [1713] Certificate submission attempt complete.
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: 2018-04-26 10:27:38
> [1713] Child status = 3.
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: 2018-04-26 10:27:38
> [1713] Child output:
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: "Server at
>
https://ipa4.example.com/ipa/xml failed request, will retry: -504
> (libcurl failed to execute the HTTP POST transaction, explaining:
> Failed connect to ipa4.example.com:443; Connection ref
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: Server at
>
https://ipa3.example.com/ipa/xml failed request, will retry: 4001 (RPC
> failed at server. ipa: Certificate Authority not found).
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: Server at
>
https://ipa2.example.com/ipa/xml failed request, will retry: 4001 (RPC
> failed at server. ipa: Certificate Authority not found).
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: "
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: 2018-04-26 10:27:38
> [1713] Certificate not (yet?) issued.
> Apr 26 10:27:38
ipa4.example.com certmonger[1713]: 2018-04-26 10:27:38
> [1713] Request1('20180426082737') moved to state 'CA_UNREACHABLE'
>
> ipa3 httpd/error_log:
> [Thu Apr 26 10:27:38.375982 2018] [auth_gssapi:error] [pid 1724]
> [client 1.1.1.4:35234] NO AUTH DATA Client did not send any
> authentication headers, referer:
https://ipa3.example.com/ipa/xml
> [Thu Apr 26 10:27:38.422274 2018] [:error] [pid 1720] ipa: INFO:
> [xmlserver] host/ipa4.example.com(a)EXAMPLE.COM:
> cert_request(u'XYZ...==', profile_id=u'caIPAserviceCert',
> principal=u'ldap/ipa4.example.com(a)EXAMPLE.COM', add=True,
> version=u'2.51'): NotFound
>
> [root@ipa3 ~]# ipa ca-show ipa
> ipa: ERROR: ipa: Certificate Authority not found
>
>
>
> ipa2 httpd/error_log:
> [Thu Apr 26 10:27:14.476884 2018] [:error] [pid 7564] ipa: INFO:
> [jsonserver_kerb] admin(a)EXAMPLE.COM:
> server_conncheck(u'ipa2.example.com', u'ipa4.example.com',
> version=u'2.162'): SUCCESS
> [Thu Apr 26 10:27:38.443093 2018] [auth_gssapi:error] [pid 8336]
> [client 1.1.1.4:59674] NO AUTH DATA Client did not send any
> authentication headers, referer:
https://ipa2.example.com/ipa/xml
> [Thu Apr 26 10:27:38.503320 2018] [:error] [pid 7565] ipa: INFO:
> [xmlserver] host/ipa4.example.com(a)EXAMPLE.COM:
> cert_request(u'XYZ...==', profile_id=u'caIPAserviceCert',
> principal=u'ldap/ipa4.example.com(a)EXAMPLE.COM', add=True,
> version=u'2.51'): NotFound
>
> [root@ipa2 ~]# ipa ca-show ipa
> ipa: ERROR: ipa: Certificate Authority not found
>
>
> With kind regards,
> Jan Gardian
>
> On 04/24/2018 02:52 PM, Rob Crittenden wrote:
>> Jan Gardian via FreeIPA-users wrote:
>>> Hello,
>>>
>>> I setup more verbose output for certmonger and tested to install ipa
>>> replica at ipa4. What credentials does certmonger use? Installing
>>> replica is run with admin credentials.
>> certmonger uses the host principal in /etc/krb5.keytab
>>
>> I'd check on the remote servers /var/log/httpd/error_log to see if
>> anything was logged for the cert requests. Invalid credentials seems
>> like an odd error.
>>
>> You can also check on the validity of the keytab with:
>>
>> # klist -kt /etc/krb5.keytab
>> # kvno host/`hostname`
>>
>> The kvno should match.
>>
>> IIRC you are promoting a client to a replica which means there shouldn't
>> be any issues with replication of the host principal.
>>
>> rob
>>
>>> Servers ipa2 and ipa3 are up.
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: 2018-04-24 13:24:19
>>> [1755] Certificate submission still ongoing.
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: 2018-04-24 13:24:19
>>> [1755] Will revisit Request1('20180424112419') on traffic from 15.
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: 2018-04-24 13:24:19
>>> [1755] Certificate submission attempt complete.
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: 2018-04-24 13:24:19
>>> [1755] Child status = 2.
