<div dir="ltr">I was able to solve this by recreating my test CA. I believe the problem was with non-matching Organisation between the CSR and CA - but I dont have the knowledge to know if this is really required.<div><br>
</div><div>Anyhow, things work, despite not having removed the "-----BEGIN CERTIFICATE-----" lines this time around.</div><div><br></div><div>Thanks for the help and sorry for wasting your time!</div></div><div class="gmail_extra">
<br clear="all"><div><div><span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px">-</span><span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px">-</span></div>
<span style="background-color:rgb(255,255,255);color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px">William Leese</span><br><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
Production Engineer,<br>Operations, Asia Pacific</div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Meltwater Group</div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
<div>m: <a value="+818043592539" style="color:rgb(17,85,204)">+81 80 4946 0329</a><br>skype: william.leese1<br></div><div>w: <font color="#000000"><a href="http://meltwater.com/" style="color:rgb(17,85,204)" target="_blank">meltwater.com</a></font></div>
</div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></div><div style="color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">
This email and any attachment(s) is intended for and confidential to the addressee. If you are neither the addressee nor an authorized recipient for the addressee, please notify us of receipt, delete this message from your system and do not use, copy or disseminate the information in, or attached to it, in any way. Our messages are checked for viruses but please note that we do not accept liability for any viruses which may be transmitted in or with this message.</div>
<div><br></div></div>
<br><br><div class="gmail_quote">On Thu, Nov 7, 2013 at 8:36 PM, Petr Viktorin <span dir="ltr"><<a href="mailto:pviktori@redhat.com" target="_blank">pviktori@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 11/07/2013 08:34 AM, William Leese wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
<br>
[root@vagrant-centos-6 CA]# cat /root/server.pem<br>
Certificate:<br>
Data:<br>
Version: 3 (0x2)<br>
Serial Number: 2 (0x2)<br>
Signature Algorithm: sha1WithRSAEncryption<br>
Issuer: C=JP, ST=TK, L=TKK, O=MW, OU=ops,<br></div>
CN=vagrant.localdomain/__<u></u>emailAddress=<a href="mailto:t@t.com" target="_blank">t@t.com</a> <mailto:<a href="mailto:t@t.com" target="_blank">t@t.com</a>><br>
<mailto:<a href="mailto:t@t.com" target="_blank">t@t.com</a> <mailto:<a href="mailto:t@t.com" target="_blank">t@t.com</a>>><div class="im"><br>
<br>
Validity<br>
Not Before: Nov 6 05:12:09 2013 GMT<br>
Not After : Nov 6 05:12:09 2014 GMT<br>
Subject: O=<a href="http://MELTWATER.COM" target="_blank">MELTWATER.COM</a> <<a href="http://MELTWATER.COM" target="_blank">http://MELTWATER.COM</a>><br>
<<a href="http://MELTWATER.COM" target="_blank">http://MELTWATER.COM</a>>, CN=Certificate<br>
<br>
Authority<br>
[snip]<br>
-----BEGIN CERTIFICATE-----<br></div>
MIIDfDCCAmSgAwIBAgIBAjANBgkqhk<u></u>__<u></u>iG9w0BAQUFADB5MQswCQYDVQQGEwJK<u></u>__UDEL<br>
MAkGA1UECAwCVEsxDDAKBgNVBAcMA1<u></u>__<u></u>RLSzELMAkGA1UECgwCTVcxDDAKBgNV<u></u>__BAsM<br>
A29wczEcMBoGA1UEAwwTdmFncmFudC<u></u>__<u></u>5sb2NhbGRvbWFpbjEWMBQGCSqGSIb3<u></u>__DQEJ<div class="im"><br>
[snip]<br>
<br>
<br>
Try removing everything before the -----BEGIN CERTIFICATE----- line<br>
from the PEM.<br>
<br>
Well that was unexpected: removing the BEGIN Certificate / End lines now<br>
makes the install proceed up until:<br>
<br>
The log file for this installation can be found in<br>
/var/log/ipaserver-install.log<br>
The PKCS#10 certificate is not signed by the external CA (unknown issuer<br></div>
E=<a href="mailto:x@x.com" target="_blank">x@x.com</a> <mailto:<a href="mailto:x@x.com" target="_blank">x@x.com</a>>,CN=vagrant-<u></u>centos-6,OU=JP,O=JP,L=JP,ST=<u></u>JP,C=JP).<br>
</blockquote>
<br>
Can you please post more (all) of /var/lig/ipaserver-install.<u></u>log? We need to know where exactly the issue is occuring and what the traceback is.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Do I need to do anything to make my freshly created internal CA trusted<br>
for the installation? I've tried the usual magic in /etc/pki/tls/certs,<br>
but to no avail.<br>
</blockquote>
<br></div>
No, --external_ca_file should have been enough.<span class="HOEnZb"><font color="#888888"><br>
<br>
-- <br>
Petrł<br>
</font></span></blockquote></div><br></div>