I'm on my way home but I manage to find this in
/var/log/pki/pki-tomcat/ca/debug on the replica (hostnames have been changed
to protect the innocent, ipa03 is the master ipa01 is the replica), I'll
send the real logs directly to your email when I get a VPN up :
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: SystemConfigService: get
configuration entries from master
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange start
host=ipa03.example.org adminPort=443
eePort=443
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange content:
{xmlOutput=[true], sessionID=[21110386709
73117531], type=[request]}
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: ConfigurationUtils: POST
https://ipa03.example.org:443/ca/ad
min/ca/updateNumberRange
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: content from admin interface
=<HTML>
<BODY BGCOLOR=white>
<P>
The Certificate System has encountered an unrecoverable error.
<P>
Error Message:<BR>
<I>java.lang.NullPointerException</I>
<P>
Please contact your local administrator for assistance.
</BODY>
</HTML>
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange: Failed to
contact master using admin portorg.xml.sax.SAXParseException; lineNumber: 2;
columnNumber: 15; Open quote is expected for attribute "BGCOLOR" associated
with an element type "BODY".
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange: Attempting
to contact master using EE port
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: ConfigurationUtils: POST
https://ipa03.example.org:443/ca/ee/ca/updateNumberRange
javax.ws.rs.NotFoundException: HTTP 404 Not Found
at
org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.handleErrorStatus(
ClientInvocation.java:181)
at
org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(Clie
ntInvocation.java:154)
at
org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvoc
ation.java:444)
at
org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.post(Client
InvocationBuilder.java:201)
at
com.netscape.certsrv.client.PKIConnection.post(PKIConnection.java:509)
-----Original Message-----
From: Fraser Tweedale <ftweedal(a)redhat.com>
Sent: Thursday, 2 August 2018 5:34 PM
To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Cc: Aaron Hicks <aaron.hicks(a)nesi.org.nz>
Subject: Re: [Freeipa-users] Creating CA replica fails
Hi Aaron,
Can you please provide the contents of
/var/log/pki/pki-ca-spawn.20180802044015.log, and
/var/log/pki/pki-tomcat/ca/debug from both the replica (if it
exists) and the master.
Thanks,
Fraser
On Thu, Aug 02, 2018 at 05:03:54PM +1200, Aaron Hicks via FreeIPA-users
wrote:
Hello the List,
I'm successfully replicating IPA and DNS across two sites, however
when I try and replicate CA it fails:
[root@ipa01 pki]# ipa-ca-install
Directory Manager (existing master) password:
Run connection check to master
Connection check OK
/usr/lib/python2.7/site-packages/urllib3/connection.py:251:
SecurityWarning:
Certificate has no `subjectAltName`, falling back to check for a
`commonName` for now. This feature is being removed by major browsers
and deprecated by RFC 2818. (See
https://github.com/shazow/urllib3/issues/497
for details.)
SecurityWarning
Configuring certificate server (pki-tomcatd). Estimated time: 3
minutes
[1/25]: creating certificate server db
[2/25]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded
[3/25]: creating installation admin user
[4/25]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to
configure CA
instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W'
returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the
installation logs and the following files/directories for more
information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL
/var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
When I check the logs in /var/log/ipareplica-ca-install.log
<snip all good>
2018-08-02T04:40:15Z DEBUG Starting external process
2018-08-02T04:40:15Z DEBUG args=/usr/sbin/pkispawn -s CA -f
/tmp/tmpaJdg1W
2018-08-02T04:45:31Z DEBUG Process finished, return code=1
2018-08-02T04:45:31Z DEBUG stdout=Log file:
/var/log/pki/pki-ca-spawn.20180802044015.log
Loading deployment configuration from /tmp/tmpaJdg1W.
WARNING: The 'pki_ssl_server_nickname' in [CA] has been deprecated.
Use 'pki_sslserver_nickname' instead.
WARNING: The 'pki_ssl_server_subject_dn' in [CA] has been deprecated.
Use 'pki_sslserver_subject_dn' instead.
Installing CA into /var/lib/pki/pki-tomcat.
Storing deployment configuration into
/etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg.
Importing certificates from /tmp/ca.p12:
<snip a certificate>
Installation failed:
Please check the CA logs in q.
2018-08-02T04:45:31Z DEBUG stderr=
2018-08-02T04:45:31Z CRITICAL Failed to configure CA instance: Command
'/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
' returned non-zero exit status 1
2018-08-02T04:45:31Z CRITICAL See the installation logs and the
following files/directories for more information:
2018-08-02T04:45:31Z CRITICAL /var/log/pki/pki-tomcat
2018-08-02T04:45:31Z DEBUG Traceback (most recent call last):
File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line
504, in start_creation
run_step(full_msg, method)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line
494, in run_step
method()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 616, in __spawn_instance
self.tmp_agent_pwd)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py"
, line 148, in spawn_instance
self.handle_setup_error(e)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py"
, line 386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
RuntimeError: CA configuration failed.
2018-08-02T04:45:31Z DEBUG [error] RuntimeError: CA configuration
failed.
2018-08-02T04:45:31Z DEBUG File
"/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py",
line 998,
in run_script
return_value = main_function()
File "/sbin/ipa-ca-install", line 309, in main
promote(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 277, in promote
install_replica(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 207, in install_replica
ca.install(True, config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py",
line 202, in install
install_step_0(standalone, replica_config, options,
custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py",
line 279, in install_step_0
use_ldaps=standalone)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 448, in configure_instance
self.start_creation(runtime=runtime)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line
504, in start_creation
run_step(full_msg, method)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line
494, in run_step
method()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py",
line 616, in __spawn_instance
self.tmp_agent_pwd)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py"
, line 148, in spawn_instance
self.handle_setup_error(e)
File
"/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py"
, line 386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
2018-08-02T04:45:31Z DEBUG The ipa-ca-install command failed, exception:
RuntimeError: CA configuration failed.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedo
rahosted.org/message/QJOK7T4BHOBDRSCX6GH2W6PW2QRUI6ZI/