<div dir="ltr"><div class="gmail_extra"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div style="background-color:rgb(255,255,255)"><div><div>The httpd_error log doesn't contain the part where `ipa cert-show 1` was run. If it is from the same time. </div><div><br></div><div><b>I am not sure about that, please see httpd_error when `ipa cert-show 1` was run</b></div><div><br></div><div>[root@caer ~]# <b>tail -f /var/log/httpd/error_log</b></div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: WSGI wsgi_dispatch.__call__:</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: WSGI xmlserver_session.__call__:</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: found session cookie_id = bc2c7ed0eccd840dc266efaf9ece913c</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: found session data in cache with id=bc2c7ed0eccd840dc266efaf9ece913c</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: xmlserver_session.__call__: session_id=bc2c7ed0eccd840dc266efaf9ece913c start_timestamp=2016-07-21T11:58:54 access_timestamp=2016-07-21T12:01:21 expiration_timestamp=2016-07-21T12:18:54</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: storing ccache data into file "/var/run/ipa_memcached/krbcc_13554"</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: get_credential_times: principal=HTTP/<a href="mailto:caer.teloip.net@TELOIP.NET">caer.teloip.net@TELOIP.NET</a>, authtime=07/21/16 10:31:46, starttime=07/21/16 10:43:26, endtime=07/22/16 10:31:44, renew_till=12/31/69 19:00:00</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: get_credential_times: principal=HTTP/<a href="mailto:caer.teloip.net@TELOIP.NET">caer.teloip.net@TELOIP.NET</a>, authtime=07/21/16 10:31:46, starttime=07/21/16 10:43:26, endtime=07/22/16 10:31:44, renew_till=12/31/69 19:00:00</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: KRB5_CCache FILE:/var/run/ipa_memcached/krbcc_13554 endtime=1469197904 (07/22/16 10:31:44)</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: set_session_expiration_time: duration_type=inactivity_timeout duration=1200 max_age=1469197604 expiration=1469118081.77 (2016-07-21T12:21:21)</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: WSGI xmlserver.__call__:</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: Created connection context.ldap2</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: WSGI WSGIExecutioner.__call__:</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: raw: cert_show(u'1')</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: cert_show(u'1')</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: IPA: virtual verify retrieve certificate</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: ipaserver.plugins.dogtag.ra.get_certificate()</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: https_request '<a href="https://caer.teloip.net:443/ca/agent/ca/displayBySerial">https://caer.teloip.net:443/ca/agent/ca/displayBySerial</a>'</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: https_request post 'xml=true&serialNumber=1'</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: NSSConnection init <a href="http://caer.teloip.net">caer.teloip.net</a></div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: Connecting: <a href="http://10.20.0.75:0">10.20.0.75:0</a></div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: auth_certificate_callback: check_sig=True is_server=False</div><div><b>.</b></div><div><b>.</b></div><div><b>.</b></div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: cert valid True for "CN=<a href="http://caer.teloip.net">caer.teloip.net</a>,O=<a href="http://TELOIP.NET">TELOIP.NET</a>"</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: handshake complete, peer = <a href="http://10.20.0.75:443">10.20.0.75:443</a></div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: auth_certificate_callback: check_sig=True is_server=False</div><div><b>.</b></div><div><b>.</b></div><div><b>.