Hi all,
we try to set up IPA replication between a Master (Version 4.4.0 on CentOS 7.3) and a new
IPA (Version 4.5.1 on CentOS 7.5) on different hosts.
We followed the official documentation by first installing the ipa dependencies, then ipa
server, added the new host by running "ipa-client-install --server=<new-host>
--domain=<existing-domain>". Lastly, we simply ran
"ipa-replica-install" and the process gets stuck on "installing X509
Certificate for PKINIT" and resumes after some minutes:
> Full PKINIT configuration did not succeed
> The setup will only install bits essential to the server functionality
> You can enable PKINIT after the setup completed using 'ipa-pkinit-manage'
> Done configuring Kerberos KDC (krb5kdc).
Even so, logging into the new IPA all users, groups, services are available. Running
"ipa-pkinit-manage enable" doesn't help the following problem.
---
Problem:
The new IPA instance is reporting issues then running "ipa cert_find":
Certificate operation cannot be completed: Unable to communicate with CMS (Comment not
terminated, line 2, column 1)
The same error can be observed by navigating to the IPA Web UI -> Authentication - >
Certificates: Certificate operation cannot be completed: Unable to communicate with CMS
(Comment not terminated, line 2, column 1)
The /var/log/httpd/error_log report the same issue (on the new IPA only):
[:error] [pid 15679] ipa: ERROR: ra.find(): Unable to communicate with CMS (Comment not
terminated, line 2, column 1)
Running "getcert list" shows no expired certificates...
---
We ran into the same issues when we tried to upgrade the host OS from CentOS 7.3 to 7.5
(which executes the IPA Upgrade script). With that issue we were not able to remove
services from the IPA at all (only adding services, adding/removing users and groups). We
then chose to roll back the VM. But now we need to upgrade the OS version.
---
How can we go from here? We could not find any similar issue ("Comment not
terminated, line 2, column 1") at all.
Kind regards
Adrian