My misunderstanding, sorry. This is from the existing CA since that's where I thought
the problem would be. Okay, going back and looking at the debug log on the new server to
see if it's more revealing.
--
Bret Wortman
bret.wortman(a)damascusgrp.com
On Tue, Jun 8, 2021, at 2:27 PM, Rob Crittenden wrote:
> Bret Wortman via FreeIPA-users wrote:
> > I was tailing several logs in /var/log/pki/pki-tomcat/ca/ (debug, system, and
transactions) and though the replica installation failed again at the same point, this is
what I got from the logs throughout the installation process:
>
> This doesn't seem to show any errors. Reading the pki logs can be
> problematic as it often charges on after an error is encountered so
> subsequent errors are basically red herrings but I don't see anything
> wrong here at all, or I'm missing something.
>
> The IPA installer calls pki-spawn <bunch of options> so not much comes
> back to us. It's a black box. Can you provide the whole debug log,
> out-of-band is fine too. I'd also suggest looking at the debug log on
> the existing CA as it may be part of the communication as well.
>
> rob
>
> >
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
SecurityDomainResource.getDomainInfo()
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
mapping: default
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
required auth methods: [*]
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
anonymous access allowed
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor:
SecurityDomainResource.getDomainInfo()
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: No ACL
mapping.
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
SecurityDomainResource.getDomainInfo()
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
content-type: null
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
accept: [application/json]
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
response format: application/json
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: according to ccMode,
authorization for servlet: securitydomain is LDAP based, not XML {1}, use default authz
mgr: {2}.
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapBoundConnFactory:
init
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]:
LdapBoundConnFactory:doCloning true
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapAuthInfo: init()
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapAuthInfo: init
begins
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapAuthInfo: init ends
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: init: before
makeConnection errorIfDown is false
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: makeConnection:
errorIfDown false
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: LdapJssSSLSocket set
client auth cert nicknamesubsystemCert cert-pki-ca
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SSL handshake happened
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: Established LDAP
connection with SSL client auth to ipa1.our.net:636
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: initializing with mininum
3 and maximum 15 connections to host
ipa1.our.net port 636, secure connection, true,
authentication type 2
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: increasing minimum
connections by 3
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: new total available
connections 3
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: new number of connections
3
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected:
true
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is
connected true
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
name: IPA
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
subtype: CA
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- cn=ipa1.our.net:443,cn=CAList,ou=Security Domain,o=ipaca
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- objectClass: top
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- host:
ipa1.our.net
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- SecurePort: 443
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- SecureAgentPort: 443
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- SecureAdminPort: 443
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- SecureEEClientAuthPort: 443
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- UnSecurePort: 80
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- Clone: FALSE
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- SubsystemName: CA
ipa1.our.net 8443
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- cn: ipa1.our.net:443
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
- DomainManager: TRUE
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
subtype: OCSP
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
subtype: KRA
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
subtype: RA
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
subtype: TKS
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SecurityDomainProcessor:
subtype: TPS
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: Releasing ldap
connection
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now
3
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: Authentication:
UID=admin
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected:
true
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is
connected true
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]:
LdapAnonConnFactory::getConn
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]:
LdapAnonConnFactory.getConn(): num avail conns now 2
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now
3
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: SSL handshake happened
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now
2
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected:
true
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is
connected true
> > [08/Jun/2021:06:35:45][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now
3
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected:
true
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is
connected true
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now
3
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: In
LdapBoundConnFactory::getConn()
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: masterConn is connected:
true
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: getConn: conn is
connected true
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: getConn: mNumConns now 2
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: returnConn: mNumConns now
3
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
AccountResource.login()
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
mapping: account
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
required auth methods: [passwdUserDBAuthMgr, certUserDBAuthMgr]
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
authentication manager: passwdUserDBAuthMgr
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
access granted
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor:
AccountResource.login()
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: mapping:
account.login
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor:
principal: admin
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: ACL:
certServer.ca.account,login
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: checkACLS(): ACLEntry
expressions= user="anybody"
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: evaluating expressions:
user="anybody"
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: evaluated expression:
user="anybody" to be true
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: DirAclAuthz:
authorization passed
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: access
granted
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
AccountResource.login()
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
content-type: null
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
accept: [application/json]
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
response format: application/json
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
AccountResource.logout()
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
mapping: account
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
required auth methods: [passwdUserDBAuthMgr, certUserDBAuthMgr]
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
authentication manager: passwdUserDBAuthMgr
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: AuthMethodInterceptor:
access granted
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor:
AccountResource.logout()
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: mapping:
account.logout
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor:
principal: admin
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: ACL:
certServer.ca.account,logout
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: checkACLS(): ACLEntry
expressions= user="anybody"
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: evaluating expressions:
user="anybody"
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: evaluated expression:
user="anybody" to be true
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: DirAclAuthz:
authorization passed
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: ACLInterceptor: access
granted
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
AccountResource.logout()
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
content-type: null
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
accept: [application/json]
> > [08/Jun/2021:06:35:46][ajp-bio-127.0.0.1-8009-exec-2]: MessageFormatInterceptor:
response format: application/json
> >
> > It again failed at this point:
> >
> > Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
> > [1/30]: configuring certificate server instance
> > ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance:
Command '/usr/sbin/pkispawn -s CA -f /tmp/tmph2SUT4' returned non-zero exit status
1
> > ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the
following files/directories for more information:
> > ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat
> > [error] RuntimeError: CA configuration failed.
> > Your system may be partly configured.
> > Run /usr/sbin/ipa-server-install --uninstall to clean up.
> >
> > ipapython.admintool: ERROR CA configuration failed.
> > ipapython.admintool: ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
> >
> >
> > Is there another way to transfer or duplicate the CA? We are ultimately planning
to shut this box down due to its age, and currently it is the only CA, but it seems to be
trying to hang on to its job security... ;-)
> >
> >
>
>