Hello the List,
I'm successfully replicating IPA and DNS across two sites, however when I try and replicate CA it fails:
[root@ipa01 pki]# ipa-ca-install
Directory Manager (existing master) password:
Run connection check to master
Connection check OK
/usr/lib/python2.7/site-packages/urllib3/connection.py:251: SecurityWarning: Certificate has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)
SecurityWarning
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/25]: creating certificate server db
[2/25]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded
[3/25]: creating installation admin user
[4/25]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
When I check the logs in /var/log/ipareplica-ca-install.log
<snip all good>
2018-08-02T04:40:15Z DEBUG Starting external process
2018-08-02T04:40:15Z DEBUG args=/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
2018-08-02T04:45:31Z DEBUG Process finished, return code=1
2018-08-02T04:45:31Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20180802044015.log
Loading deployment configuration from /tmp/tmpaJdg1W.
WARNING: The 'pki_ssl_server_nickname' in [CA] has been deprecated. Use 'pki_sslserver_nickname' instead.
WARNING: The 'pki_ssl_server_subject_dn' in [CA] has been deprecated. Use 'pki_sslserver_subject_dn' instead.
Installing CA into /var/lib/pki/pki-tomcat.
Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg.
Importing certificates from /tmp/ca.p12:
<snip a certificate>
Installation failed:
Please check the CA logs in q.
2018-08-02T04:45:31Z DEBUG stderr=
2018-08-02T04:45:31Z CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
' returned non-zero exit status 1
2018-08-02T04:45:31Z CRITICAL See the installation logs and the following files/directories for more information:
2018-08-02T04:45:31Z CRITICAL /var/log/pki/pki-tomcat
2018-08-02T04:45:31Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 616, in __spawn_instance
self.tmp_agent_pwd)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 148, in spawn_instance
self.handle_setup_error(e)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
RuntimeError: CA configuration failed.
2018-08-02T04:45:31Z DEBUG [error] RuntimeError: CA configuration failed.
2018-08-02T04:45:31Z DEBUG File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 998,
in run_script
return_value = main_function()
File "/sbin/ipa-ca-install", line 309, in main
promote(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 277, in promote
install_replica(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 207, in install_replica
ca.install(True, config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 202, in install
install_step_0(standalone, replica_config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 279, in install_step_0
use_ldaps=standalone)
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 448, in configure_instance
self.start_creation(runtime=runtime)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 616, in __spawn_instance
self.tmp_agent_pwd)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 148, in spawn_instance
self.handle_setup_error(e)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
2018-08-02T04:45:31Z DEBUG The ipa-ca-install command failed, exception: RuntimeError: CA configuration failed.
Hi Aaron,
Can you please provide the contents of /var/log/pki/pki-ca-spawn.20180802044015.log, and /var/log/pki/pki-tomcat/ca/debug from both the replica (if it exists) and the master.
Thanks, Fraser
On Thu, Aug 02, 2018 at 05:03:54PM +1200, Aaron Hicks via FreeIPA-users wrote:
Hello the List,
I'm successfully replicating IPA and DNS across two sites, however when I try and replicate CA it fails:
[root@ipa01 pki]# ipa-ca-install
Directory Manager (existing master) password:
Run connection check to master
Connection check OK
/usr/lib/python2.7/site-packages/urllib3/connection.py:251: SecurityWarning: Certificate has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)
SecurityWarning
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/25]: creating certificate server db
[2/25]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded
[3/25]: creating installation admin user
[4/25]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
When I check the logs in /var/log/ipareplica-ca-install.log
<snip all good>
2018-08-02T04:40:15Z DEBUG Starting external process
2018-08-02T04:40:15Z DEBUG args=/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
2018-08-02T04:45:31Z DEBUG Process finished, return code=1
2018-08-02T04:45:31Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20180802044015.log
Loading deployment configuration from /tmp/tmpaJdg1W.
WARNING: The 'pki_ssl_server_nickname' in [CA] has been deprecated. Use 'pki_sslserver_nickname' instead.
WARNING: The 'pki_ssl_server_subject_dn' in [CA] has been deprecated. Use 'pki_sslserver_subject_dn' instead.
Installing CA into /var/lib/pki/pki-tomcat.
Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg.
Importing certificates from /tmp/ca.p12:
<snip a certificate>
Installation failed:
Please check the CA logs in q.
2018-08-02T04:45:31Z DEBUG stderr=
2018-08-02T04:45:31Z CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
' returned non-zero exit status 1
2018-08-02T04:45:31Z CRITICAL See the installation logs and the following files/directories for more information:
2018-08-02T04:45:31Z CRITICAL /var/log/pki/pki-tomcat
2018-08-02T04:45:31Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 616, in __spawn_instance
self.tmp_agent_pwd)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 148, in spawn_instance
self.handle_setup_error(e)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
RuntimeError: CA configuration failed.
2018-08-02T04:45:31Z DEBUG [error] RuntimeError: CA configuration failed.
2018-08-02T04:45:31Z DEBUG File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 998,
in run_script
return_value = main_function()
File "/sbin/ipa-ca-install", line 309, in main
promote(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 277, in promote
install_replica(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 207, in install_replica
ca.install(True, config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 202, in install
install_step_0(standalone, replica_config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 279, in install_step_0
use_ldaps=standalone)
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 448, in configure_instance
self.start_creation(runtime=runtime)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 616, in __spawn_instance
self.tmp_agent_pwd)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 148, in spawn_instance
self.handle_setup_error(e)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py", line 386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
2018-08-02T04:45:31Z DEBUG The ipa-ca-install command failed, exception: RuntimeError: CA configuration failed.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost...
