On Mon, May 3, 2021 at 1:30 PM lejeczek via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
On 03/05/2021 08:50, Florence Renaud wrote:
> Hi,
> the issue looks similar to
>
https://pagure.io/freeipa/issue/8614
> <
https://pagure.io/freeipa/issue/8614>.
> Did you try installation on a node which was previously
> installed? There may be a remaining cert in
> /etc/ipa/ca.crt or in the system-wide trust store (for
> instance check in
> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem). If the
> previous installation had the same domain name, the CA
> cert subject is the same and the installer tries to import
> a CA cert similar to the previous one but generated with a
> different key.
>
> If that's the case you need to uninstall ipa with
> ipa-server-install --uninstall -U, then delete
> /etc/ipa/ca.crt and run update-ca-trust + ensure the CA
> has been removed from /etc/pki/ca-trust.
> flo
Yes, there was IPA deployed before on the box but also was
IPA uninstalled and uninstaller claimed it was successful.
Should that not be enough, uninstaller succeeding?
Yes, a successful uninstallation should have cleaned up the trust store,
but bugs happen...
flo
There was, certainly not consciously, no IPA's cert put into
system-wide store.
Cannot troubleshoot unfortunately as a clean-slate kvm vm
rollback was the quick "fix" I did.
>
> On Sat, May 1, 2021 at 7:51 PM lejeczek via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>
> Hi guys.
>
> That is quite bizarre, don't you think? It's a first
> master
> installation.
>
> Configuring directory server (dirsrv)
> [1/3]: configuring TLS for DS instance
> [error] CalledProcessError: CalledProcessError(Command
> ['/usr/bin/certutil', '-d',
> 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n',
> 'PRIV.COM <
http://PRIV.COM> IPA
> CA', '-t', 'CT,C,C', '-a', '-f',
> '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned
> non-zero
> exit status 255: 'certutil: could not decode certificate:
> SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to
> import a cert with the same issuer/serial as an existing
> cert, but that is not the same cert.\n')
> CalledProcessError(Command ['/usr/bin/certutil', '-d',
> 'sql:/etc/dirsrv/slapd-PRIV-COM/', '-A', '-n',
> 'PRIV.COM <
http://PRIV.COM> IPA
> CA', '-t', 'CT,C,C', '-a', '-f',
> '/etc/dirsrv/slapd-PRIV-COM/pwdfile.txt'] returned
> non-zero
> exit status 255: 'certutil: could not decode certificate:
> SEC_ERROR_REUSED_ISSUER_AND_SERIAL: You are attempting to
> import a cert with the same issuer/serial as an existing
> cert, but that is not the same cert.\n')
> The ipa-server-install command failed. See
> /var/log/ipaserver-install.log for more information
>
> It's a new install, certainly there is no
> '/etc/dirsrv/slapd-PRIV-COM' prior to install.
> regards, L.
> _______________________________________________
> FreeIPA-users mailing list --
> freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> <mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> <
https://docs.fedoraproject.org/en-US/project/code-of-conduct/>
> List Guidelines:
>
https://fedoraproject.org/wiki/Mailing_list_guidelines
> <
https://fedoraproject.org/wiki/Mailing_list_guidelines>
> List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> <
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
> Do not reply to spam on the list, report it:
>
https://pagure.io/fedora-infrastructure
> <
https://pagure.io/fedora-infrastructure>
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure