<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 01/11/2014 09:20 AM, Charlie Derwent wrote:
<blockquote
cite="mid:CA+W6xetksaGOW6kpT-XqfVzhbtDfpERdPsu4yBZ4=JukwiY37A@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Hi </div>
<div><br>
</div>
<div>I'm experiencing an issue trying to use ipa-getcert on my
IPA clients. </div>
<div><br>
</div>
<div>When I run a command similar to this</div>
<div><font face="courier new,monospace">ipa-getcert request -K
principal/`hostname` -D `hostname` \</font>
<div>
<font face="courier new,monospace"><code> </code><code>-k
/var/lib/ssl/private_keys/`hostname`.pem \</code></font></div>
<div><font face="courier new,monospace"><code> </code><code>-f
/var/lib/ssl/certs/`hostname`.pem</code></font></div>
</div>
<div><br>
</div>
<div>Sometimes it will work, but 9 times out of 10 an
"ipa-getcert list" will show the request failed with a status
of CA_UNREACHABLE. I'm fairly certain it's not a time
related issue as I tend to run the command just after
enrolment and our NTP servers are rock solid. </div>
<div><br>
</div>
<div>Now please correct me if I'm wrong (because it feels like I
am wrong) but I think this is happening because not all of my
replicas are Certificate Authorities but the clients are
still trying to validate their certificate signing
requests with them. </div>
<div><br>
</div>
<div>Am I mistaken? Have I misconfigured something? If my theory
is correct is there a way to force the client to only talk to
the replica(s) running the CA service for these types
of tasks?</div>
<div><br>
</div>
<div>Anyway to try and get round the issue I decided to try and
make all my IPA replicas Certificate Authorities and ran into
the issue linked below</div>
<div><br>
</div>
<div><font color="#000000"><span id="summary_alias_container">Bug
905064 - <span id="short_desc_nonedit_display">ipa
install error Unable to find preop.pin</span></span></font></div>
<div><a moz-do-not-send="true"
href="https://bugzilla.redhat.com/show_bug.cgi?id=905064">https://bugzilla.redhat.com/show_bug.cgi?id=905064</a></div>
<div><br>
</div>
<div>This has stopped me from rolling out the CA functionality
across all of my replicas (and I almost trashed a replica in
the process of trying to work around it). </div>
<div><br>
</div>
<div>I'm not really bothered which way I go about solving the
problem but would really appreciate some assistance as it
feels like I'm stuck between a rock and a hard place.</div>
<div><br>
</div>
<div>
Thanks,</div>
<div>Charlie</div>
<div><br>
</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
Even if the replica does not have CA it has code to turn around and
proxy request to the corresponding replica that has CA.<br>
The first thing to check is the logs on the certmonger side that
does the certificate request to see which replica it is trying to
connect and httpd logs from the replica it tries to hit. If the
requests do not hit (which I suspect the case since the client
returned CA_UNREACHABLE) then it might be a firewall issue between
the client and the replica. If it hits the server but server fails
to proxy and returns CA_UNREACHABLE to the client then it is
probably a FW issue between replicas.<br>
<br>
At least this is where I would dig.<br>
<br>
Also the bug you mentioned is a race condition and seems like a rare
one so there is a chance it would not happen all the time if you try
more than once or may be choose a different system.<br>
Do you hit every time you try?<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>