<div dir="ltr"><div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default">I'm hoping to get a lead on this issue from a few months back - I work with John. Maybe a more narrow question will get us somewhere. When ipa-ca-install is comparing the URI in the .gpg file to the "available subsystems", what does that mean? How do I know what the correct URLs for my "available subsystems" actually are? I reviewed the logs, and the site & port seem like they're probably right to me, unless they need a more specific path or something. Maybe it could be having trouble authenticating? I don't know why that would be.<br><br></div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default">Is it safe to decrypt the .gpg file, re-encrypt it, and try running it again, if I knew what edits to make, to the URI?<br><br></div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default">-Jack Eidsness<br></div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default"><br></div><br> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><hr> <ul><li><i>From</i>: John Bowman <john bowman zayo com></li><li><i>To</i>: freeipa-users redhat com</li><li><i>Subject</i>: [Freeipa-users] Clone URI does not match available subsystems ?</li><li><i>Date</i>: Wed, 17 Aug 2016 10:41:38 -0500</li></ul> <hr> <span style="font-size:12.8px">Howdy!</span><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Trying to figure out how to get past the error: Clone URI does not match available subsystems when running ipa-ca-install on new ipa server.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">A little background. We have 3 FreeIPA 3.0.0 servers running on RHEL 6.7. We just recently (within the last month) added a new FreeIPA 4.2 server replica running on RHEL 7.2 at a new location which will hopefully be the start of replacing all the 3.0.0 instances.</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Unfortunately during the 4.2 install the --setup-ca was failing so we decided to install without it to make sure everything else worked. And it did everything seems to be replicating properly and all is good. </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Now its time to add the ca replication to the new server but its failing with that error. </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Command output:</div><div style="font-size:12.8px"><div># ipa-ca-install --skip-conncheck /var/lib/ipa/replica-info-new-<wbr>server.example.com.gpg</div><div>Directory Manager (existing master) password:</div><div><br></div><div>Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds</div><div> [1/22]: creating certificate server user</div><div> [2/22]: configuring certificate server instance</div><div>ipa.ipaserver.install.cainstan<wbr>ce.CAInstance: CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmp7cBK9P'' returned non-zero exit status 1</div><div>ipa.ipaserver.install.cainstan<wbr>ce.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:</div><div>ipa.ipaserver.install.cainstan<wbr>ce.CAInstance: CRITICAL /var/log/pki-ca-install.log</div><div>ipa.ipaserver.install.cainstan<wbr>ce.CAInstance: CRITICAL /var/log/pki/pki-tomcat</div><div> [error] RuntimeError: CA configuration failed.</div><div><br></div><div>Your system may be partly configured.</div><div>Run /usr/sbin/ipa-server-install --uninstall to clean up.</div><div><br></div><div>CA configuration failed.</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">ipareplica-ca-install.log output:</div><div style="font-size:12.8px"><div>2016-08-17T15:25:52Z DEBUG stdout=Log file: /var/log/pki/pki-ca-spawn.2016<wbr>0817092533.log</div><div>Loading deployment configuration from /tmp/tmp7cBK9P.</div><div>Installing CA into /var/lib/pki/pki-tomcat.</div><div>Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-<wbr>tomcat/ca/deployment.cfg.</div><div><br></div><div>Installation failed.