</b></div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: cert valid True for "CN=<a href="http://caer.teloip.net">caer.teloip.net</a>,O=<a href="http://TELOIP.NET">TELOIP.NET</a>"</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: handshake complete, peer = <a href="http://10.20.0.75:443">10.20.0.75:443</a></div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: ERROR: ipaserver.plugins.dogtag.ra.get_certificate(): Unable to communicate with CMS (Not Found)</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: INFO: <a href="mailto:admin@TELOIP.NET">admin@TELOIP.NET</a>: cert_show(u'1'): CertificateOperationError</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: response: CertificateOperationError: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: Destroyed connection context.ldap2</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: reading ccache data from file "/var/run/ipa_memcached/krbcc_13554"</div><div>[Thu Jul 21 12:01:21 2016] [error] ipa: DEBUG: store session: session_id=bc2c7ed0eccd840dc266efaf9ece913c start_timestamp=2016-07-21T11:58:54 access_timestamp=2016-07-21T12:01:21 expiration_timestamp=2016-07-21T12:21:21</div><div><br></div><div><br></div><div>Does `ipa cert-show` communicate with the same replica? Could be verified by `ipa -vv cert-show`</div><div><br></div><div><b>It's asking for the serial number of the certificate. If I give 64 (serial number of ipaCert ), I get ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)</b></div><div><br></div><div><b>[root@caer ~]# ipa -vv cert-show</b></div><div>ipa: DEBUG: importing all plugin modules in '/usr/lib/python2.6/site-packages/ipalib/plugins'...</div><div><b>.</b></div><div><b>.</b></div><div><b>.</b></div><div>ipa: DEBUG: stdout=ipa_session=bc2c7ed0eccd840dc266efaf9ece913c; Domain=<a href="http://caer.teloip.net">caer.teloip.net</a>; Path=/ipa; Expires=Thu, 21 Jul 2016 16:25:32 GMT; Secure; HttpOnly</div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: found session_cookie in persistent storage for principal '<a href="mailto:admin@TELOIP.NET">admin@TELOIP.NET</a>', cookie: 'ipa_session=bc2c7ed0eccd840dc266efaf9ece913c; Domain=<a href="http://caer.teloip.net">caer.teloip.net</a>; Path=/ipa; Expires=Thu, 21 Jul 2016 16:25:32 GMT; Secure; HttpOnly'</div><div>ipa: DEBUG: setting session_cookie into context 'ipa_session=bc2c7ed0eccd840dc266efaf9ece913c;'</div><div>ipa: INFO: trying <a href="https://caer.teloip.net/ipa/session/xml">https://caer.teloip.net/ipa/session/xml</a></div><div>ipa: DEBUG: Created connection context.xmlclient</div><div>Serial number: 64</div><div>ipa: DEBUG: raw: cert_show(u'64')</div><div>ipa: DEBUG: cert_show(u'64')</div><div>ipa: INFO: Forwarding 'cert_show' to server u'<a href="https://caer.teloip.net/ipa/session/xml">https://caer.teloip.net/ipa/session/xml</a>'</div><div>ipa: DEBUG: NSSConnection init <a href="http://caer.teloip.net">caer.teloip.net</a></div><div>ipa: DEBUG: Connecting: <a href="http://10.20.0.75:0">10.20.0.75:0</a></div><div>send: u'POST /ipa/session/xml HTTP/1.0\r\nHost: <a href="http://caer.teloip.net">caer.teloip.net</a>\r\nAccept-Language: en-us\r\nReferer: <a href="https://caer.teloip.net/ipa/xml\r\nCookie">https://caer.teloip.net/ipa/xml\r\nCookie</a>: ipa_session=bc2c7ed0eccd840dc266efaf9ece913c;\r\nUser-Agent: <a href="http://xmlrpclib.py/1.0.1">xmlrpclib.py/1.0.1</a> (by <a href="http://www.pythonware.com">www.pythonware.com</a>)\r\nContent-Type: text/xml\r\nContent-Length: 268\r\n\r\n'</div><div>ipa: DEBUG: auth_certificate_callback: check_sig=True is_server=False</div><div><b>.</b></div><div><b>.</b></div><div><b>.</b></div><div>ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer</div><div>ipa: DEBUG: cert valid True for "CN=<a href="http://caer.teloip.net">caer.teloip.net</a>,O=<a href="http://TELOIP.NET">TELOIP.NET</a>"</div><div>ipa: DEBUG: handshake complete, peer = <a href="http://10.20.0.75:443">10.20.0.75:443</a></div><div>send: "<?xml version='1.0' encoding='UTF-8'?>\n<methodCall>\n<methodName>cert_show</methodName>\n<params>\n<param>\n<value><array><data>\n<value><string>64</string></value>\n</data></array></value>\n</param>\n<param>\n<value><struct>\n</struct></value>\n</param>\n</params>\n</methodCall>\n"</div><div>reply: 'HTTP/1.1 200 Success\r\n'</div><div>header: Date: Thu, 21 Jul 2016 16:05:40 GMT</div><div>header: Server: Apache/2.2.15 (CentOS)</div><div>header: Set-Cookie: ipa_session=bc2c7ed0eccd840dc266efaf9ece913c; Domain=<a href="http://caer.teloip.net">caer.teloip.net</a>; Path=/ipa; Expires=Thu, 21 Jul 2016 16:25:40 GMT; Secure; HttpOnly</div><div>header: Connection: close</div><div>header: Content-Type: text/xml; charset=utf-8</div><div>ipa: DEBUG: received Set-Cookie 'ipa_session=bc2c7ed0eccd840dc266efaf9ece913c; Domain=<a href="http://caer.teloip.net">caer.teloip.net</a>; Path=/ipa; Expires=Thu, 21 Jul 2016 16:25:40 GMT; Secure; HttpOnly'</div><div>ipa: DEBUG: storing cookie 'ipa_session=bc2c7ed0eccd840dc266efaf9ece913c; Domain=<a href="http://caer.teloip.net">caer.teloip.net</a>; Path=/ipa; Expires=Thu, 21 Jul 2016 16:25:40 GMT; Secure; HttpOnly' for principal <a href="mailto:admin@TELOIP.NET">admin@TELOIP.NET</a></div><div>ipa: DEBUG: args=keyctl search @s user <a href="mailto:ipa_session_cookie%3Aadmin@TELOIP.NET">ipa_session_cookie:admin@TELOIP.NET</a></div><div>ipa: DEBUG: stdout=457971704</div><div><br></div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: args=keyctl search @s user <a href="mailto:ipa_session_cookie%3Aadmin@TELOIP.NET">ipa_session_cookie:admin@TELOIP.NET</a></div><div>ipa: DEBUG: stdout=457971704</div><div><br></div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: args=keyctl pupdate 457971704</div><div>ipa: DEBUG: stdout=</div><div>ipa: DEBUG: stderr=</div><div>body: "<?xml version='1.0' encoding='UTF-8'?