<div dir="ltr"><div dir="ltr"><div><br></div><div><b>I didn't use any file for the installation, i used the basic questions with their answers. This is a replica of how things went.</b></div><div><br></div><div><br></div><div>[root@ocsp01 ~]# pkispawn -s OCSP -vvv</div><div><br></div><div>IMPORTANT:</div><div><br></div><div> Interactive installation currently only exists for very basic deployments!</div><div><br></div><div> For example, deployments intent upon using advanced features such as:</div><div><br></div><div> * Cloning,</div><div> * Elliptic Curve Cryptography (ECC),</div><div> * External CA,</div><div> * Hardware Security Module (HSM),</div><div> * Subordinate CA,</div><div> * etc.,</div><div><br></div><div> must provide the necessary override parameters in a separate</div><div> configuration file.</div><div><br></div><div> Run 'man pkispawn' for details.</div><div><br></div><div>Tomcat:</div><div> Instance [pki-tomcat]: testinstance</div><div> HTTP port [8080]: </div><div> Secure HTTP port [8443]: </div><div> AJP port [8009]: </div><div> Management port [8005]: </div><div><br></div><div>Administrator:</div><div> Username [ocspadmin]: </div><div> Password: </div><div> Verify password: </div><div> Import certificate (Yes/No) [Y]? </div><div> Import certificate from [/root/.dogtag/testinstance/ca_admin.cert]: /root/ca_admin.cert</div><div><br></div><div>Directory Server:</div><div> Hostname [ocsp01.pki.ccpsd.corp]: ca01 </div><div> Use a secure LDAPS connection (Yes/No/Quit) [N]? </div><div> LDAP Port [389]: </div><div> Bind DN [cn=Directory Manager]: </div><div> Password: </div><div> Base DN [o=testinstance-OCSP]: </div><div><br></div><div>Security Domain:</div><div> Hostname [ocsp01.pki.ccpsd.corp]: ca01</div><div> Secure HTTP port [8443]: </div><div> Name: Test Instance Security Domain</div><div> Username [caadmin]: </div><div> Password: </div><div><br></div><div>Begin installation (Yes/No/Quit)? Yes</div><div><br></div><div><br></div><div><b>As you can see, the LDAP server was up, it asked for user and password and went to the next step. The security domain, when i indicated the host of the CA, it was detected, so that was good also.</b></div><div><br></div><div><b>If you take a look to the /etc/sysconfig/pki/tomcat/testinstance/ocsp/deployment.cfg</b></div><div>[DEFAULT]</div><div>pki_instance_name = testinstance</div><div>pki_admin_password = XXXXXXXX</div><div>pki_backup_password = XXXXXXXX</div><div>pki_client_database_password = XXXXXXXX</div><div>pki_client_pin = XXXXXXXX</div><div>pki_client_pkcs12_password = XXXXXXXX</div><div>pki_clone_pkcs12_password = XXXXXXXX</div><div>pki_ds_password = XXXXXXXX</div><div>pki_external_pkcs12_password = XXXXXXXX</div><div>pki_pkcs12_password = XXXXXXXX</div><div>pki_one_time_pin = XXXXXXXX</div><div>pki_pin = XXXXXXXX</div><div>pki_replication_password = XXXXXXXX</div><div>pki_security_domain_password = XXXXXXXX</div><div>pki_server_pkcs12_password = XXXXXXXX</div><div>pki_token_password = XXXXXXXX</div><div><br></div><div>[OCSP]</div><div>pki_http_port = 8080</div><div>pki_https_port = 8443</div><div>pki_ajp_port = 8009</div><div>pki_tomcat_server_port = 8005</div><div>pki_admin_uid = ocspadmin</div><div>pki_admin_password = XXXXXXXX</div><div>pki_backup_password = XXXXXXXX</div><div>pki_client_database_password = XXXXXXXX</div><div>pki_client_pkcs12_password = XXXXXXXX</div><div>pki_import_admin_cert = True</div><div>pki_admin_cert_file = /root/ca_admin.cert</div><div>pki_ds_hostname = ca01</div><div>pki_ds_ldap_port = 389</div><div>pki_ds_bind_dn = cn=Directory Manager</div><div>pki_ds_password = XXXXXXXX</div><div>pki_ds_base_dn = o=testinstance-OCSP</div><div>pki_security_domain_hostname = ca01</div><div>pki_security_domain_https_port = 8443</div><div>pki_security_domain_name = Test Instance Security Domain</div><div>pki_security_domain_user = caadmin</div><div>pki_security_domain_password = XXXXXXXX</div><div>pki_client_pin = XXXXXXXX</div><div>pki_clone_pkcs12_password = XXXXXXXX</div><div>pki_external_pkcs12_password = XXXXXXXX</div><div>pki_pkcs12_password = XXXXXXXX</div><div>pki_one_time_pin = XXXXXXXX</div><div>pki_pin = XXXXXXXX</div><div>pki_replication_password = XXXXXXXX</div><div>pki_server_pkcs12_password = XXXXXXXX</div><div>pki_token_password = XXXXXXXX</div><div><br></div><div><b>The CA deployment file is this</b></div><div>[DEFAULT]</div><div>pki_instance_name = testinstance</div><div>pki_admin_password = XXXXXXXX</div><div>pki_backup_password = XXXXXXXX</div><div>pki_client_database_password = XXXXXXXX</div><div>pki_client_pin = XXXXXXXX</div><div>pki_client_pkcs12_password = XXXXXXXX</div><div>pki_clone_pkcs12_password = XXXXXXXX</div><div>pki_ds_password = XXXXXXXX</div><div>pki_external_pkcs12_password = XXXXXXXX</div><div>pki_pkcs12_password = XXXXXXXX</div><div>pki_one_time_pin = XXXXXXXX</div><div>pki_pin = XXXXXXXX</div><div>pki_replication_password = XXXXXXXX</div><div>pki_security_domain_password = XXXXXXXX</div><div>pki_server_pkcs12_password = XXXXXXXX</div><div>pki_token_password = XXXXXXXX</div><div><br></div><div>[CA]</div><div>pki_http_port = 8080</div><div>pki_https_port = 8443</div><div>pki_ajp_port = 8009</div><div>pki_tomcat_server_port = 8005</div><div>pki_admin_uid = caadmin</div><div>pki_admin_password = XXXXXXXX</div><div>pki_backup_password = XXXXXXXX</div><div>pki_client_database_password = XXXXXXXX</div><div>pki_client_pkcs12_password = XXXXXXXX</div><div>pki_import_admin_cert = False</div><div>pki_client_admin_cert = /root/.dogtag/testinstance/ca_admin.cert</div><div>pki_ds_hostname = ca01.pki.ccpsd.corp</div><div>pki_ds_ldap_port = 389</div><div>pki_ds_bind_dn = cn=Directory Manager</div><div>pki_ds_password = XXXXXXXX</div><div>pki_ds_base_dn = o=testinstance-CA</div><div>pki_security_domain_name = Test Instance Security Domain</div><div>pki_client_pin = XXXXXXXX</div><div>pki_clone_pkcs12_password = XXXXXXXX</div><div>pki_external_pkcs12_password = XXXXXXXX</div><div>pki_pkcs12_password = XXXXXXXX</div><div>pki_one_time_pin = XXXXXXXX</div><div>pki_pin = XXXXXXXX</div><div>pki_replication_password = XXXXXXXX</div><div>pki_security_domain_password = XXXXXXXX</div><div>pki_server_pkcs12_password = XXXXXXXX</div><div>pki_token_password = XXXXXXXX</div><div><br></div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><br></div><div><br></div><div><table style="border-spacing:0px;border-collapse:collapse;color:rgb(51,51,51);line-height:1.4;font-family:"Lucida Console",Monaco,monospace;font-size:10.4px"><tbody><tr><td valign="top" style="padding:0px 12px 0px 0px"><img src="https://mysignature.io/images/photos/305145143e15ed99571bf9733bfd8475.jpg" style="border: 0px; vertical-align: middle; width: 100px; border-radius: 0%;"></td><td valign="top" style="padding:0px 0px 0px 12px;font-size:1em;font-family:"Lucida Console",Monaco,monospace;border-left:1px solid rgb(61,133,198)"><div><span style="font-weight:600;font-size:1.5em;color:rgb(61,133,198)">Jonathan Montero</span></div><div style="line-height:1em"> </div><div>IT Professional | IT Trainer</div><div><div><span style="font-weight:600;color:rgb(61,133,198)">M:</span> <a href="tel:809-609-3003" style="background-color:transparent;color:rgb(0,0,0)" target="_blank">809-609-3003</a></div><div><span style="font-weight:600;color:rgb(61,133,198)">S:</span> <a style="background-color:transparent;color:rgb(0,0,0)">tuxmontero</a></div><div><span style="font-weight:600;font-size:1em;color:rgb(61,133,198)">E:</span> <a href="mailto:jmrxto@gmail.com" style="background-color:transparent;color:rgb(0,0,0)" target="_blank">jmrxto@gmail.com</a></div><div><span style="font-weight:600;color:rgb(61,133,198)">A: </span>Santo Domingo, DR</div></div><div style="line-height:1em"> </div><div><a