Is it true that these "Errors" appear on an IPA server without CA role present and can be ignored?
CRITICAL: pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
As well as these for a disabled trust domain?
ERROR: ipahealthcheck.ipa.trust.IPATrustDomainsCheck.domain-list: /usr/sbin/sssctl domain-list reports mismatch: sssd domains mydomain.at, buero.mydomain.at, org.mydomain.at trust domains buero.mydomain.at, mydomain.at, org.mydomain.at, tk.mydomain.at ERROR: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.domain-status: Execution of domain-status failed: CalledProcessError(Command ['/usr/sbin/sssctl', 'domain-status', 'tk.mydomain.at', '--active-server'] returned non-zero exit status 1: 'Unable to get online status\n')
Cheers, Ronald
Ronald Wimmer via FreeIPA-users wrote:
Is it true that these "Errors" appear on an IPA server without CA role present and can be ignored?
CRITICAL: pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck
CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
There was an issue that pki.server checks though throw errors even if the CA was unconfigured. I had to filter these out of healthcheck.
But the IPACRLManagerCheck should only run if a CA is configured so I'd double check your roles. It seems to believe one is configured on this host.
As well as these for a disabled trust domain?
ERROR: ipahealthcheck.ipa.trust.IPATrustDomainsCheck.domain-list: /usr/sbin/sssctl domain-list reports mismatch: sssd domains mydomain.at, buero.mydomain.at, org.mydomain.at trust domains buero.mydomain.at, mydomain.at, org.mydomain.at, tk.mydomain.at ERROR: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.domain-status: Execution of domain-status failed: CalledProcessError(Command ['/usr/sbin/sssctl', 'domain-status', 'tk.mydomain.at', '--active-server'] returned non-zero exit status 1: 'Unable to get online status\n')
Disabled how? healthcheck is running through the list of trust domains that sssd is returning. So should sssd not be aware of this domain at all?
rob
Cheers, Ronald _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
On 05.01.22 14:48, Rob Crittenden wrote:
Ronald Wimmer via FreeIPA-users wrote:
Is it true that these "Errors" appear on an IPA server without CA role present and can be ignored?
CRITICAL: pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck
CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
There was an issue that pki.server checks though throw errors even if the CA was unconfigured. I had to filter these out of healthcheck.
But the IPACRLManagerCheck should only run if a CA is configured so I'd double check your roles. It seems to believe one is configured on this host
The CA role is definitely not enabled on these machines. (but maybe something went wrong some time ago when we migrated from CentOS 7 to OL 8.) Where should I have a closer look for leftovers?
As well as these for a disabled trust domain?
ERROR: ipahealthcheck.ipa.trust.IPATrustDomainsCheck.domain-list: /usr/sbin/sssctl domain-list reports mismatch: sssd domains mydomain.at, buero.mydomain.at, org.mydomain.at trust domains buero.mydomain.at, mydomain.at, org.mydomain.at, tk.mydomain.at ERROR: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.domain-status: Execution of domain-status failed: CalledProcessError(Command ['/usr/sbin/sssctl', 'domain-status', 'tk.mydomain.at', '--active-server'] returned non-zero exit status 1: 'Unable to get online status\n')
Disabled how? healthcheck is running through the list of trust domains that sssd is returning. So should sssd not be aware of this domain at all?
ipa trustdomain-disable
We've disabled the tk.mydomain.at domain because we do not need it.
Cheers, Ronald
Ronald Wimmer wrote:
On 05.01.22 14:48, Rob Crittenden wrote:
Ronald Wimmer via FreeIPA-users wrote:
Is it true that these "Errors" appear on an IPA server without CA role present and can be ignored?
CRITICAL: pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck
CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
There was an issue that pki.server checks though throw errors even if the CA was unconfigured. I had to filter these out of healthcheck.
But the IPACRLManagerCheck should only run if a CA is configured so I'd double check your roles. It seems to believe one is configured on this host
The CA role is definitely not enabled on these machines. (but maybe something went wrong some time ago when we migrated from CentOS 7 to OL 8.) Where should I have a closer look for leftovers?
