<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 11/17/2011 10:58 AM, Dan Scott wrote: <blockquote cite="mid:CANQKhh=rkkdabU7JOEE7yFUA_LireExRh0Kco=Es_s51T958qQ@mail.gmail.com" type="cite"> <pre wrap="">On Wed, Nov 16, 2011 at 14:01, Rob Crittenden <a class="moz-txt-link-rfc2396E" href="mailto:rcritten@redhat.com"><rcritten@redhat.com></a> wrote: </pre> <blockquote type="cite"> <pre wrap="">Dan Scott wrote: </pre> <blockquote type="cite"> <pre wrap=""> On Wed, Nov 16, 2011 at 10:39, Rob Crittenden<a class="moz-txt-link-rfc2396E" href="mailto:rcritten@redhat.com"><rcritten@redhat.com></a> wrote: </pre> <blockquote type="cite"> <pre wrap=""> Dan Scott wrote: </pre> <blockquote type="cite"> <pre wrap=""> On Wed, Nov 16, 2011 at 09:23, Rob Crittenden<a class="moz-txt-link-rfc2396E" href="mailto:rcritten@redhat.com"><rcritten@redhat.com></a> wrote: </pre> <blockquote type="cite"> <pre wrap=""> Dan Scott wrote: </pre> <blockquote type="cite"> <pre wrap=""> Hi, I receive the following error when I try to remove a host from IPA: djscott@pc35:~$ ipa host-del pc60 ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found) I'm running a Fedora 16 (freeipa-server-2.1.3-5.fc16.x86_64) server replicated with a Fedora 15 (freeipa-server-2.1.3-2.fc15.i686) server. I've looked at this: <a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/1889">https://fedorahosted.org/freeipa/ticket/1889</a> But it looks like it was fixed in 2.1.2 or 2.1.3. Any ideas for what I need to do? Thanks, Dan </pre> </blockquote> <pre wrap=""> This would suggest that dogtag isn't running. Is dogtag and its LDAP instance up? </pre> </blockquote> <pre wrap=""> It seems to be, there are 2 entries 'loaded active running' for the dirsrv@ instances. I don't see any errors in the /var/log/dirsrv/slapd-PKI-IPA/errors file. Tomcat is running too. Dan </pre> </blockquote> <pre wrap=""> Hmm, ok, lets see if we can talk to the cert system at all. $ ipa cert-show 1 </pre> </blockquote> <pre wrap=""> fileserver1 is the IPA server with PKI-IPA running: [root@fileserver1 ~]# ipa cert-show 1 ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found) SELinux is my normal culprit when things don't work. It may be so in this case. My /var/log/audit/audit.log hasn't changed since 11th November..... Unfortunately, temporarily disabling it doesn't seem to help: [root@fileserver1 ~]# setenforce Permissive [root@fileserver1 ~]# ipa cert-show 1 ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found) What processes should be running for the certificate server? I have the ns-slapd process and tomcat6 running. The tomcat logs are empty. Dan </pre> </blockquote> <pre wrap=""> It sounds like you have the right processes running. The dogtag logs are in /var/log/pki-ca. debug is rather verbose and where I usually start looking for issues. </pre> </blockquote> <pre wrap=""> The /var/log/pki-ca/debug file hasn't been updated since the 11th November. I've attached an extract from catalina.out which contains some pretty severe errors. To summarise, the errors are: SEVERE: Error initializing socket factory java.lang.ClassNotFoundException: org.mozilla.jss.ssl.SSLSocket SEVERE: Failed to initialize connector [Connector[HTTP/1.1-9443]] java.io.IOException: Failed to access resource /WEB-INF/lib/osutil.jar I'd guess that this means I'm missing a package? I'm having trouble figuring out which one contains the code I'm missing. Maybe I need to reinstall one? Thanks, Dan</pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> Is this on F16? It might be that the package is there but not being picked up. JSS and osutils are a JNI packages, and you should find them in /usr/lib64/java/jss4.jar and osutil.jar, but they might end up in /usr/lib/java/jss4.jar and osutil,jar </body> </html>