<html><head></head><body data-style="font-family: Monospace;"><div>Hi all,</div><div><br></div><div>I tried to install freeipa server (freeipa-server.armv7hl 4.2.3-1.1.fc23), but the installation failed.</div><div><br></div><div>-----------------------------------------------------</div><div>Configuring NTP daemon (ntpd)</div><div> [1/4]: stopping ntpd</div><div> [2/4]: writing configuration</div><div> [3/4]: configuring ntpd to start on boot</div><div> [4/4]: starting ntpd</div><div>Done configuring NTP daemon (ntpd).</div><div>Configuring directory server (dirsrv). Estimated time: 1 minute</div><div> [1/43]: creating directory server user</div><div> [2/43]: creating directory server instance</div><div> [3/43]: adding default schema</div><div> [4/43]: enabling memberof plugin</div><div> [5/43]: enabling winsync plugin</div><div> [6/43]: configuring replication version plugin</div><div> [7/43]: enabling IPA enrollment plugin</div><div> [8/43]: enabling ldapi</div><div> [9/43]: configuring uniqueness plugin</div><div> [10/43]: configuring uuid plugin</div><div> [11/43]: configuring modrdn plugin</div><div> [12/43]: configuring DNS plugin</div><div> [13/43]: enabling entryUSN plugin</div><div> [14/43]: configuring lockout plugin</div><div> [15/43]: creating indices</div><div> [16/43]: enabling referential integrity plugin</div><div> [17/43]: configuring certmap.conf</div><div> [18/43]: configure autobind for root</div><div> [19/43]: configure new location for managed entries</div><div> [20/43]: configure dirsrv ccache</div><div> [21/43]: enable SASL mapping fallback</div><div> [22/43]: restarting directory server</div><div> [23/43]: adding default layout</div><div> [24/43]: adding delegation layout</div><div> [25/43]: creating container for managed entries</div><div> [26/43]: configuring user private groups</div><div> [27/43]: configuring netgroups from hostgroups</div><div> [28/43]: creating default Sudo bind user</div><div> [29/43]: creating default Auto Member layout</div><div> [30/43]: adding range check plugin</div><div> [31/43]: creating default HBAC rule allow_all</div><div> [32/43]: creating default CA ACL rule</div><div> [33/43]: adding entries for topology management</div><div> [34/43]: initializing group membership</div><div> [35/43]: adding master entry</div><div> [36/43]: initializing domain level</div><div> [37/43]: configuring Posix uid/gid generation</div><div> [38/43]: adding replication acis</div><div> [39/43]: enabling compatibility plugin</div><div> [40/43]: activating sidgen plugin</div><div> [41/43]: activating extdom plugin</div><div> [42/43]: tuning directory server</div><div> [43/43]: configuring directory to start on boot</div><div>Done configuring directory server (dirsrv).</div><div>Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds</div><div> [1/25]: creating certificate server user</div><div> [2/25]: configuring certificate server instance</div><div> [3/25]: stopping certificate server instance to update CS.cfg</div><div> [4/25]: backing up CS.cfg</div><div> [5/25]: disabling nonces</div><div> [6/25]: set up CRL publishing</div><div> [7/25]: enable PKIX certificate path discovery and validation</div><div> [8/25]: starting certificate server instance</div><div> [9/25]: creating RA agent certificate database</div><div> [10/25]: importing CA chain to RA certificate database</div><div> [11/25]: fixing RA database permissions</div><div> [12/25]: setting up signing cert profile</div><div> [13/25]: setting audit signing renewal to 2 years</div><div> [14/25]: restarting certificate server</div><div> [15/25]: requesting RA certificate from CA</div><div> [16/25]: issuing RA agent certificate</div><div> [17/25]: adding RA agent as a trusted user</div><div> [18/25]: authorizing RA to modify profiles</div><div> [19/25]: configure certmonger for renewals</div><div> [20/25]: configure certificate renewals</div><div> [21/25]: configure RA certificate renewal</div><div> [22/25]: configure Server-Cert certificate renewal</div><div> [23/25]: Configure HTTP to proxy connections</div><div> [24/25]: restarting certificate server</div><div> [25/25]: Importing IPA certificate profiles</div><div>Done configuring certificate server (pki-tomcatd).</div><div>Configuring directory server (dirsrv). Estimated time: 10 seconds</div><div> [1/3]: configuring ssl for ds instance</div><div> [error] RuntimeError: Certificate issuance failed</div><div>ipa.ipapython.install.cli.install_tool(Server): ERROR Certificate issuance failed </div><div><br></div><div>-----------------------------------------------</div><div><br></div><div>The last messages in the log file (/var/log/ipaserver-install.log):</div><div><br></div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 637, in __enable_ssl</div><div> self.nickname, self.fqdn, cadb)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py", line 337, in create_server_cert</div><div> cdb.issue_server_cert(self.certreq_fname, self.certder_fname)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py", line 419, in issue_server_cert</div><div> raise RuntimeError("Certificate issuance failed")</div><div><br></div><div>2016-01-08T09:33:47Z DEBUG The ipa-server-install command failed, exception: RuntimeError: Certificate issuance failed</div><div>2016-01-08T09:33:47Z ERROR Certificate issuance failed</div><div><br></div><div>any ideas about this error?</div><div><br></div><div>Markus</div></body></html>