>\n<methodResponse>\n<fault>\n<value><struct>\n<member>\n<name>faultCode</name>\n<value><int>4301</int></value>\n</member>\n<member>\n<name>faultString</name>\n<value><string>Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)</string></value>\n</member>\n</struct></value>\n</fault>\n</methodResponse>\n"</div><div>ipa: DEBUG: Caught fault 4301 from server <a href="https://caer.teloip.net/ipa/session/xml">https://caer.teloip.net/ipa/session/xml</a>: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)</div><div>ipa: DEBUG: Destroyed connection context.xmlclient</div><div>ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Not Found)</div><div>[root@caer ~]# </div><div><br></div><div><br></div><div>But more interesting is: SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED!</div><div><br></div><div>Are you sure that CA is running? </div><div> # ipactl status</div><div> </div><div><b>Yes, CA is runnig, </b></div><div><br></div><div><b>[root@caer ~]# ipactl status</b></div><div>Directory Service: RUNNING</div><div>KDC Service: RUNNING</div><div>KPASSWD Service: RUNNING</div><div>DNS Service: RUNNING</div><div>MEMCACHE Service: RUNNING</div><div>HTTP Service: RUNNING</div><div>CA Service: RUNNING</div><div><br></div><div>This looks like that self test fail and therefore CA shouldn't start. It also says that some of CA cert is not valid. Which one might be seen in /var/log/pki-ca/debug but a bigger chunk would be needed.</div><div><br></div><div><b>[root@caer ~]# tail -100 /var/log/pki-ca/debug </b></div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: getConn: conn is connected true</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: getConn: mNumConns now 1</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: In findCertRecordsInListRawJumpto with Jumpto 20160721114829Z</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=REVOKED) attrs: [objectclass, certRevokedOn, certRecordId, certRevoInfo, notAfter, x509cert] pageSize -200 startFrom 20160721114829Z</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: returnConn: mNumConns now 2</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: returnConn: mNumConns now 3</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: getEntries returning 0</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: mTop 0</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Getting Virtual List size: 0</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: index may be empty</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: updateCertStatus done</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Starting cert checkRanges</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Serial numbers left in range: 268369849</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Last Serial Number: 71</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Serial Numbers available: 268369849</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: cert checkRanges done</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Starting request checkRanges</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Serial numbers left in range: 9989888</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Last Serial Number: 112</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: Serial Numbers available: 9989888</div><div>[21/Jul/2016:11:48:29][CertStatusUpdateThread]: request checkRanges done</div><div>[21/Jul/2016:11:53:28][Timer-0]: CMSEngine: getPasswordStore(): password store initialized before.</div><div>[21/Jul/2016:11:53:28][Timer-0]: CMSEngine: getPasswordStore(): password store initialized.</div><div>[21/Jul/2016:11:58:28][Timer-0]: CMSEngine: getPasswordStore(): password store initialized before.</div><div>[21/Jul/2016:11:58:28][Timer-0]: CMSEngine: getPasswordStore(): password store initialized.