href="http://jonathanmontero.com/" style="background-color:transparent;color:rgb(61,133,198)" target="_blank">jonathanmontero.com</a></div><div style="line-height:1em"> </div><table style="border-spacing:0px;border-collapse:collapse;background-color:transparent"><tbody><tr><td style="padding:0px;font-family:Arial"><a href="https://www.linkedin.com/in/monterojonathan" style="background-color:transparent;color:rgb(51,122,183);line-height:0;margin:0px 5px 0px 0px;display:inline-block;padding:0px" target="_blank"><img width="27px" src="https://mysignature.io/images/socials/89d70f7d4de8478ad2b7119b7e8477d1.png" style="border: 0px; vertical-align: middle;"></a><a href="https://twitter.com/tuxmontero" style="background-color:transparent;color:rgb(51,122,183);line-height:0;margin:0px 5px 0px 0px;display:inline-block;padding:0px" target="_blank"><img width="27px" src="https://mysignature.io/images/socials/dc706095d52a25f1f36c1012c67e93a2.png" style="border: 0px; vertical-align: middle;"></a><a href="https://www.facebook.com/jmrxto" style="background-color:transparent;color:rgb(51,122,183);line-height:0;margin:0px 5px 0px 0px;display:inline-block;padding:0px" target="_blank"><img width="27px" src="https://mysignature.io/images/socials/a6f0bf723e5819f4e3fa70e5c44121c0.png" style="border: 0px; vertical-align: middle;"></a><a href="https://github.com/tuxmontero" style="background-color:transparent;color:rgb(51,122,183);line-height:0;margin:0px 5px 0px 0px;display:inline-block;padding:0px" target="_blank"><img width="27px" src="https://mysignature.io/images/socials/898785292fefff9ccce988a5cf544d23.png" style="border: 0px; vertical-align: middle;"></a></td></tr></tbody></table></td></tr></tbody></table></div><div><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Mar 1, 2019 at 8:41 PM Marc Sauton <<a href="mailto:msauton@redhat.com">msauton@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">Make sure in the OCSP's pkispawn config file, the security domain configured for the CA, and make sure that CA and its LDAP server are up.<div>Or may be something is missing in that OCSP's pkispawn config file, or incorrect.<br><div>There may be more hints into the /var/log/pki/pki-ocsp/ocsp/debug file, like may be a private key could not be unlocked (file or hsm)</div><div>Thanks,</div><div>M.</div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Mar 1, 2019 at 5:24 AM Jonathan Montero <<a href="mailto:jmrxto@gmail.com" target="_blank">jmrxto@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi Guys, i have a case that i haven't been able to solve. I'm not too experienced in dogtag, but believe me, i'm doing my best. I installed a CA in server1 and OSCP in server2. Server1 is working fine as CA. When i "pkispawn -s OCSP -vvv" in server 2, things go fine until the last moment.</div><div><br></div><div>pkispawn : INFO ....... executing 'systemctl daemon-reload'</div><div>pkispawn : INFO ....... executing 'systemctl start pki-tomcatd@testinstance.service'</div><div>pkispawn : DEBUG ........... No connection - server may still be down</div><div>pkispawn : DEBUG ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused'))</div><div>pkispawn : DEBUG ........... No connection - server may still be down</div><div>pkispawn : DEBUG ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused'))</div><div>pkispawn : DEBUG ........... No connection - server may still be down</div><div>pkispawn : DEBUG ........... No connection - exception thrown: ('Connection aborted.', error(111, 'Connection refused'))</div><div>pkispawn : DEBUG ........... No connection - server may still be down</div><div>pkispawn : DEBUG ........... No connection - exception thrown: 500 Server Error: Internal Server Error</div><div>pkispawn : DEBUG ........... No connection - server may still be down</div><div><br></div><div><b>firewalld is down and disabled, same with iptables, same with selinux in both servers<br></b></div><div><div dir="ltr" class="gmail-m_-1414331412992266310gmail-m_5902276243633232591gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><br></div><div><br></div><div>I'm using default values (most of them) before going to production.