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: 2018-04-24 13:24:19
>>> [1755] Child output:
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: "Server at
>>>
https://ipa4.example.com/ipa/xml failed request, will retry: -504
>>> (libcurl failed to execute the HTTP POST transaction, explaining:
>>> Failed
>>> connect to ipa4.example.com:443; Connection refused).
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: Server at
>>>
https://ipa3.example.com/ipa/xml denied our request, giving up: 2100
>>> (RPC failed at server. Insufficient access: Invalid credentials).
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: "
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: 2018-04-24 13:24:19
>>> [1755] Certificate not (yet?) issued.
>>> Apr 24 13:24:19
ipa4.example.com certmonger[1755]: 2018-04-24 13:24:19
>>> [1755] Request1('20180424112419') moved to state
>>> 'NEED_TO_NOTIFY_REJECTION'
>>>
>>>
>>> Only ipa2 is up
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: 2018-04-24 13:52:46
>>> [1715] Certificate submission still ongoing.
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: 2018-04-24 13:52:46
>>> [1715] Will revisit Request1('20180424115242') on traffic from 15.
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: 2018-04-24 13:52:46
>>> [1715] Certificate submission attempt complete.
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: 2018-04-24 13:52:46
>>> [1715] Child status = 3.
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: 2018-04-24 13:52:46
>>> [1715] Child output:
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: "Server at
>>>
https://ipa4.example.com/ipa/xml failed request, will retry: -504
>>> (libcurl failed to execute the HTTP POST transaction, explaining:
>>> Failed
>>> connect to ipa4.example.com:443; Connection refused).
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: Server at
>>>
https://ipa3.example.com/ipa/xml failed request, will retry: -504
>>> (libcurl failed to execute the HTTP POST transaction, explaining:
>>> Failed
>>> connect to ipa3.example.com:443; No route to host).
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: Server at
>>>
https://ipa2.example.com/ipa/xml failed request, will retry: 4001 (RPC
>>> failed at server. ipa: Certificate Authority not found).
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: "
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: 2018-04-24 13:52:46
>>> [1715] Certificate not (yet?) issued.
>>> Apr 24 13:52:46
ipa4.example.com certmonger[1715]: 2018-04-24 13:52:46
>>> [1715] Request1('20180424115242') moved to state
'CA_UNREACHABLE'
>>>
>>>
>>> With kind regards,
>>> Jan Gardian
>>>
>>> On 04/24/2018 12:24 PM, Jan Gardian via FreeIPA-users wrote:
>>>> Hello,
>>>>
>>>> I checked and we already have correct permission for mentioned cert
>>>> files:
>>>>
>>>> [root@ipa2 ~]# ls -la /etc/ipa/ca.crt
>>>> -rw-r--r--. 1 root root 5201 Apr 18 09:43 /etc/ipa/ca.crt
>>>> [root@ipa2 ~]# ls -la /var/lib/ipa/ra-agent.*
>>>> -r--r-----. 1 root ipaapi 1854 Apr 18 09:50 /var/lib/ipa/ra-agent.key
>>>> -r--r-----. 1 root ipaapi 1423 Apr 18 09:50 /var/lib/ipa/ra-agent.pem
>>>>
>>>> And when doing replica install at ipa4 it still tries to get
>>>> certificate from itself and not from master ipa2:
>>>> [root@ipa4 ~]# getcert list
>>>> Number of certificates and requests being tracked: 1.
>>>> Request ID '20180424101635':
>>>> status: CA_REJECTED
>>>> ca-error: Server at
https://ipa4.example.com/ipa/xml failed
>>>> request, will retry: -504 (libcurl failed to execute the HTTP POST
>>>> transaction, explaining: Failed connect to ipa4.example.com:443;
>>>> Connection refused).
>>>> stuck: yes
>>>> key pair storage:
>>>>
type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert',token='NSS
>>>>
>>>> Certificate
DB',pinfile='/etc/dirsrv/slapd-EXAMPLE-COM/pwdfile.txt'
>>>> certificate:
>>>>
type=NSSDB,location='/etc/dirsrv/slapd-EXAMPLE-COM',nickname='Server-Cert'
>>>>
>>>>
>>>> CA: IPA
>>>> issuer:
>>>> subject:
>>>> expires: unknown
>>>> pre-save command:
>>>> post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv
>>>> EXAMPLE-COM
>>>> track: yes
>>>> auto-renew: yes
>>>>
>>>>
>>>>
>>>> With kind regards,
>>>> Jan Gardian
>>>>
>>>>
>>>> On 04/24/2018 10:41 AM, Florence Blanc-Renaud wrote:
>>>>> On 04/19/2018 06:34 PM, r hartikainen via FreeIPA-users wrote:
>>>>>> Hello
>>>>>>
>>>>>> I got this same error with replica installation on rhel 7.4
after
>>>>>> the OS was hardened with openscap. Pure base OS install without
any
>>>>>> additional hardening did work without problems. I was doing
replica
>>>>>> immediately after setting up the new primary.
