<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 12/08/2014 11:04 PM, Les Stott wrote: </div> <blockquote cite="mid:4ED173A868981548967B4FCA2707222628048DF6@AACMBXP04.exchserver.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> <div class="WordSection1"> Does anyone have any ideas on the below errors when trying to add CA replication to an existing replica?<o:p></o:p> </div> </blockquote> People who might be able to help are or PTO right now. Is your installation older than 2 years? Did you generate a new replica package or use the original one? May be the problem is that the cert that is in that package already expired? Just a thought... The simplest workaround IMO would be to prepare Server C, install it with CA and then decommission replica B. Do not forget to clean replication agreements on master. But that would be work around, would not solve this specific problem, it will kill it. <blockquote cite="mid:4ED173A868981548967B4FCA2707222628048DF6@AACMBXP04.exchserver.com" type="cite"> <div class="WordSection1"> <o:p> </o:p> Thanks in advance,<o:p></o:p> <o:p> </o:p> Les<o:p></o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [<a class="moz-txt-link-freetext" href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Les Stott Sent: Tuesday, 2 December 2014 6:17 PM To: <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: [Freeipa-users] CA Replication Installation Failing<o:p></o:p> </div> </div> <o:p> </o:p> Hi All,<o:p></o:p> <o:p> </o:p> I have RHEL6 with ipa servers running standard ipa server 3.0.0-42. Pki components are also standard version 9.0.3-38.<o:p></o:p> <o:p> </o:p> Servera is the master<o:p></o:p> Serverb is the replica<o:p></o:p> <o:p> </o:p> Both have been running for many, many months. Serverb was initially setup as a replica, but not a CA replica.<o:p></o:p> <o:p> </o:p> I am now trying to add CA Replication to serverb but it is failing midway through and I cannot figure out why.<o:p></o:p> <o:p> </o:p> Annoyingly, I used the same method/command to setup a CA replica on test servers and it completed without issue.<o:p></o:p> <o:p> </o:p> Here is what I get….(for the sake of brevity, I am excluding the lines for connection check which were all OK)<o:p></o:p> <o:p> </o:p> =================<o:p></o:p> /usr/sbin/ipa-ca-install /var/lib/ipa/replica-info-serverb.mydomain.com.gpg<o:p></o:p> Directory Manager (existing master) password:<o:p></o:p> Get credentials to log in to remote master<o:p></o:p> <a moz-do-not-send="true" href="mailto:admin@MYDOMAIN.COM">admin@MYDOMAIN.COM</a> password:<o:p></o:p> Execute check on remote master<o:p></o:p> Connection check OK<o:p></o:p> Configuring directory server for the CA (pkids): Estimated time 30 seconds<o:p></o:p> [1/3]: creating directory server user<o:p></o:p> [2/3]: creating directory server instance<o:p></o:p> [3/3]: restarting directory server<o:p></o:p> Done configuring directory server for the CA (pkids).<o:p></o:p> Configuring certificate server (pki-cad): Estimated time 3 minutes 30 seconds<o:p></o:p> [1/16]: creating certificate server user<o:p></o:p> [2/16]: creating pki-ca instance<o:p></o:p> [3/16]: configuring certificate server instance<o:p></o:p> ipa : CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname serverb.mydomain.com -cs_port 9445 -client_certdb_dir /tmp/tmp-t3aHM7 -client_certdb_pwd XXXXXXXX -preop_pin exoyO2y7bawG5yjZMACM -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=MYDOMAIN.COM -ldap_host serverb.mydomain.com -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=MYDOMAIN.COM -ca_subsystem_cert_subject_name CN=CA Subsystem,O=MYDOMAIN.COM -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=MYDOMAIN.COM -ca_server_cert_subject_name CN=serverb.mydomain.com,O=MYDOMAIN.COM -ca_audit_signing_cert_subject_name CN=CA Audit,O=MYDOMAIN.COM -ca_sign_cert_subject_name CN=Certificate Authority,O=MYDOMAIN.COM -external false -clone true -clone_p12_file ca.p12 -clone_p12_password XXXXXXXX -sd_hostname servera.mydomain.com -sd_admin_port 443 -sd_admin_name admin -sd_admin_password XXXXXXXX -clone_start_tls true -clone_uri <a moz-do-not-send="true" href="https://servera.mydomain.com:443">https://servera.mydomain.com:443</a>' returned non-zero exit status 255<o:p></o:p> <o:p> </o:p> Your system may be partly configured.