<div dir="ltr"><div>1. Create replica ipa-1 from old-ipa-1</div><div>2. Followed procedure documented at <a href="http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master">http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master</a> to make ipa-1 the node responsible for CRL generation and CA renewal</div><div>3. Prepare ipa-2 to be a replica by running 'ipa-replica-prepare <a href="http://ipa-2.example.com">ipa-2.example.com</a>' on ipa-1 and copying over the resulting gpg</div><div>4. Ran ipa-replica-install on ipa-2 and received the following output/failure:</div><div><br></div><div>===================</div><div><br></div><div>[root@ipa-2 ~]# ipa-replica-install --setup-ca /var/lib/ipa/replica-info-ipa-2.example.com.gpg </div><div>Directory Manager (existing master) password: </div><div><br></div><div>Run connection check to master</div><div>Check connection from replica to remote master '<a href="http://ipa-1.example.com">ipa-1.example.com</a>':</div><div> Directory Service: Unsecure port (389): OK</div><div> Directory Service: Secure port (636): OK</div><div> Kerberos KDC: TCP (88): OK</div><div> Kerberos Kpasswd: TCP (464): OK</div><div> HTTP Server: Unsecure port (80): OK</div><div> HTTP Server: Secure port (443): OK</div><div> PKI-CA: Directory Service port (7389): OK</div><div><br></div><div>The following list of ports use UDP protocol and would need to be</div><div>checked manually:</div><div> Kerberos KDC: UDP (88): SKIPPED</div><div> Kerberos Kpasswd: UDP (464): SKIPPED</div><div><br></div><div>Connection from replica to master is OK.</div><div>Start listening on required ports for remote master check</div><div>Get credentials to log in to remote master</div><div><a href="mailto:admin@EXAMPLE.COM">admin@EXAMPLE.COM</a> password: </div><div><br></div><div>Execute check on remote master</div><div>Check connection from master to remote replica '<a href="http://ipa-2.example.com">ipa-2.example.com</a>':</div><div> Directory Service: Unsecure port (389): OK</div><div> Directory Service: Secure port (636): OK</div><div> Kerberos KDC: TCP (88): OK</div><div> Kerberos KDC: UDP (88): OK</div><div> Kerberos Kpasswd: TCP (464): OK</div><div> Kerberos Kpasswd: UDP (464): OK</div><div> HTTP Server: Unsecure port (80): OK</div><div> HTTP Server: Secure port (443): OK</div><div> PKI-CA: Directory Service port (7389): OK</div><div><br></div><div>Connection from master to replica is OK.</div><div><br></div><div>Connection check OK</div><div>Configuring NTP daemon (ntpd)</div><div> [1/4]: stopping ntpd</div><div> [2/4]: writing configuration</div><div> [3/4]: configuring ntpd to start on boot</div><div> [4/4]: starting ntpd</div><div>Done configuring NTP daemon (ntpd).</div><div>Configuring directory server for the CA (pkids): Estimated time 30 seconds</div><div> [1/3]: creating directory server user</div><div> [2/3]: creating directory server instance</div><div> [3/3]: restarting directory server</div><div>Done configuring directory server for the CA (pkids).</div><div>Configuring certificate server (pki-cad): Estimated time 3 minutes 30 seconds</div><div> [1/17]: creating certificate server user</div><div> [2/17]: creating pki-ca instance</div><div> [3/17]: configuring certificate server instance</div><div>ipa : CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname <a href="http://ipa-2.example.com">ipa-2.example.com</a> -cs_port 9445 -client_certdb_dir /tmp/tmp-ATedaS -client_certdb_pwd XXXXXXXX -preop_pin SAW89xQS4ICFy5zYWv0m -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ldap_host <a href="http://ipa-2.example.com">ipa-2.example.com</a> -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_subsystem_cert_subject_name CN=CA Subsystem,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_server_cert_subject_name CN=<a href="http://ipa-2.example.com">ipa-2.example.com</a>,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_audit_signing_cert_subject_name CN=CA Audit,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_sign_cert_subject_name CN=Certificate Authority,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -external false -clone true -clone_p12_file ca.p12 -clone_p12_password XXXXXXXX -sd_hostname <a href="http://ipa-1.example.com">ipa-1.example.com</a> -sd_admin_port 443 -sd_admin_name admin -sd_admin_password XXXXXXXX -clone_start_tls true -clone_uri <a href="https://ipa-1.example.com:443">https://ipa-1.example.com:443</a>' returned non-zero exit status 255</div><div><br></div><div>Your system may be partly configured.</div><div>Run /usr/sbin/ipa-server-install --uninstall to clean up.</div><div><br></div><div>Configuration of CA failed</div><div><br></div><div>===================</div><div><br></div><div>Found the following in /var/log/ipareplica-install.log:</div><div><br></div><div>--snip--</div><div>#############################################</div><div>Attempting to connect to: <a href="http://ipa-2.example.com:9445">ipa-2.example.com:9445</a></div><div>Connected.