</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: About to start updateCertStatus</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Starting updateCertStatus (entered lock)</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In updateCertStatus()</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In LdapBoundConnFactory::getConn()</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: masterConn is connected: true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: conn is connected true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: mNumConns now 2</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getInvalidCertificatesByNotBeforeDate filter (certStatus=INVALID)</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getInvalidCertificatesByNotBeforeDate: about to call findCertRecordsInList</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In LdapBoundConnFactory::getConn()</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: masterConn is connected: true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: conn is connected true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: mNumConns now 1</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In findCertRecordsInListRawJumpto with Jumpto 20160721115829Z</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=INVALID) attrs: [objectclass, certRecordId, x509cert] pageSize -200 startFrom 20160721115829Z</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: returnConn: mNumConns now 2</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In getInvalidCertsByNotBeforeDate finally.</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: returnConn: mNumConns now 3</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getEntries returning 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: mTop 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Getting Virtual List size: 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: index may be empty</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In LdapBoundConnFactory::getConn()</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: masterConn is connected: true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: conn is connected true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: mNumConns now 2</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getValidCertsByNotAfterDate filter (certStatus=VALID)</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In LdapBoundConnFactory::getConn()</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: masterConn is connected: true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: conn is connected true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: mNumConns now 1</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In findCertRecordsInListRawJumpto with Jumpto 20160721115829Z</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=VALID) attrs: [objectclass, certRecordId, x509cert] pageSize -200 startFrom 20160721115829Z</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: returnConn: mNumConns now 2</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: returnConn: mNumConns now 3</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getEntries returning 1</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: mTop 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Getting Virtual List size: 14</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: transidValidCertificates: list size: 14</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: transitValidCertificates: ltSize 1</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getElementAt: 0 mTop 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: reverse direction getting index 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Record does not qualify,notAfter Thu Jan 12 09:11:48 EST 2017 date Thu Jul 21 11:58:29 EDT 2016</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: transitCertList EXPIRED</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In LdapBoundConnFactory::getConn()</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: masterConn is connected: true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: conn is connected true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: mNumConns now 2</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getRevokedCertificatesByNotAfterDate filter (certStatus=REVOKED)</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getRevokedCertificatesByNotAfterDate: about to call findCertRecordsInList</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In LdapBoundConnFactory::getConn()</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: masterConn is connected: true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: conn is connected true</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getConn: mNumConns now 1</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In