</div><div><br></div><div><br></div><div>2016-08-17T15:25:52Z DEBUG stderr=/usr/lib/python2.7/site<wbr>-packages/urllib3/connectionpo<wbr>ol.py:769: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: <a rel="nofollow" href="https://urllib3.readthedocs.org/en/latest/security.h" target="_blank">https://urllib3.readthedo<wbr>cs.org/en/latest/security.h</a></div><div>tml</div><div> InsecureRequestWarning)</div><div>pkispawn : WARNING ....... unable to validate security domain user/password through REST interface. Interface not available</div><div>pkispawn : ERROR ....... Exception from Java Configuration Servlet: 400 Client Error: Bad Request</div><div>pkispawn : ERROR ....... ParseError: not well-formed (invalid token): line 1, column 0: {"Attributes":{"Attribute":[]}<wbr>,"ClassName"</div><div>:"<a href="http://com.netscape.certsrv.base.Ba" target="_blank">com.netscape.certsrv.base.Ba</a><wbr>dRequestException","Code":400,<wbr>"Message":"Clone URI does not match available subsystems: <a rel="nofollow" href="https://master.idm.example.com/" target="_blank">https://master.idm<wbr>.example.com:443</a>"}</div><div><br></div><div>2016-08-17T15:25:52Z CRITICAL Failed to configure CA instance: Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmp7cBK9P'' returned n</div><div>on-zero exit status 1</div><div>2016-08-17T15:25:52Z CRITICAL See the installation logs and the following files/directories for more information:</div><div>2016-08-17T15:25:52Z CRITICAL /var/log/pki-ca-install.log</div><div>2016-08-17T15:25:52Z CRITICAL /var/log/pki/pki-tomcat</div><div>2016-08-17T15:25:52Z DEBUG Traceback (most recent call last):</div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/service.<wbr>py", line 418, in start_creation</div><div> run_step(full_msg, method)</div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/service.<wbr>py", line 408, in run_step</div><div> method()</div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/cainstan<wbr>ce.py", line 622, in __spawn_instance</div><div> DogtagInstance.spawn_instance(<wbr>self, cfg_file)</div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/dogtagin<wbr>stance.py", line 201, in spawn_instance</div><div> self.handle_setup_error(e)</div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/dogtagin<wbr>stance.py", line 465, in handle_setup_error</div><div> raise RuntimeError("%s configuration failed." % self.subsystem)</div><div>RuntimeError: CA configuration failed.</div><div><br></div><div>2016-08-17T15:25:52Z DEBUG [error] RuntimeError: CA configuration failed.</div><div>2016-08-17T15:25:52Z DEBUG File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/installu<wbr>tils.py", line 732, in run_script</div><div> return_value = main_function()</div><div><br></div><div> File "/sbin/ipa-ca-install", line 202, in main</div><div> install_replica(safe_options, options, filename)</div><div><br></div><div> File "/sbin/ipa-ca-install", line 150, in install_replica</div><div> ca.install(True, config, options)</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/ca.py", line 114, in install</div><div> install_step_0(standalone, replica_config, options)</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/ca.py", line 138, in install_step_0</div><div> ra_p12=getattr(options, 'ra_p12', None))</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/cainstan<wbr>ce.py", line 1545, in install_replica_ca</div><div> subject_base=config.subject_ba<wbr>se)</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/cainstan<wbr>ce.py", line 488, in configure_instance</div><div> self.start_creation(runtime=21<wbr>0)</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/service.<wbr>py", line 418, in start_creation</div><div> run_step(full_msg, method)</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/service.<wbr>py", line 408, in run_step</div><div> method()</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/cainstan<wbr>ce.py", line 622, in __spawn_instance</div><div> DogtagInstance.spawn_instance(<wbr>self, cfg_file)</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/dogtagin<wbr>stance.py", line 201, in spawn_instance</div><div> self.handle_setup_error(e)</div><div><br></div><div> File "/usr/lib/python2.7/site-packa<wbr>ges/ipaserver/install/dogtagin<wbr>stance.py", line 465, in handle_setup_error</div><div> raise RuntimeError("%s configuration failed." % self.subsystem)</div><div><br></div><div>2016-08-17T15:25:52Z DEBUG The ipa-ca-install command failed, exception: RuntimeError: CA configuration failed.