>>>>>>
>>>>>> Also, with same scap policy the fresh primary ipa did not allow
any
>>>>>> login at webui. In my case I believe it was about some security
>>>>>> setting but have not yet had time to debug which one. Dunno where
to
>>>>>> start the debug though.
>>>>>>
>>>>>> br,
>>>>>> risto
>>>>>>
>>>>>> Sent from my iPad
>>>>>>
>>>>>> On 19 Apr 2018, at 18.24, Jan Gardian via FreeIPA-users
>>>>>> <freeipa-users(a)lists.fedorahosted.org
>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>>>>>>
>>>>>>> Hello,
>>>>>>>
>>>>>>> We had two ipa replicas ipa1 with CA and ipa2. Those servers
were
>>>>>>> on Ubuntu 16.
>>>>>>>
>>>>>>> I successfully installed ipa3 replica with CA that is running
on
>>>>>>> newer version of IPA and Centos 7. After that I stopped old
ipa2
>>>>>>> and successfully installed new ipa2 with CA on Centos 7.
Lastly I
>>>>>>> setup CA master to be new ipa2 following
>>>>>>>
https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master#P...
>>>>>>>
>>>>>>> and turned off old ipa1 server.
>>>>>>>
>>>>>>> Problem occurred when I was installing replica with CA to new
ipa1
>>>>>>> server running at Centos 7.
>>>>>>> I can successfully install ipa client and create ticket under
admin
>>>>>>> user but when trying to install replica it fails with
"ERROR
>>>>>>> Certificate issuance failed (CA_UNREACHABLE)". Somehow
it tries to
>>>>>>> get certificates during replica install from ipa1 server when
it
>>>>>>> does not have yet httpd installed.
>>>>>>>
>>>>>>> I thought it could be problem that certificate was primary
created
>>>>>>> at old ipa1 and we have it signed by our own certificates as
well
>>>>>>> so I created another ipa4 server on Centos 7. And again it
crashed
>>>>>>> at the same point trying to get certificate from itself when
it did
>>>>>>> not have httpd installed yet.
>>>>>>>
>>>>>>> OS: CentOS Linux release 7.4.1708
>>>>>>> IPA: VERSION: 4.5.0, API_VERSION: 2.228
>>>>>>>
>>>>>>> Attached are logs from ipa client installation and ipa
replica
>>>>>>> installation for ipa4 server.
>>>>>>> Please ask if you require any different logs. I tried also
to
>>>>>>> follow debugging from
>>>>>>>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>>>>
>>>>>>> but in my case it end earlier because it try to get
certificate
>>>>>>> from itself and does not get to master. This can be also seen
in
>>>>>>> output of command getcert list(in attachement).
>>>>>>>
>>>>>>>
>>>>>>> Thank you for checking.
>>>>>>>
>>>>>>>
>>>>>>> With kind regards,
>>>>>>> *Ján Gardian*
>>>>>>> Administrator
>>>>>>> <ipa4_debug>
>>>>>>> _______________________________________________
>>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>> To unsubscribe send an email to
>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org
>>>>>> To unsubscribe send an email to
>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>
>>>>> Hi,
>>>>>
>>>>> the issue is probably linked to the root's umask setting on the
>>>>> master. When umask is too restrictive, the httpd server is not able
>>>>> to read the CA file and establish a secure connection with Dogtag.
>>>>> This is a known issue [1], the workaround is to modify the cert file
>>>>> permissions:
>>>>> chmod 644 /etc/ipa/ca.crt
>>>>> chmod 440 /var/lib/ipa/ra-agent.{key|pem}
>>>>>
>>>>> HTH,
>>>>> Flo
>>>>>
>>>>> [1]
https://pagure.io/freeipa/issue/7193
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email to
>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to
>>> freeipa-users-leave(a)lists.fedorahosted.org
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org