<o:p></o:p> Run /usr/sbin/ipa-server-install --uninstall to clean up.<o:p></o:p> <o:p> </o:p> Configuration of CA failed<o:p></o:p> =================<o:p></o:p> <o:p> </o:p> Additional excerpt from the log file /var/log/ipareplica-ca-install.log at the point of failure….<o:p></o:p> <o:p> </o:p> =================<o:p></o:p> <o:p> </o:p> #############################################<o:p></o:p> Attempting to connect to: serverb.mydomain.com:9445<o:p></o:p> Connected.<o:p></o:p> Posting Query = <a moz-do-not-send="true" href="https://serverb.mydomain.com:9445/ca/admin/console/config/wizard?p=7&op=next&xml=true&__password=XXXXXXXX&path=ca.p12">https://serverb.mydomain.com:9445//ca/admin/console/config/wizard?p=7&op=next&xml=true&__password=XXXXXXXX&path=ca.p12</a><o:p></o:p> RESPONSE STATUS: HTTP/1.1 200 OK<o:p></o:p> RESPONSE HEADER: Server: Apache-Coyote/1.1<o:p></o:p> RESPONSE HEADER: Content-Type: application/xml;charset=UTF-8<o:p></o:p> RESPONSE HEADER: Date: Tue, 02 Dec 2014 05:44:19 GMT<o:p></o:p> RESPONSE HEADER: Connection: close<o:p></o:p> <?xml version="1.0" encoding="UTF-8"?><o:p></o:p> <o:p></o:p> <response><o:p></o:p> <panel>admin/console/config/restorekeycertpanel.vm</panel><o:p></o:p> <res/><o:p></o:p> <updateStatus>failure</updateStatus><o:p></o:p> <password/><o:p></o:p> <errorString>The pkcs12 file is not correct.</errorString><o:p></o:p> <size>19</size><o:p></o:p> <title>Import Keys and Certificates</title><o:p></o:p> <panels><o:p></o:p> <Vector><o:p></o:p> <Panel><o:p></o:p> <Id>welcome</Id><o:p></o:p> <Name>Welcome</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>module</Id><o:p></o:p> <Name>Key Store</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>confighsmlogin</Id><o:p></o:p> <Name>ConfigHSMLogin</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>securitydomain</Id><o:p></o:p> <Name>Security Domain</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>securitydomain</Id><o:p></o:p> <Name>Display Certificate Chain</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>subsystem</Id><o:p></o:p> <Name>Subsystem Type</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>clone</Id><o:p></o:p> <Name>Display Certificate Chain</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>restorekeys</Id><o:p></o:p> <Name>Import Keys and Certificates</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>cahierarchy</Id><o:p></o:p> <Name>PKI Hierarchy</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>database</Id><o:p></o:p> <Name>Internal Database</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>size</Id><o:p></o:p> <Name>Key Pairs</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>subjectname</Id><o:p></o:p> <Name>Subject Names</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>certrequest</Id><o:p></o:p> <Name>Requests and Certificates</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>backupkeys</Id><o:p></o:p> <Name>Export Keys and Certificates</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>savepk12</Id><o:p></o:p> <Name>Save Keys and Certificates</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>importcachain</Id><o:p></o:p> <Name>Import CA's Certificate Chain</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>admin</Id><o:p></o:p> <Name>Administrator</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>importadmincert</Id><o:p></o:p> <Name>Import Administrator's Certificate</Name><o:p></o:p> </Panel><o:p></o:p> <Panel><o:p></o:p> <Id>done</Id><o:p></o:p> <Name>Done</Name><o:p></o:p> </Panel><o:p></o:p> </Vector><o:p></o:p> </panels><o:p></o:p> <name>CA Setup Wizard</name><o:p></o:p> 