</div><div>Posting Query = <a href="https://ipa-2.example.com:9445//ca/admin/console/config/wizard?p=5&subsystem=CA&session_id=4306304501997072616&xml=true">https://ipa-2.example.com:9445//ca/admin/console/config/wizard?p=5&subsystem=CA&session_id=4306304501997072616&xml=true</a></div><div>RESPONSE STATUS: HTTP/1.1 200 OK</div><div>RESPONSE HEADER: Server: Apache-Coyote/1.1</div><div>RESPONSE HEADER: Content-Type: text/html;charset=UTF-8</div><div>RESPONSE HEADER: Date: Fri, 12 Dec 2014 20:47:08 GMT</div><div>RESPONSE HEADER: Connection: close</div><div>Exception in SecurityDomainLoginPanel(): java.lang.Exception: Invalid clone_uri</div><div>ERROR: ConfigureSubCA: SecurityDomainLoginPanel() failure</div><div>ERROR: unable to create CA</div><div><br></div><div>#######################################################################</div><div><br></div><div>2014-12-12T20:47:08Z DEBUG stderr=java.lang.Exception: Invalid clone_uri</div><div><span class="" style="white-space:pre"> </span>at ConfigureCA.SecurityDomainLoginPanel(ConfigureCA.java:392)</div><div><span class="" style="white-space:pre"> </span>at ConfigureCA.ConfigureCAInstance(ConfigureCA.java:1188)</div><div><span class="" style="white-space:pre"> </span>at ConfigureCA.main(ConfigureCA.java:1672)</div><div><br></div><div>2014-12-12T20:47:08Z CRITICAL failed to configure ca instance Command '/usr/bin/perl /usr/bin/pkisilent ConfigureCA -cs_hostname <a href="http://ipa-2.example.com">ipa-2.example.com</a> -cs_port 9445 -client_certdb_dir /tmp/tmp-ATedaS -client_certdb_pwd XXXXXXXX -preop_pin SAW89xQS4ICFy5zYWv0m -domain_name IPA -admin_user admin -admin_email root@localhost -admin_password XXXXXXXX -agent_name ipa-ca-agent -agent_key_size 2048 -agent_key_type rsa -agent_cert_subject CN=ipa-ca-agent,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ldap_host <a href="http://ipa-2.example.com">ipa-2.example.com</a> -ldap_port 7389 -bind_dn cn=Directory Manager -bind_password XXXXXXXX -base_dn o=ipaca -db_name ipaca -key_size 2048 -key_type rsa -key_algorithm SHA256withRSA -save_p12 true -backup_pwd XXXXXXXX -subsystem_name pki-cad -token_name internal -ca_subsystem_cert_subject_name CN=CA Subsystem,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_subsystem_cert_subject_name CN=CA Subsystem,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_ocsp_cert_subject_name CN=OCSP Subsystem,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_server_cert_subject_name CN=<a href="http://ipa-2.example.com">ipa-2.example.com</a>,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_audit_signing_cert_subject_name CN=CA Audit,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -ca_sign_cert_subject_name CN=Certificate Authority,O=<a href="http://EXAMPLE.COM">EXAMPLE.COM</a> -external false -clone true -clone_p12_file ca.p12 -clone_p12_password XXXXXXXX -sd_hostname <a href="http://ipa-1.example.com">ipa-1.example.com</a> -sd_admin_port 443 -sd_admin_name admin -sd_admin_password XXXXXXXX -clone_start_tls true -clone_uri <a href="https://ipa-1.example.com:443">https://ipa-1.example.com:443</a>' returned non-zero exit status 255</div><div>2014-12-12T20:47:08Z INFO File "/usr/lib/python2.6/site-packages/ipaserver/install/installutils.py", line 614, in run_script</div><div> return_value = main_function()</div><div><br></div><div> File "/usr/sbin/ipa-replica-install", line 476, in main</div><div> (CA, cs) = cainstance.install_replica_ca(config)</div><div><br></div><div> File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 1626, in install_replica_ca</div><div> subject_base=config.subject_base)</div><div><br></div><div> File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 626, in configure_instance</div><div> self.start_creation(runtime=210)</div><div><br></div><div> File "/usr/lib/python2.6/site-packages/ipaserver/install/service.py", line 358, in start_creation</div><div> method()</div><div><br></div><div> File "/usr/lib/python2.6/site-packages/ipaserver/install/cainstance.py", line 888, in __configure_instance</div><div> raise RuntimeError('Configuration of CA failed')</div><div><br></div><div>2014-12-12T20:47:08Z INFO The ipa-replica-install command failed, exception: RuntimeError: Configuration of CA failed</div><div>--snip--</div><div><br></div><div>===================</div><div><br></div><div>I've searched high and low for a solution and the closest I've found is this exchange from Sept 2013 - <a href="http://www.redhat.com/archives/freeipa-users/2013-September/msg00203.html">http://www.redhat.com/archives/freeipa-users/2013-September/msg00203.html</a> - which doesn't have a resolution. My issue is almost identical with the exception of newer revisions:</div><div><br></div><div>Linux <a href="http://ipa-2.example.com">ipa-2.example.com</a> 2.6.32-504.1.3.el6.x86_64 #1 SMP Tue Nov 11 17:57:25 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux</div><div>ipa-server-3.0.0-42.el6.x86_64</div><div>pki-selinux-9.0.3-38.el6_6.noarch</div><div><br></div><div class="gmail_signature"></div> </div>