For the CA take a look at /var/lib/ipa/sysrestore/sysrestore.state to see if installed = True in the pki-tomcatd section. That indicates that the CA was configured.
I'll have to check with the SSSD team to see if they use the blacklist that IPA uses for disabled domains. If not I'll have to filter them directly in healthcheck. It's very possible this is a bug in healthcehck.
rob
As well as these for a disabled trust domain?
ERROR: ipahealthcheck.ipa.trust.IPATrustDomainsCheck.domain-list: /usr/sbin/sssctl domain-list reports mismatch: sssd domains mydomain.at, buero.mydomain.at, org.mydomain.at trust domains buero.mydomain.at, mydomain.at, org.mydomain.at, tk.mydomain.at ERROR: ipahealthcheck.ipa.trust.IPATrustCatalogCheck.domain-status: Execution of domain-status failed: CalledProcessError(Command ['/usr/sbin/sssctl', 'domain-status', 'tk.mydomain.at', '--active-server'] returned non-zero exit status 1: 'Unable to get online status\n')
Disabled how? healthcheck is running through the list of trust domains that sssd is returning. So should sssd not be aware of this domain at all?
ipa trustdomain-disable
We've disabled the tk.mydomain.at domain because we do not need it.
Cheers, Ronald
On 05.01.22 20:16, Rob Crittenden via FreeIPA-users wrote:
Ronald Wimmer wrote:
On 05.01.22 14:48, Rob Crittenden wrote:
Ronald Wimmer via FreeIPA-users wrote:
Is it true that these "Errors" appear on an IPA server without CA role present and can be ignored?
CRITICAL: pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck
CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
There was an issue that pki.server checks though throw errors even if the CA was unconfigured. I had to filter these out of healthcheck.
But the IPACRLManagerCheck should only run if a CA is configured so I'd double check your roles. It seems to believe one is configured on this host
The CA role is definitely not enabled on these machines. (but maybe something went wrong some time ago when we migrated from CentOS 7 to OL 8.) Where should I have a closer look for leftovers?
For the CA take a look at /var/lib/ipa/sysrestore/sysrestore.state to see if installed = True in the pki-tomcatd section. That indicates that the CA was configured.
On these servers (without CA role) there is not even a pki-tomcatd section.
Cheers, Ronald
Ronald Wimmer wrote:
On 05.01.22 20:16, Rob Crittenden via FreeIPA-users wrote:
Ronald Wimmer wrote:
On 05.01.22 14:48, Rob Crittenden wrote:
Ronald Wimmer via FreeIPA-users wrote:
Is it true that these "Errors" appear on an IPA server without CA role present and can be ignored?
CRITICAL: pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck
CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck:
Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
There was an issue that pki.server checks though throw errors even if the CA was unconfigured. I had to filter these out of healthcheck.
But the IPACRLManagerCheck should only run if a CA is configured so I'd double check your roles. It seems to believe one is configured on this host
The CA role is definitely not enabled on these machines. (but maybe something went wrong some time ago when we migrated from CentOS 7 to OL 8.) Where should I have a closer look for leftovers?
For the CA take a look at /var/lib/ipa/sysrestore/sysrestore.state to see if installed = True in the pki-tomcatd section. That indicates that the CA was configured.
On these servers (without CA role) there is not even a pki-tomcatd section.
This is fixed upstream but isn't in RHEL 8 yet. It should be fixed as part of https://bugzilla.redhat.com/show_bug.cgi?id=1983060
rob
On 07.01.22 14:30, Rob Crittenden via FreeIPA-users wrote:
Ronald Wimmer wrote:
On 05.01.22 20:16, Rob Crittenden via FreeIPA-users wrote:
Ronald Wimmer wrote:
On 05.01.22 14:48, Rob Crittenden wrote:
Ronald Wimmer via FreeIPA-users wrote:
Is it true that these "Errors" appear on an IPA server without CA role present and can be ignored?
