[Freeipa-devel] [PATCH] 843 reduce dogtag install time

[Rob Crittenden]

Jan Cholasta wrote:
> On 4.8.2011 17:24, Martin Kosek wrote:
>> On Thu, 2011-08-04 at 17:02 +0200, Jan Cholasta wrote:
>>> On 2.8.2011 13:49, Martin Kosek wrote:
>>>> On Mon, 2011-08-01 at 15:19 -0400, Rob Crittenden wrote:
>>>>> Ade Lee from the dogtag team looked at our installer and found that we
>>>>> restarted the pki-cad process too many times. Re-arranging some code
>>>>> allows us to restart it just once. The new config time for dogtag is 3
>>>>> 1/2 minutes, down from about 5 1/2.
>>>>>
>>>>> Ade is working on improvements in pki-silent as well which can
>>>>> bring the
>>>>> overall install time to 90 seconds. If we can get a change in SELinux
>>>>> policy we're looking at 60 seconds.
>>>>>
>>>>> This patch just contains the reworked installer part. Once an updated
>>>>> dogtag is released we can update the spec file to pull it in.
>>>>>
>>>>> rob
>>>>
>>>> This worked fine for standard dogtag installation + CA on a replica,
>>>> but
>>>> it failed with external CA:
>>>>
>>>> /var/log/ipaserver-install.log:
>>>> ...
>>>> <response>
>>>> <panel>admin/console/config/backupkeycertpanel.vm</panel>
>>>> <res/>
>>>> <pwdagain/>
>>>> <dobackup>checked</dobackup>
>>>> <errorString>Failed to create pkcs12 file.</errorString>
>>>> <size>19</size>
>>>> <pwd/>
>>>> <title>Export Keys and Certificates</title>
>>>> <panels>
>>>> <Vector>
>>>> <Panel>
>>>> ....
>>>> 2011-08-02 07:45:38,276 CRITICAL failed to configure ca instance
>>>> Command
>>>> '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname
>>>> vm-059.idm.lab.bos.redhat.com -cs_port 9445
>>>> -client_certdb_dir /tmp/tmp-GS6wzH -client_certdb_pwd 'XXXXXXXX'
>>>> -preop_pin BbkK9wJ7vD9UEzL4kBcO -domain_name IPA -admin_user admin
>>>> -admin_email root at localhost -admin_password 'XXXXXXXX' -agent_name
>>>> ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa
>>>> -agent_cert_subject "CN=ipa-ca-agent,O=IDM.LAB.BOS.REDHAT.COM"
>>>> -ldap_host vm-059.idm.lab.bos.redhat.com -ldap_port 7389 -bind_dn
>>>> "cn=Directory Manager" -bind_password 'XXXXXXXX' -base_dn o=ipaca
>>>> -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm
>>>> SHA256withRSA
>>>> -save_p12 true -backup_pwd 'XXXXXXXX' -subsystem_name pki-cad
>>>> -token_name internal -ca_subsystem_cert_subject_name "CN=CA
>>>> Subsystem,O=IDM.LAB.BOS.REDHAT.COM" -ca_ocsp_cert_subject_name "CN=OCSP
>>>> Subsystem,O=IDM.LAB.BOS.REDHAT.COM" -ca_server_cert_subject_name
>>>> "CN=vm-059.idm.lab.bos.redhat.com,O=IDM.LAB.BOS.REDHAT.COM"
>>>> -ca_audit_signing_cert_subject_name "CN=CA
>>>> Audit,O=IDM.LAB.BOS.REDHAT.COM" -ca_sign_cert_subject_name
>>>> "CN=Certificate Authority,O=IDM.LAB.BOS.REDHAT.COM" -external true
>>>> -ext_ca_cert_file /home/mkosek/cadb_f15/external-ca.crt
>>>> -ext_ca_cert_chain_file /home/mkosek/cadb_f15/ipa.crt -clone false'
>>>> returned non-zero exit status 255
>>>> 2011-08-02 07:45:38,302 DEBUG Configuration of CA failed
>>>> ...
>>>>
>>>
>>> Works for me.
>>>
>>> It's just a guess, but didn't you happen to swap --external_cert_file
>>> and --external_ca_file?
>>>
>>> Honza
>>>
>>
>> That's a good bet. I managed to find CRTs used in my installation and
>> displayed their contents and they were indeed wrong. So the problem was
>> only my side.
>>
>> ACK for Rob's patch then.
>>
>> Martin
>>
>
> It would be nice to add some sanity checks (verify that
> --external_cert_file's subject name is correct and that its issuer name
> matches --external_ca_file's subject name) to prevent this kind of
> problem in the future.
>
> Honza
>

https://fedorahosted.org/freeipa/ticket/1572