<div dir="ltr">Hi,<div><br></div><div>Trying to install freeIPA and have it a sub-ca of an existing one. Sadly I'm not getting anywhere.</div><div><br></div><div>The version I have installed:</div><div>ipa-server-3.0.0-26.el6_4.4.x86_64</div>
<div><br></div><div>This is what I run:</div><div><br></div><div>ipa-server-install -U -a testtest -p testtest --external_cert_file=/root/server.pem --external_ca_file=/root/cacert.pem -p testtest -P testtest -r <a href="http://MELTWATER.COM">MELTWATER.COM</a> </div>
<div><br></div><div>Which runs this as part of the process:</div><div><br></div><div>/usr/bin/pkisilent ConfigureCA -cs_hostname <a href="http://vagrant-centos-6.meltwater.com">vagrant-centos-6.meltwater.com</a> -cs_port 9445 -client_certdb_dir /tmp/tmp-bOrwSu -client_certdb_pwd testtest -preop_pin 4hdia3IvPvf27Qo7kBbO -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password testtest -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=<a href="http://MELTWATER.COM">MELTWATER.COM</a> -ldap_host <a href="http://vagrant-centos-6.meltwater.com">vagrant-centos-6.meltwater.com</a> -ldap_port 7389 -bind_dn cn="Directory Manager" -bind_password testtest -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd testtest -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name "CN=CA Subsystem,O=<a href="http://MELTWATER.COM">MELTWATER.COM</a>" -ca_subsystem_cert_subject_name "CN=CA Subsystem,O=<a href="http://MELTWATER.COM">MELTWATER.COM</a>" -ca_ocsp_cert_subject_name "CN=OCSP Subsystem,O=<a href="http://MELTWATER.COM">MELTWATER.COM</a>" -ca_server_cert_subject_name CN=<a href="http://vagrant-centos-6.meltwater.com">vagrant-centos-6.meltwater.com</a>,O=<a href="http://MELTWATER.COM">MELTWATER.COM</a> -ca_audit_signing_cert_subject_name "CN=CA Audit,O=<a href="http://MELTWATER.COM">MELTWATER.COM</a>" -ca_sign_cert_subject_name "CN=Certificate Authority,O=<a href="http://MELTWATER.COM">MELTWATER.COM</a>" -external true -ext_ca_cert_file /root/server.pem -ext_ca_cert_chain_file /root/cacert.pem</div>
<div><br></div><div>All this results in this in the log:</div><div><div> <errorString>Failed to create pkcs12 file.</errorString></div></div><div>[snip]</div><div><div>Error in BackupPanel(): updateStatus value is null</div>
<div>ERROR: ConfigureCA: BackupPanel() failure</div><div>ERROR: unable to create CA</div><div><br></div><div>Interestingly adding the option -save_p12 false to the pkisilent command above results in:</div><div><br></div><div>
<div>importCert string: importing with nickname: ipa-ca-agent</div><div>Already logged into to DB</div><div>ERROR:exception importing cert Security library failed to decode certificate package: (-8183) security library: improperly formatted DER-encoded message.</div>
<div>ERROR: AdminCertImportPanel() during cert import</div><div>ERROR: ConfigureCA: AdminCertImportPanel() failure</div><div>ERROR: unable to create CA</div></div><div><br></div><div>While the option change seemed innocent, I honestly don't know if its crucial to the install or not. Anyhow, things don't really progress anyway.</div>
<div><br></div><div>I followed the documentation by signing the /root/ipa.csr with a test, internal CA but somehow I can't get the install to proceed.</div><div><br></div><div><div>[root@vagrant-centos-6 CA]# cat /root/server.pem </div>
<div>Certificate:</div><div> Data:</div><div> Version: 3 (0x2)</div><div> Serial Number: 2 (0x2)</div><div> Signature Algorithm: sha1WithRSAEncryption</div><div> Issuer: C=JP, ST=TK, L=TKK, O=MW, OU=ops, CN=vagrant.localdomain/emailAddress=<a href="mailto:t@t.com">t@t.com</a></div>
<div> Validity</div><div> Not Before: Nov 6 05:12:09 2013 GMT</div><div> Not After : Nov 6 05:12:09 2014 GMT</div><div> Subject: O=<a href="http://MELTWATER.COM">MELTWATER.COM</a>, CN=Certificate Authority</div>
</div><div>[snip]</div><div><div>-----BEGIN CERTIFICATE-----</div><div>MIIDfDCCAmSgAwIBAgIBAjANBgkqhkiG9w0BAQUFADB5MQswCQYDVQQGEwJKUDEL</div><div>MAkGA1UECAwCVEsxDDAKBgNVBAcMA1RLSzELMAkGA1UECgwCTVcxDDAKBgNVBAsM</div><div>
A29wczEcMBoGA1UEAwwTdmFncmFudC5sb2NhbGRvbWFpbjEWMBQGCSqGSIb3DQEJ</div></div><div>[snip]</div><div><br></div><div><div>[root@vagrant-centos-6 CA]# cat /root/cacert.pem </div><div>-----BEGIN CERTIFICATE-----</div><div>MIIDxTCCAq2gAwIBAgIJALIzKeNrwx2lMA0GCSqGSIb3DQEBBQUAMHkxCzAJBgNV</div>
<div>BAYTAkpQMQswCQYDVQQIDAJUSzEMMAoGA1UEBwwDVEtLMQswCQYDVQQKDAJNVzEM</div><div>MAoGA1UECwwDb3BzMRwwGgYD</div></div><div>[snip]</div><div><br></div><div>Any help would be welcome.</div><div><div><span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><br>
</span></div><div><span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><br>
</span></div><div><span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px">-</span><span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px">-</span></div>
<span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px">William Leese</span><br><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
Production Engineer,<br>Operations, Asia Pacific</div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Meltwater Group</div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<div>m: <a value="+818043592539" style="color:rgb(17,85,204)">+81 80 4946 0329</a><br>skype: william.leese1<br></div><div>w: <font color="#000000"><a href="http://meltwater.com/" style="color:rgb(17,85,204)" target="_blank">meltwater.com</a></font></div>
</div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
This email and any attachment(s) is intended for and confidential to the addressee. If you are neither the addressee nor an authorized recipient for the addressee, please notify us of receipt, delete this message from your system and do not use, copy or disseminate the information in, or attached to it, in any way. Our messages are checked for viruses but please note that we do not accept liability for any viruses which may be transmitted in or with this message.</div>
<div><br></div></div>
</div></div>