CRITICAL: pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck
CRITICAL: pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck:
Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: Invalid PKI instance: pki-tomcat CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to read /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
There was an issue that pki.server checks though throw errors even if the CA was unconfigured. I had to filter these out of healthcheck.
But the IPACRLManagerCheck should only run if a CA is configured so I'd double check your roles. It seems to believe one is configured on this host
The CA role is definitely not enabled on these machines. (but maybe something went wrong some time ago when we migrated from CentOS 7 to OL 8.) Where should I have a closer look for leftovers?
For the CA take a look at /var/lib/ipa/sysrestore/sysrestore.state to see if installed = True in the pki-tomcatd section. That indicates that the CA was configured.
On these servers (without CA role) there is not even a pki-tomcatd section.
This is fixed upstream but isn't in RHEL 8 yet. It should be fixed as part of https://bugzilla.redhat.com/show_bug.cgi?id=1983060
I am not allowed to view the bug's content. What would be a good workaround? Create a pki-tomcatd section in sysrestore.state with installed = False?
Cheers, Ronaldg
Ronald Wimmer via FreeIPA-users wrote:
On 07.01.22 14:30, Rob Crittenden via FreeIPA-users wrote:
Ronald Wimmer wrote:
On 05.01.22 20:16, Rob Crittenden via FreeIPA-users wrote:
Ronald Wimmer wrote:
On 05.01.22 14:48, Rob Crittenden wrote:
Ronald Wimmer via FreeIPA-users wrote: > Is it true that these "Errors" appear on an IPA server without CA > role > present and can be ignored? > > CRITICAL: > pki.server.healthcheck.certs.expiration.CASystemCertExpiryCheck: > Invalid > PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.expiration.KRASystemCertExpiryCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.expiration.OCSPSystemCertExpiryCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.expiration.TKSSystemCertExpiryCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.expiration.TPSSystemCertExpiryCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.trustflags.CASystemCertTrustFlagCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.trustflags.KRASystemCertTrustFlagCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.trustflags.OCSPSystemCertTrustFlagCheck: > > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.trustflags.TKSSystemCertTrustFlagCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.certs.trustflags.TPSSystemCertTrustFlagCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck > > > > > CRITICAL: > pki.server.healthcheck.meta.csconfig.CADogtagCertsConfigCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.csconfig.KRADogtagCertsConfigCheck: > Invalid > PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.csconfig.OCSPDogtagCertsConfigCheck: > Invalid > PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.csconfig.TKSDogtagCertsConfigCheck: > Invalid > PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.csconfig.TPSDogtagCertsConfigCheck: > Invalid > PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.connectivity.DogtagCACertsConnectivityCheck: > > > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.connectivity.DogtagKRAConnectivityCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.connectivity.DogtagOCSPConnectivityCheck: > > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.connectivity.DogtagTKSConnectivityCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: > pki.server.healthcheck.meta.connectivity.DogtagTPSConnectivityCheck: > Invalid PKI instance: pki-tomcat > CRITICAL: ipahealthcheck.ipa.roles.IPACRLManagerCheck: Unable to > read > /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
There was an issue that pki.server checks though throw errors even if the CA was unconfigured. I had to filter these out of healthcheck.
But the IPACRLManagerCheck should only run if a CA is configured so I'd double check your roles. It seems to believe one is configured on this host
The CA role is definitely not enabled on these machines. (but maybe something went wrong some time ago when we migrated from CentOS 7 to OL 8.) Where should I have a closer look for leftovers?
For the CA take a look at /var/lib/ipa/sysrestore/sysrestore.state to see if installed = True in the pki-tomcatd section. That indicates that the CA was configured.
On these servers (without CA role) there is not even a pki-tomcatd section.
This is fixed upstream but isn't in RHEL 8 yet. It should be fixed as part of https://bugzilla.redhat.com/show_bug.cgi?id=1983060
I am not allowed to view the bug's content. What would be a good workaround? Create a pki-tomcatd section in sysrestore.state with installed = False?
There is no workaround. The code you have does no pre-check on whether a CA is installed or not.
rob
freeipa-users@lists.fedorahosted.org