findCertRecordsInListRawJumpto with Jumpto 20160721115829Z</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: In DBVirtualList filter attrs startFrom sortKey pageSize filter: (certStatus=REVOKED) attrs: [objectclass, certRevokedOn, certRecordId, certRevoInfo, notAfter, x509cert] pageSize -200 startFrom 20160721115829Z</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: returnConn: mNumConns now 2</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: returnConn: mNumConns now 3</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: getEntries returning 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: mTop 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Getting Virtual List size: 0</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: index may be empty</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: updateCertStatus done</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Starting cert checkRanges</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Serial numbers left in range: 268369849</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Last Serial Number: 71</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Serial Numbers available: 268369849</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: cert checkRanges done</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Starting request checkRanges</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Serial numbers left in range: 9989888</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Last Serial Number: 112</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: Serial Numbers available: 9989888</div><div>[21/Jul/2016:11:58:29][CertStatusUpdateThread]: request checkRanges done</div><div>[21/Jul/2016:12:03:28][Timer-0]: CMSEngine: getPasswordStore(): password store initialized before.</div><div>[21/Jul/2016:12:03:28][Timer-0]: CMSEngine: getPasswordStore(): password store initialized.</div></div></div></div></div></div></div> <br><div class="gmail_quote">On Thu, Jul 21, 2016 at 11:46 AM, Petr Vobornik <span dir="ltr"><<a href="mailto:pvoborni@redhat.com" target="_blank">pvoborni@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span class="">On 07/21/2016 05:14 PM, Linov Suresh wrote:<br> > I set debug=true in /etc/ipa/default.conf<br> ><br> > Here are my logs,<br> <br> </span>The httpd_error log doesn't contain the part where `ipa cert-show 1` was<br> run. If it is from the same time. Does `ipa cert-show` communicate with<br> the same replica? Could be verified by `ipa -vv cert-show`<br> <br> But more interesting is:<br> <span class=""><br> SelfTestSubsystem: The CRITICAL self test plugin called<br> selftests.container.instance.SystemCertsVerification running at startup<br> FAILED!<br> <br> </span>Are you sure that CA is running?<br> # ipactl status<br> <br> This looks like that self test fail and therefore CA shouldn't start. It<br> also says that some of CA cert is not valid. Which one might be seen in<br> /var/log/pki-ca/debug but a bigger chunk would be needed.<br> <br> ><br> > *[root@caer ~]# tail -f /var/log/httpd/error_log*<br> <div><div class="h5">> [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: WSGI WSGIExecutioner.__call__:<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: raw: user_show(u'admin',<br> > rights=False, all=False, raw=False, version=u'2.46')<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: user_show(u'admin', rights=False,<br> > all=False, raw=False, version=u'2.46')<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: get_memberof:<br> > entry_dn=uid=admin,cn=users,cn=accounts,dc=teloip,dc=net<br> > memberof=[ipapython.dn.DN('cn=admins,cn=groups,cn=accounts,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=replication<br> > administrators,cn=privileges,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=add<br> > replication agreements,cn=permissions,cn=pbac,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=modify replication<br> > agreements,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=remove<br> > replication agreements,cn=permissions,cn=pbac,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=unlock user<br> > accounts,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=manage<br> > service keytab,cn=permissions,cn=pbac,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=trust admins,cn=groups,cn=accounts,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=host enrollment,cn=privileges,cn=pbac,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=manage host<br> > keytab,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=enroll