I'm on my way home but I manage to find this in /var/log/pki/pki-tomcat/ca/debug on the replica (hostnames have been changed to protect the innocent, ipa03 is the master ipa01 is the replica), I'll send the real logs directly to your email when I get a VPN up :
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: SystemConfigService: get configuration entries from master [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange start host=ipa03.example.org adminPort=443 eePort=443 [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange content: {xmlOutput=[true], sessionID=[21110386709 73117531], type=[request]} [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa03.example.org:443/ca/ad min/ca/updateNumberRange [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: content from admin interface =<HTML> <BODY BGCOLOR=white> <P> The Certificate System has encountered an unrecoverable error. <P> Error Message:<BR> <I>java.lang.NullPointerException</I> <P> Please contact your local administrator for assistance. </BODY> </HTML>
[02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange: Failed to contact master using admin portorg.xml.sax.SAXParseException; lineNumber: 2; columnNumber: 15; Open quote is expected for attribute "BGCOLOR" associated with an element type "BODY". [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: updateNumberRange: Attempting to contact master using EE port [02/Aug/2018:04:40:31][http-bio-8443-exec-3]: ConfigurationUtils: POST https://ipa03.example.org:443/ca/ee/ca/updateNumberRange javax.ws.rs.NotFoundException: HTTP 404 Not Found at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.handleErrorStatus( ClientInvocation.java:181) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(Clie ntInvocation.java:154) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvoc ation.java:444) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.post(Client InvocationBuilder.java:201) at com.netscape.certsrv.client.PKIConnection.post(PKIConnection.java:509)
-----Original Message----- From: Fraser Tweedale ftweedal@redhat.com Sent: Thursday, 2 August 2018 5:34 PM To: FreeIPA users list freeipa-users@lists.fedorahosted.org Cc: Aaron Hicks aaron.hicks@nesi.org.nz Subject: Re: [Freeipa-users] Creating CA replica fails
Hi Aaron,
Can you please provide the contents of /var/log/pki/pki-ca-spawn.20180802044015.log, and /var/log/pki/pki-tomcat/ca/debug from both the replica (if it exists) and the master.
Thanks, Fraser
On Thu, Aug 02, 2018 at 05:03:54PM +1200, Aaron Hicks via FreeIPA-users wrote:
Hello the List,
I'm successfully replicating IPA and DNS across two sites, however when I try and replicate CA it fails:
[root@ipa01 pki]# ipa-ca-install
Directory Manager (existing master) password:
Run connection check to master
Connection check OK
/usr/lib/python2.7/site-packages/urllib3/connection.py:251:
SecurityWarning:
Certificate has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)
SecurityWarning
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
[1/25]: creating certificate server db
[2/25]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded
[3/25]: creating installation admin user
[4/25]: configuring certificate server instance
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more
information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL /var/log/pki/pki-tomcat
[error] RuntimeError: CA configuration failed.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
CA configuration failed.
When I check the logs in /var/log/ipareplica-ca-install.log
<snip all good>
2018-08-02T04:40:15Z DEBUG Starting external process
2018-08-02T04:40:15Z DEBUG args=/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
2018-08-02T04:45:31Z DEBUG Process finished, return code=1
2018-08-02T04:45:31Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.20180802044015.log
Loading deployment configuration from /tmp/tmpaJdg1W.
WARNING: The 'pki_ssl_server_nickname' in [CA] has been deprecated. Use 'pki_sslserver_nickname' instead.
WARNING: The 'pki_ssl_server_subject_dn' in [CA] has been deprecated. Use 'pki_sslserver_subject_dn' instead.
Installing CA into /var/lib/pki/pki-tomcat.
Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-tomcat/ca/deployment.cfg.
Importing certificates from /tmp/ca.p12:
<snip a certificate>
Installation failed:
Please check the CA logs in q.
2018-08-02T04:45:31Z DEBUG stderr=
2018-08-02T04:45:31Z CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpaJdg1W
' returned non-zero exit status 1
2018-08-02T04:45:31Z CRITICAL See the installation logs and the following files/directories for more information:
2018-08-02T04:45:31Z CRITICAL /var/log/pki/pki-tomcat
2018-08-02T04:45:31Z DEBUG Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 616, in __spawn_instance
self.tmp_agent_pwd)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py" , line 148, in spawn_instance
self.handle_setup_error(e)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py" , line 386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
RuntimeError: CA configuration failed.
2018-08-02T04:45:31Z DEBUG [error] RuntimeError: CA configuration
failed.
2018-08-02T04:45:31Z DEBUG File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 998,
in run_script
return_value = main_function()
File "/sbin/ipa-ca-install", line 309, in main
promote(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 277, in promote
install_replica(safe_options, options, filename)
File "/sbin/ipa-ca-install", line 207, in install_replica
ca.install(True, config, options, custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 202, in install
install_step_0(standalone, replica_config, options,
custodia=custodia)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ca.py", line 279, in install_step_0
use_ldaps=standalone)
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 448, in configure_instance
self.start_creation(runtime=runtime)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 504, in start_creation
run_step(full_msg, method)
File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 494, in run_step
method()
File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 616, in __spawn_instance
self.tmp_agent_pwd)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py" , line 148, in spawn_instance
self.handle_setup_error(e)
File "/usr/lib/python2.7/site-packages/ipaserver/install/dogtaginstance.py" , line 386, in handle_setup_error
raise RuntimeError("%s configuration failed." % self.subsystem)
2018-08-02T04:45:31Z DEBUG The ipa-ca-install command failed, exception: RuntimeError: CA configuration failed.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedo rahosted.org/message/QJOK7T4BHOBDRSCX6GH2W6PW2QRUI6ZI/
freeipa-users@lists.fedorahosted.org