</div><div><br></div><div>what am i missing here?</div><div><br></div><div><table style="border-spacing:0px;border-collapse:collapse;color:rgb(51,51,51);line-height:1.4;font-family:"Lucida Console",Monaco,monospace;font-size:10.4px"><tbody><tr><td valign="top" style="padding:0px 12px 0px 0px"><img src="https://mysignature.io/images/photos/305145143e15ed99571bf9733bfd8475.jpg" style="border: 0px; vertical-align: middle; width: 100px; border-radius: 0%;"></td><td valign="top" style="padding:0px 0px 0px 12px;font-size:1em;font-family:"Lucida Console",Monaco,monospace;border-left:1px solid rgb(61,133,198)"><div><span style="font-weight:600;font-size:1.5em;color:rgb(61,133,198)">Jonathan Montero</span></div><div style="line-height:1em"> </div><div>IT Professional | IT Trainer</div><div><div><span style="font-weight:600;color:rgb(61,133,198)">M:</span> <a href="tel:809-609-3003" style="background-color:transparent;color:rgb(0,0,0)" target="_blank">809-609-3003</a></div><div><span style="font-weight:600;color:rgb(61,133,198)">S:</span> <a style="background-color:transparent;color:rgb(0,0,0)">tuxmontero</a></div><div><span style="font-weight:600;font-size:1em;color:rgb(61,133,198)">E:</span> <a href="mailto:jmrxto@gmail.com" style="background-color:transparent;color:rgb(0,0,0)" target="_blank">jmrxto@gmail.com</a></div><div><span style="font-weight:600;color:rgb(61,133,198)">A: </span>Santo Domingo, DR</div></div><div style="line-height:1em"> </div><div><a href="http://jonathanmontero.com/" style="background-color:transparent;color:rgb(61,133,198)" target="_blank">jonathanmontero.com</a></div><div style="line-height:1em"> </div><table style="border-spacing:0px;border-collapse:collapse;background-color:transparent"><tbody><tr><td style="padding:0px;font-family:Arial"><a href="https://www.linkedin.com/in/monterojonathan" style="background-color:transparent;color:rgb(51,122,183);line-height:0;margin:0px 5px 0px 0px;display:inline-block;padding:0px" target="_blank"><img width="27px" src="https://mysignature.io/images/socials/89d70f7d4de8478ad2b7119b7e8477d1.png" style="border: 0px; vertical-align: middle;"></a><a href="https://twitter.com/tuxmontero" style="background-color:transparent;color:rgb(51,122,183);line-height:0;margin:0px 5px 0px 0px;display:inline-block;padding:0px" target="_blank"><img width="27px" src="https://mysignature.io/images/socials/dc706095d52a25f1f36c1012c67e93a2.png" style="border: 0px; vertical-align: middle;"></a><a href="https://www.facebook.com/jmrxto" style="background-color:transparent;color:rgb(51,122,183);line-height:0;margin:0px 5px 0px 0px;display:inline-block;padding:0px" target="_blank"><img width="27px" src="https://mysignature.io/images/socials/a6f0bf723e5819f4e3fa70e5c44121c0.png" style="border: 0px; vertical-align: middle;"></a><a href="https://github.com/tuxmontero" style="background-color:transparent;color:rgb(51,122,183);line-height:0;margin:0px 5px 0px 0px;display:inline-block;padding:0px" target="_blank"><img width="27px" src="https://mysignature.io/images/socials/898785292fefff9ccce988a5cf544d23.png" style="border: 0px; vertical-align: middle;"></a></td></tr></tbody></table></td></tr></tbody></table></div><div><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div> _______________________________________________<br> Pki-users mailing list<br> <a href="mailto:Pki-users@redhat.com" target="_blank">Pki-users@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/pki-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pki-users</a></blockquote></div> </blockquote></div>