a<br> > host,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=add host<br> > password,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=add<br> > krbprincipalname to a host,cn=permissions,cn=pbac,dc=teloip,dc=net')]<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: get_memberof: result<br> > direct=[ipapython.dn.DN('cn=admins,cn=groups,cn=accounts,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=trust admins,cn=groups,cn=accounts,dc=teloip,dc=net')]<br> > indirect=[ipapython.dn.DN('cn=replication<br> > administrators,cn=privileges,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=add<br> > replication agreements,cn=permissions,cn=pbac,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=modify replication<br> > agreements,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=remove<br> > replication agreements,cn=permissions,cn=pbac,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=unlock user<br> > accounts,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=manage<br> > service keytab,cn=permissions,cn=pbac,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=host enrollment,cn=privileges,cn=pbac,dc=teloip,dc=net'),<br> > ipapython.dn.DN('cn=manage host<br> > keytab,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=enroll a<br> > host,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=add host<br> > password,cn=permissions,cn=pbac,dc=teloip,dc=net'), ipapython.dn.DN('cn=add<br> > krbprincipalname to a host,cn=permissions,cn=pbac,dc=teloip,dc=net')]<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: INFO: <a href="mailto:admin@TELOIP.NET">admin@TELOIP.NET</a><br> </div></div>> <mailto:<a href="mailto:admin@TELOIP.NET">admin@TELOIP.NET</a>>: user_show(u'admin', rights=False, all=False,<br> <span class="">> raw=False, version=u'2.46'): SUCCESS<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: response: entries returned 1<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: Destroyed connection context.ldap2<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: reading ccache data from file<br> > "/var/run/ipa_memcached/krbcc_13554"<br> > [Thu Jul 21 11:00:38 2016] [error] ipa: DEBUG: store session:<br> > session_id=10c5de02f8ae0f3969b96ef0f2e3a96d start_timestamp=2016-07-21T10:43:26<br> > access_timestamp=2016-07-21T11:00:38 expiration_timestamp=2016-07-21T11:20:38<br> ><br> </span>> *[root@caer ~]# tail -f /var/log/pki-ca/debug*<br> <span class="">> [21/Jul/2016:11:08:29][CertStatusUpdateThread]: RequestQueue: curReqId: 9990001<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: getElementAt: 1 mTop 107<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: reverse direction getting index 4<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: RequestQueue: curReqId: 112<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: RequestQueue: getLastRequestId :<br> > returning value 112<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: Repository: mLastSerialNo: 112<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: Serial numbers left in range:<br> > 9989888<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: Last Serial Number: 112<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: Serial Numbers available: 9989888<br> > [21/Jul/2016:11:08:29][CertStatusUpdateThread]: request checkRanges done<br> ><br> </span>> *[root@caer ~]# tail -f /var/log/pki-ca/transactions*<br> <div><div class="h5">> 6563.CRLIssuingPoint-MasterCRL - [20/Jul/2016:17:00:00 EDT] [20] [1] CRL Update<br> > completed. CRL ID: MasterCRL CRL Number: 8,912 last update time: 7/20/16 5:00 PM<br> > next update time: 7/20/16 9:00 PM Number of entries in the CRL: 11 time: 25 CRL<br> > time: 25 delta CRL time: 0 (0,0,0,0,0,0,0,8,17,0,0,25,25)<br> > 6563.CRLIssuingPoint-MasterCRL - [20/Jul/2016:21:00:00 EDT] [20] [1] CRL update<br> > started. CRL ID: MasterCRL CRL Number: 8,913 Delta CRL Enabled: false CRL<br> > Cache Enabled: true Cache Recovery Enabled: true Cache Cleared: false Cache:<br> > 11,0,0,0<br> > 6563.CRLIssuingPoint-MasterCRL - [20/Jul/2016:21:00:00 EDT] [20] [1] CRL Update<br> > completed. CRL ID: MasterCRL CRL Number: 8,913 last update time: 7/20/16 9:00 PM<br> > next update time: 7/21/16 1:00 AM Number of entries in the CRL: 11 time: 11 CRL<br> > time: 11 delta CRL time: 0 (0,0,0,0,0,0,0,6,5,0,0,11,11)<br> > 6563.CRLIssuingPoint-MasterCRL - [21/Jul/2016:01:00:00 EDT] [20] [1] CRL update<br> > started. CRL ID: MasterCRL CRL Number: 8,914 Delta CRL Enabled: false CRL<br> > Cache Enabled: true Cache Recovery Enabled: true Cache Cleared: false Cache:<br> > 11,0,0,0<br> > 6563.CRLIssuingPoint-MasterCRL - [21/Jul/2016:01:00:00 EDT] [20] [1] CRL Update<br> > completed. CRL ID: MasterCRL CRL Number: 8,914 last update time: 7/21/16 1:00 AM<br> > next update time: 7/21/16 5:00 AM Number of entries in the CRL: 11 time: 13 CRL<br> > time: 13 delta CRL time: 0 (0,0,0,0,0,0,0,6,7,0,0,13,13)<br> > 6563.CRLIssuingPoint-MasterCRL - [21/Jul/2016:05:00:00 EDT] [20] [1] CRL update<br> > started. CRL ID: MasterCRL CRL Number: 8,915 Delta CRL Enabled: false CRL<br> > Cache Enabled: true Cache Recovery Enabled: true Cache Cleared: false Cache:<br> > 11,0,0,0<br> > 6563.CRLIssuingPoint-MasterCRL - [21/Jul/2016:05:00:00 EDT] [20] [1] CRL Update<br> > completed. CRL ID: MasterCRL CRL Number: 8,915 last update time: 7/21/16 5:00 AM<br> > next update time: 7/21/16 9:00 AM Number of entries in the CRL: 11 time: 16 CRL<br> > time: 16 delta CRL time: 0 (0,0,0,0,0,0,0,8,8,0,0,16,16)<br> > 6563.CRLIssuingPoint-MasterCRL - [21/Jul/2016:09:00:00 EDT] [20] [1] CRL update<br> > started. CRL ID: MasterCRL CRL Number: 8,916 Delta CRL Enabled: false CRL<br> > Cache Enabled: true Cache Recovery Enabled: true Cache Cleared: false Cache:<br> > 11,0,0,0<br> > 6563.CRLIssuingPoint-MasterCRL - [21/Jul/2016:09:00:00 EDT] [20] [1] CRL Update<br> > completed. CRL ID: MasterCRL CRL Number: 8,916 last update time: 7/21/16 9:00 AM<br> > next update time: 7/21/16 1:00 PM Number of entries in the CRL: 11 time: 13 CRL<br> > time: 13 delta CRL time: 0 (0,0,0,0,0,0,0,6,7,0,0,13,13)<br> > 10657.http-9443-2 - [21/Jul/2016:10:28:19 EDT] [20] [1] renewal reqID 112<br> > fromAgent userID: ipara authenticated by certUserDBAuthMgr is completed DN<br> </div></div>> requested: CN=CA Audit,O=<a href="http://TELOIP.NET" rel="noreferrer" target="_blank">TELOIP.NET</a> <<a href="http://TELOIP.NET" rel="noreferrer" target="_blank">http://TELOIP.NET</a>> cert issued serial<br> > number: 0x47 time: 39<br> ><br> > *[root@caer ~]# tail -f /var/log/pki-ca/selftests.log*<br> <span class="">> 14116.main - [21/Jul/2016:10:58:29 EDT] [20] [1] SelfTestSubsystem: loading all<br> > self test plugin logger parameters<br> > 14116.main - [21/Jul/2016:10:58:29 EDT] [20] [1] SelfTestSubsystem: loading all<br> > self test plugin instances<br> > 14116.main - [21/Jul/2016:10:58:29 EDT] [20] [1] SelfTestSubsystem: loading all<br> > self test plugin instance parameters<br> > 14116.main - [21/Jul/2016:10:58:29 EDT] [20] [1] SelfTestSubsystem: loading<br> > self test plugins in on-demand order<br> > 14116.main - [21/Jul/2016:10:58:29 EDT] [20] [1] SelfTestSubsystem: loading<br> > self test plugins in startup order<br> > 14116.main - [21/Jul/2016:10:58:29 EDT] [20] [1] SelfTestSubsystem: Self test<br> > plugins have been successfully loaded!<br> > 14116.main - [21/Jul/2016:10:58:30 EDT] [20] [1] SelfTestSubsystem: Running self<br> > test plugins specified to be executed at startup:<br> > 14116.main - [21/Jul/2016:10:58:30 EDT] [20] [1] CAPresence: CA is present<br> > 14116.main - [21/Jul/2016:10:58:30 EDT] [20] [1] SystemCertsVerification: system<br> > certs verification failure<br> > 14116.main - [21/Jul/2016:10:58:30 EDT] [20] [1] SelfTestSubsystem: The CRITICAL<br> > self test plugin called selftests.container.instance.SystemCertsVerification<br> > running at startup FAILED!<br> ><br> </span>> But intrestingly, [root@caer ~]# ipa cert-show 1 returns "*ipa: ERROR:<br> <span class="">> Certificate operation cannot be completed: Unable to communicate with CMS (Not<br> </span>> Found)*"<br> <span class="im">><br> > On Thu, Jul 21, 2016 at 10:04 AM, Linov Suresh <<a href="mailto:linov.suresh@gmail.com">linov.suresh@gmail.com</a><br> </span><span class="im">> <mailto:<a href="mailto:linov.suresh@gmail.com">linov.suresh@gmail.com</a>>> wrote:<br> ><br> > This could be because of incorrect trust attributes trust on the<br> > certificates, the current attributes are,<br> ><br> > [root@caer ~]# certutil -L -d /var/lib/pki-ca/alias<br> ><br> > Certificate Nickname Trust Attributes<br> > SSL,S/MIME,JAR/XPI<br> ><br> > ocspSigningCert cert-pki-ca u,u,Pu<br> > subsystemCert cert-pki-ca u,u,Pu<br> > caSigningCert cert-pki-ca CTu,Cu,Cu<br> > subsystemCert cert-pki-ca u,u,Pu<br> > Server-Cert cert-pki-ca u,u,u<br> > auditSigningCert cert-pki-ca u,u,Pu<br> ><br> > I'm going to fix the trust attributes and try.<br> ><br> > On Thu, Jul 21, 2016 at 9:45 AM, Petr Vobornik <<a href="mailto:pvoborni@redhat.com">pvoborni@redhat.com</a><br> </span><div class=""><div class="h5">> <mailto:<a href="mailto:pvoborni@redhat.com">pvoborni@redhat.com</a>>> wrote:<br> ><br> > On 07/20/2016 09:41 PM, Linov Suresh wrote:<br> > > I have restarted the pki-cad and checked if communication with the CA is<br> > > working, but no luck,<br> > ><br> > > Debug logs in /var/log/pki-ca do not have anything unusual. Can you think of<br> > > anything other than this?