</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">****</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">I've tried running the pkispawn command manually by using the deployment.cfg file but it gives the same error:</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><div># pkidestroy -s CA -i pki-tomcat</div><div>Log file: /var/log/pki/pki-ca-destroy.20<wbr>160817093402.log</div><div>Loading deployment configuration from /var/lib/pki/pki-tomcat/ca/reg<wbr>istry/ca/deployment.cfg.</div><div>Uninstalling CA from /var/lib/pki/pki-tomcat.</div><div>pkidestroy : WARNING ....... this 'CA' entry will NOT be deleted from security domain 'unknown'!</div><div>pkidestroy : ERROR ....... No security domain defined.</div><div>If this is an unconfigured instance, then that is OK.</div><div>Otherwise, manually delete the entry from the security domain master.</div><div><br></div><div>Uninstallation complete.</div><div><br></div><div># /usr/sbin/pkispawn -s CA -f /tmp/replica_file</div><div>Log file: /var/log/pki/pki-ca-spawn.2016<wbr>0817093444.log</div><div>Loading deployment configuration from /tmp/replica_file.</div><div>/usr/lib/python2.7/site-packag<wbr>es/urllib3/connectionpool.py:7<wbr>69: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: <a rel="nofollow" href="https://urllib3.readthedocs.org/en/latest/security.html" target="_blank">https://urllib3.readthedo<wbr>cs.org/en/latest/security.html</a></div><div> InsecureRequestWarning)</div><div>pkispawn : WARNING ....... unable to validate security domain user/password through REST interface. Interface not available</div><div>Installing CA into /var/lib/pki/pki-tomcat.</div><div>Storing deployment configuration into /etc/sysconfig/pki/tomcat/pki-<wbr>tomcat/ca/deployment.cfg.</div><div>pkispawn : ERROR ....... Exception from Java Configuration Servlet: 400 Client Error: Bad Request</div><div>pkispawn : ERROR ....... ParseError: not well-formed (invalid token): line 1, column 0: {"Attributes":{"Attribute":[]}<wbr>,"ClassName":"com.netscape.cer<wbr>tsrv.base.BadRequestException"<wbr>,"Code":400,"Message":"Clone URI does not match available subsystems: <a rel="nofollow" href="https://master.idm.example.com/" target="_blank">https://master.idm<wbr>.example.com:443</a>"}</div><div><br></div><div>Installation failed.</div></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Any ideas on how to proceed would be much appreciated!</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Thanks!</div><div style="font-size:12.8px">-John</div></div></blockquote><br>-- <br><div class="gmail-m_117598235666432357m_4942288625883898428gmail_signature"><div dir="ltr"><div><div dir="ltr"><p style="margin:0in 0in 0.0001pt"><b><span style="font-size:13pt;font-family:"arial","sans-serif";color:rgb(89,89,89)"><font size="4"> </font><br></span></b></p><p style="margin:0in 0in 0.0001pt"><b><span style="font-size:13pt;font-family:"arial","sans-serif";color:rgb(89,89,89)"><font size="4">Jack Eidsness</font></span><span style="font-size:13pt;font-family:"arial","sans-serif";color:rgb(89,89,89)"><br></span></b></p> <p style="margin:0in 0in 0.0001pt"><b><font size="2"><span style="font-family:"arial","sans-serif";color:rgb(89,89,89)">Developer, NOPSS </span><span style="font-family:"arial","sans-serif";color:rgb(89,89,89)">| Zay</span><span style="font-family:"arial","sans-serif";color:rgb(255,128,0)">o</span><span style="font-family:"arial","sans-serif";color:rgb(89,89,89)"> Group</span></font></b><span style="font-size:10pt;font-family:"arial","sans-serif";color:rgb(34,34,34)"></span></p> <p style="margin:0in 0in 0.0001pt"><font size="2"><span style="font-family:"arial","sans-serif";color:rgb(89,89,89)">13861 Sunrise Valley Dr, Herndon, VA 20171 </span></font><span style="font-size:10pt;font-family:"arial","sans-serif";color:rgb(34,34,34)"></span></p> <p style="margin:0in 0in 0.0001pt"><span style="font-size:10pt;font-family:"arial","sans-serif";color:rgb(89,89,89)">Cell: <a href="tel:%28301%29%20706-3912" value="+13017063912" target="_blank">301.706.3912</a> | </span><a href="mailto:jack.eidsness@zayo.com" target="_blank"><span style="font-size:10pt;font-family:"arial","sans-serif";color:rgb(17,85,204)">jack.eidsness@zayo.com</span></a><span style="font-size:10pt;font-family:"arial","sans-serif";color:rgb(34,34,34)"></span></p></div></div></div></div> </div>