<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">On a clean Fedora 20, minimal install, system using the netinstall iso, I’m getting an error all the way at the end of the ipa-server-install process (when it tries to run ipa-client-install). I put the fqdn of the hostname in /etc/hostname
and “ipaddr ipa.usfs-i2.umt.edu ipa” in /etc/hosts and rebooted. Hostname returns the fqdn. DNS A, SRV, and TXT entries are in place. Reverse DNS works.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Copr repository installed, and fedora-updates-testing enabled (for required version of dirsrv). Yum refused to install freeipa-server for reason of unsatisfied dependencies, but dnf succeeded.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Tail end of ipa-server-install is here, followed by a successful kinit and a failed “ipa” command. I can fix the cert issue on the server by following
<a href="http://www.iamlinux.com/2014/06/ipa-commands-fails-with-peers-certificate-issuer-has-been-marked-as-not-trusted-by-the-user-error/">
http://www.iamlinux.com/2014/06/ipa-commands-fails-with-peers-certificate-issuer-has-been-marked-as-not-trusted-by-the-user-error/</a>. This allows ipa commands on the server to work. However, ipa-client-install on the client fails with the same “Peer's certificate
issuer has been marked as not trusted by the user.”<o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal">Is this a dorky new user problem or should I file a bug?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Bryce<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">…<o:p></o:p></p>
<p class="MsoNormal">Done configuring the web interface (httpd).<o:p></o:p></p>
<p class="MsoNormal">Applying LDAP updates<o:p></o:p></p>
<p class="MsoNormal">Restarting the directory server<o:p></o:p></p>
<p class="MsoNormal">Restarting the KDC<o:p></o:p></p>
<p class="MsoNormal">Restarting the certificate server<o:p></o:p></p>
<p class="MsoNormal">Sample zone file for bind has been created in /tmp/sample.zone.dr0fFP.db<o:p></o:p></p>
<p class="MsoNormal">Restarting the web server<o:p></o:p></p>
<p class="MsoNormal">Configuration of client side components failed!<o:p></o:p></p>
<p class="MsoNormal">ipa-client-install returned: Command ''/usr/sbin/ipa-client-install' '--on-master' '--unattended' '--domain' 'usfs-i2.umt.edu' '--server' 'ipa.usfs-i2.umt.edu' '--realm' 'USFS-I2.UMT.EDU' '--hostname' 'ipa.usfs-i2.umt.edu'' returned non-zero
exit status 1<o:p></o:p></p>
<p class="MsoNormal">[root@ipa yum.repos.d]# kinit admin<o:p></o:p></p>
<p class="MsoNormal">Password for admin@USFS-I2.UMT.EDU:<o:p></o:p></p>
<p class="MsoNormal">[root@ipa yum.repos.d]# klist<o:p></o:p></p>
<p class="MsoNormal">Ticket cache: KEYRING:persistent:0:0<o:p></o:p></p>
<p class="MsoNormal">Default principal: admin@USFS-I2.UMT.EDU<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Valid starting Expires Service principal<o:p></o:p></p>
<p class="MsoNormal">07/16/2014 13:29:51 07/17/2014 13:29:45 krbtgt/USFS-I2.UMT.EDU@USFS-I2.UMT.EDU<o:p></o:p></p>
<p class="MsoNormal">[root@ipa yum.repos.d]# ipa user-find<o:p></o:p></p>
<p class="MsoNormal">ipa: ERROR: cert validation failed for "CN=ipa.usfs-i2.umt.edu,O=USFS-I2.UMT.EDU" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.)<o:p></o:p></p>
<p class="MsoNormal">ipa: ERROR: cannot connect to 'https://ipa.usfs-i2.umt.edu/ipa/json': (SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.<o:p></o:p></p>
</div>
<br>
<br>
<br>
<br>
This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil
or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.
</body>
</html>