<br> ><br> > /var/log/httpd/error_log when /etc/ipa.conf is set to debug=true<br> > <a href="https://www.freeipa.org/page/Troubleshooting#ipa_command_crashes_or_returns_no_data" rel="noreferrer" target="_blank">https://www.freeipa.org/page/Troubleshooting#ipa_command_crashes_or_returns_no_data</a><br> ><br> > /var/log/pki-ca/debug<br> > /var/log/pki-ca/transactions<br> > /var/log/pki-ca/selftest.log<br> ><br> > ><br> > > [root@caer ~]# ipa cert-show 1<br> > > Certificate: MIIDizCCAnOgAwIBAgIBATANBgkqhkiG9w0BAQsFADA1MRMwEQYDVQQKEwpURUxP<br> > > SVAuTkVUMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTExMjE0<br> > > MjIyOTU2WhcNMTkxMjE0MjIyOTU2WjA1MRMwEQYDVQQKEwpURUxPSVAuTkVUMR4w<br> > > HAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUA<br> > > A4IBDwAwggEKAoIBAQDegJ5XVR0JSc76s9FPkkkuug3PtZi5Ysad0Dr1I5ngjTOV<br> > > ctm/P7buk2g8LxBSXLO+7Rq7PTtTD5AJ7vQjrv2RtoYTPdRebAuukTKd6RhtYa5e<br> > > tX7z0DBjQ8g9Erqf9GzLxlQqim8ZvscATBhf6MLb5cXA/pWHYuE2j0OlnrSNWqsb<br> > > UgwMsM73RlsNACsvLUk4iJY0wuxj4L/0EBQWUPGr8qBk3QBST4LDnInuvvGsAFNe<br> > > tyebENMRWnEaDFYKPapACrtKAl3hQNDB7dVGk64Dd7paXss9F8vgVnofgFpjiJs7<br> > > 5DNtKhKxzFQyanINU+uuIVs/CNIO3jV9I26ems2zAgMBAAGjgaUwgaIwHwYDVR0j<br> > > BBgwFoAUx5/ZpwOfXZQ5KNwC42cBW+Y+bGIwDwYDVR0TAQH/BAUwAwEB/zAOBgNV<br> > > HQ8BAf8EBAMCAcYwHQYDVR0OBBYEFMef2acDn12UOSjcAuNnAVvmPmxiMD8GCCsG<br> > > AQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2NhZXIudGVsb2lwLm5ldDo5<br> > > MTgwL2NhL29jc3AwDQYJKoZIhvcNAQELBQADggEBAHGElN0OcepokvNIN8f4mvTj<br> > > kL9wcuZwbbX9gZGdKSZf5Redp4tsJW8EJCy8yu9F5U+Ym3RcvJBiby9gHCVVbW+y<br> > > 5IgziiJ3kd4UlVJCDVKtbdq62bODcatFsMH8wJSMW6Cw096RyfGgu2qSyXzdZ2xV<br> > > nMovO3+Eaz2n0x4ZvaEj9Ixym/KI+QPCAL7gPkK36X4JYgM3CXUCYCN/QJY/psFt<br> > > e+121ubSZX5u3Yntux4KziJ3cx9wZ74iKff1BOVxOCi0JyLn2k15bvBXGvxxgmhK<br> > > b8YUVbDJDb9oWSbixl/TQI9PZysXYIvBNJM8h+HRKIJksKGQhKOERzrYoqABt30=<br> > > Subject: CN=Certificate Authority,O=<a href="http://TELOIP.NET" rel="noreferrer" target="_blank">TELOIP.NET</a> <<a href="http://TELOIP.NET" rel="noreferrer" target="_blank">http://TELOIP.NET</a>><br> > <<a href="http://TELOIP.NET" rel="noreferrer" target="_blank">http://TELOIP.NET</a>><br> > > Issuer: CN=Certificate Authority,O=<a href="http://TELOIP.NET" rel="noreferrer" target="_blank">TELOIP.NET</a> <<a href="http://TELOIP.NET" rel="noreferrer" target="_blank">http://TELOIP.NET</a>><br> > <<a href="http://TELOIP.NET" rel="noreferrer" target="_blank">http://TELOIP.NET</a>><br> > > Not Before: Wed Dec 14 22:29:56 2011 UTC<br> > > Not After: Sat Dec 14 22:29:56 2019 UTC<br> > > Fingerprint (MD5): c9:27:1d:84:4c:2c:97:38:a4:7b:9a:c0:78:3e:7f:7a<br> > > Fingerprint (SHA1): ce:d7:11:84:70:dd:cb:4e:e2:08:f5:c0:ac:ff:b3:c5:bb:81:77:7e<br> > > Serial number (hex): 0x1<br> > > Serial number: 1<br> > > [root@caer ~]#<br> > ><br> > > *ca-error: Internal error: no response to<br> > ><br> > "<a href="http://caer.teloip.net:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=63&renewal=true&xml=true" rel="noreferrer" target="_blank">http://caer.teloip.net:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=63&renewal=true&xml=true</a>".<br> > > *<br> > ><br> > ><br> > ><br> > > On Wed, Jul 20, 2016 at 2:22 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>><br> </div></div><span class="im">> > <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>>> wrote:<br> > ><br> > > Linov Suresh wrote:<br> > ><br> </span><div class=""><div class="h5">> > Thanks for your help Rob, I will create a separate thread for IPA<br> > > replication issue. But we are still getting<br> > > *<br> > > *<br> > > *ca-error: Internal error: no response to<br> > > "<a href="http://caer.teloip.net:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=60&renewal=true&xml=true" rel="noreferrer" target="_blank">http://caer.teloip.net:9180/ca/ee/ca/profileSubmit?profileId=caServerCert&serial_num=60&renewal=true&xml=true</a>".*<br> > ><br> > > Could you please help us to fix this?<br> > ><br> > ><br> > > I think your CA isn't quite fixed yet. I'd restart pki-cad then do something<br> > > like: ipa cert-show 1<br> > ><br> > > You should get back a cert (doesn't really matter what cert).<br> > ><br> > > Otherwise I'd check the CA debug log somewhere in /var/log/pki<br> > ><br> > > rob<br> > ><br> <br> <br> </div></div><span class=""><font color="#888888">--<br> Petr Vobornik<br> </font></span></blockquote></div><br></div></div>