<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>I'm running centos 6.3</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span># uname -r<br>2.6.32-279.5.2.el6.x86_64<br><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span>pki-ca: unrecognized service<br></span></div><div><br></div><div>There are tons of errors in /var/log/pki-ca/*, some of them are:</div><div>/var/log/pki-ca/system:11605.main - [30/Aug/2012:16:34:56 EDT] [3] [3] Cannot build CA chain. Error java.security.cert.CertificateException: Certificate is not a PKCS #11 certificate<br>/var/log/pki-ca/system:11605.main - [30/Aug/2012:16:34:56 EDT] [13] [3] authz instance
DirAclAuthz initialization failed and skipped, error=Property internaldb.ldapconn.port missing value<br>/var/log/pki-ca/system:11605.http-9445-1 - [30/Aug/2012:16:35:01 EDT] [3] [3] Cannot build CA chain. Error java.security.cert.CertificateException: Certificate is not a PKCS #11 certificate<br>/var/log/pki-ca/system:11605.http-9445-1 - [30/Aug/2012:16:35:10 EDT] [3] [3] CASigningUnit: Object certificate not found. Error org.mozilla.jss.crypto.ObjectNotFoundException<br>/var/log/pki-ca/system:3281.main - [31/Aug/2012:17:54:28 EDT] [8] [3] In Ldap (bound) connection pool to host cushing.psych.yale.edu port 7389, Cannot connect to LDAP server. Error: netscape.ldap.LDAPException: failed to connect to server ldap://cushing.psych.yale.edu:7389 (91)</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size:
16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">/var/log/pki-ca/catalina.2012-09-03.log:SEVERE: Error initializing socket factory<br>/var/log/pki-ca/catalina.2012-09-03.log:java.lang.ClassNotFoundException: Error loading SSL Implementation org.apache.tomcat.util.net.jss.JSSImplementation :java.lang.ClassNotFoundException: org.mozilla.jss.ssl.SSLSocket<br>/var/log/pki-ca/catalina.2012-09-03.log:LifecycleException: Protocol handler initialization failed: java.lang.ClassNotFoundException: Error loading SSL Implementation org.apache.tomcat.util.net.jss.JSSImplementation :java.lang.ClassNotFoundException: org.mozilla.jss.ssl.SSLSocket<br>/var/log/pki-ca/catalina.2012-09-03.log:SEVERE: Error deploying web application directory ca<br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style:
normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Thanks,</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">George<br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> John Dennis <jdennis@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> george he <george_he7@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com"
<freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, September 4, 2012 10:40 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] ipa host-del<br> </font> </div> <br>
On 09/04/2012 10:23 AM, george he wrote:<br>> First of all, i don't see any java process after ipactl stop.<br>> <br>> Then I turned on debug and this is what I get on terminal:<br>> # ipa host-del <a target="_blank" href="http://hnl09.psych.yale.edu/">hnl09.psych.yale.edu</a><br>> ......<br>> ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer<br>> ipa: DEBUG: cert valid True for "CN=cushing.psych.yale.edu,O=PSYCH.YALE.EDU"<br>> ipa: DEBUG: handshake complete, peer = 130.132.167.68:443<br>> ipa: DEBUG: Caught fault 4301 from server<br>> http://cushing.psych.yale.edu/ipa/xml: Certificate operation cannot be<br>> completed: Unable to communicate with CMS (Service Temporarily Unavailable)<br>> ipa: DEBUG: Destroyed connection context.xmlclient<br>> ipa: ERROR: Certificate operation cannot be completed: Unable to<br>> communicate with CMS (Service Temporarily Unavailable)<br>> <br>> So there's a
"fault 4301" being caught.<br>> And this is at the end of /var/log/httpd/error_log:<br>> [Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: approved_usage =<br>> SSLServer intended_usage = SSLServer<br>> [Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: cert valid True for<br>> "CN=cushing.psych.yale.edu,O=PSYCH.YALE.EDU"<br>> [Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: handshake complete, peer<br>> = 130.132.167.68:443<br>> [Tue Sep 04 10:17:05 2012] [error] (111)Connection refused: proxy: AJP:<br>> attempt to connect to 127.0.0.1:9447 (localhost) failed<br>> [Tue Sep 04 10:17:05 2012] [error] ap_proxy_connect_backend disabling<br>> worker for (localhost)<br>> [Tue Sep 04 10:17:05 2012] [error] proxy: AJP: failed to make connection<br>> to backend: localhost<br>> [Tue Sep 04 10:17:05 2012] [error] ipa: INFO: <a ymailto="mailto:admin@PSYCH.YALE.EDU"
href="mailto:admin@PSYCH.YALE.EDU">admin@PSYCH.YALE.EDU</a>:<br>> host_del((u'hnl09.psych.yale.edu',), updatedns=False):<br>> CertificateOperationError<br>> [Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: response:<br>> CertificateOperationError: Certificate operation cannot be completed:<br>> Unable to communicate with CMS (Service Temporarily Unavailable)<br>> [Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: Destroyed connection<br>> context.ldap2<br>> <br>> Thanks,<br>> George<br><br>It appears as if your CA instance is not running (pki-ca). Depending on which OS you're running on could you verify pki-ca is running via either the service or systemctl command. Do you see any errors in the log files found under /var/log/pki-ca?<br><br>-- John Dennis <<a ymailto="mailto:jdennis@redhat.com" href="mailto:jdennis@redhat.com">jdennis@redhat.com</a>><br><br>Looking to carve out IT costs?<br><a target="_blank"
href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a><br><br><br> </div> </div> </blockquote></div> </div></body></html>