7<o:p></o:p> <path/><o:p></o:p> <req/><o:p></o:p> <panelname>restorekeys</panelname><o:p></o:p> </response><o:p></o:p> Error in RestoreKeyCertPanel(): updateStatus returns failure<o:p></o:p> ERROR: ConfigureCA: RestoreKeyCertPanel() failure<o:p></o:p> ERROR: unable to create CA<o:p></o:p> <o:p> </o:p> #######################################################################<o:p></o:p> 2014-12-02T05:44:19Z DEBUG stderr=<o:p></o:p> 2014-12-02T05:44:19Z CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname serverb.mydomain.com -cs_port 9445 -client_certdb_dir /tmp/tmp-1Tqws5 -client_certdb_pwd XXXXXXXX -preop_pin rdkE0y2CiGMKNcRRPKKc -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=MYDOMAIN.COM -ldap_host serverb.mydomain.com -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=MYDOMAIN.COM -ca_subsystem_cert_subject_name CN=CA Subsystem,O=MYDOMAIN.COM -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=MYDOMAIN.COM -ca_server_cert_subject_name CN=serverb.mydomain.com,O=MYDOMAIN.COM -ca_audit_signing_cert_subject_name CN=CA Audit,O=MYDOMAIN.COM -ca_sign_cert_subject_name CN=Certificate Authority,O=MYDOMAIN.COM -external false -clone true -clone_p12_file ca.p12 -clone_p12_password XXXXXXXX -sd_hostname servera.mydomain.com -sd_admin_port 443 -sd_admin_name admin -sd_admin_password XXXXXXXX -clone_start_tls true -clone_uri <a moz-do-not-send="true" href="https://servera.mydomain.com:443"> https://servera.mydomain.com:443</a>' returned non-zero exit status 255<o:p></o:p> 2014-12-02T05:44:19Z INFO File "/usr/lib/python2.6/site-packages/ipaserver/install/installutils.py", line 614, in run_script<o:p></o:p> return_value = main_function()<o:p></o:p> <o:p> </o:p> File "/usr/sbin/ipa-ca-install", line 149, in main<o:p></o:p> (CA, cs) = cainstance.install_replica_ca(config, postinstall=True)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 1626, in install_replica_ca<o:p></o:p> subject_base=config.subject_base)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 626, in configure_instance<o:p></o:p> self.start_creation(runtime=210)<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.6/site-packages/ipaserver/install/service.py", line 358, in start_creation<o:p></o:p> method()<o:p></o:p> <o:p> </o:p> File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 888, in __configure_instance<o:p></o:p> raise RuntimeError('Configuration of CA failed')<o:p></o:p> <o:p> </o:p> 2014-12-02T05:44:19Z INFO The ipa-ca-install command failed, exception: RuntimeError: Configuration of CA failed<o:p></o:p> <o:p> </o:p> =================<o:p></o:p> <o:p> </o:p> I am not sure why this is happening.<o:p></o:p> <o:p> </o:p> Certutil shows that the setup isn’t complete on serverb when comparing against the CA replica in my test servers which were successful.<o:p></o:p> <o:p> </o:p> # certutil -L -d /var/lib/pki-ca/alias<o:p></o:p> <o:p> </o:p> Certificate Nickname Trust Attributes<o:p></o:p> SSL,S/MIME,JAR/XPI<o:p></o:p> <o:p> </o:p> Certificate Authority - MYDOMAIN.COM CT,c,<o:p></o:p> Server-Cert cert-pki-ca CTu,Cu,Cu<o:p></o:p> <o:p> </o:p> # certutil -K -d /var/lib/pki-ca/alias<o:p></o:p> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"<o:p></o:p> Enter Password or Pin for "NSS Certificate DB":<o:p></o:p> < 0> rsa ef25de4fb656a27e297899509bc3dad582bcd643 NSS Certificate DB:Server-Cert cert-pki-ca<o:p></o:p> <o:p> </o:p> <o:p> </o:p> As yet, I have not tried “/usr/sbin/ipa-server-install –uninstall” in an attempt to cleanup as this is a production server and apart from CA replication, it is running fine. I have tried multiple times manually removing pki instances and reinstalling but it still won’t get past the above error.<o:p></o:p> <o:p> </o:p> Can anyone shed any light on this?<o:p></o:p> <o:p> </o:p> Thanks in advance,<o:p></o:p> <o:p> </o:p> Les<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> </div> </div> <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc.</pre> </body> </html>